starred/floccus

Fork 0

mirror of https://github.com/floccusaddon/floccus.git synced 2026-04-27 07:05:59 +03:00

[GH-ISSUE #1637] Permission or Documentation Problem: Browser History Access Requested #1085

New issue

Closed

opened 2026-02-25 22:38:57 +03:00 by kerem · 6 comments

kerem commented

2026-02-25 22:38:57 +03:00

Owner

Originally created by @gohrner on GitHub (Jun 12, 2024).
Original GitHub issue: https://github.com/floccusaddon/floccus/issues/1637

Which version of floccus are you using?

5.2.0.3

How many bookmarks do you have, roughly?

Are you using other means to sync bookmarks in parallel to floccus?

Sync method

WebDAV

Which browser are you using? In case you are using the phone App, specify the Android or iOS version and device please.

Chromium

Which version of Nextcloud Bookmarks are you using? (if relevant)

Which version of Nextcloud? (if relevant)

What kind of WebDAV server are you using? (if relevant)

Apache httpd

Describe the Bug

Today, Floccus was blocked by Chromium, as it seems to require an additional permission:

I didn't find info about it in the release notes, and this new permission is not documented:

https://floccus.org/guides/

Permission	Explanation
storage, unlimitedStorage	Necessary for maintaining a cache and mappings between server and browser bookmarks
alarms	Necessary for triggering synchronization in regular intervals
bookmarks	Necessary for creating and reading bookmarks
Unlimited web access	Necessary for accessing your self-hosted server. This cannot be limited, because everybody's server has a different URL. Unfortunately, the way webextensions work currently, floccus also gets access to all the data the browser has collected on those websites. However, floccus makes no use of that data and doesn't in any way collect information about you.
identity	Necessary for connecting with Google Drive

So I wondered if this is legit - it probably is, but there also have been more than enough reports of hijacked extensions (or whole Open Source projects, see liblzma), so I wanted to be sure.

Expected Behavior

New permissions required to use the browser extension should be documented and also mentioned in the release notes.

To Reproduce

I really didn't do anything and it broke, so I assume it's sufficient to install an older release of the Floccus Chromium extension and let the auto-update do its job.

Debug log provided

I have provided a debug log file

Originally created by @gohrner on GitHub (Jun 12, 2024). Original GitHub issue: https://github.com/floccusaddon/floccus/issues/1637 ### Which version of floccus are you using? 5.2.0.3 ### How many bookmarks do you have, roughly? 50 ### Are you using other means to sync bookmarks in parallel to floccus? No ### Sync method WebDAV ### Which browser are you using? In case you are using the phone App, specify the Android or iOS version and device please. Chromium ### Which version of Nextcloud Bookmarks are you using? (if relevant) -- ### Which version of Nextcloud? (if relevant) -- ### What kind of WebDAV server are you using? (if relevant) Apache httpd ### Describe the Bug Today, Floccus was blocked by Chromium, as it seems to require an additional permission: ![image](https://github.com/floccusaddon/floccus/assets/26199042/2590058b-e594-48a0-a227-bde35bd3c0ae) I didn't find info about it in the release notes, and this new permission is not documented: https://floccus.org/guides/ ```plain Permission Explanation storage, unlimitedStorage Necessary for maintaining a cache and mappings between server and browser bookmarks alarms Necessary for triggering synchronization in regular intervals bookmarks Necessary for creating and reading bookmarks Unlimited web access Necessary for accessing your self-hosted server. This cannot be limited, because everybody's server has a different URL. Unfortunately, the way webextensions work currently, floccus also gets access to all the data the browser has collected on those websites. However, floccus makes no use of that data and doesn't in any way collect information about you. identity Necessary for connecting with Google Drive ``` So I wondered if this is legit - it probably is, but there also have been more than enough reports of hijacked extensions (or whole Open Source projects, see `liblzma`), so I wanted to be sure. ### Expected Behavior New permissions required to use the browser extension should be documented and also mentioned in the release notes. ### To Reproduce I really didn't do anything and it broke, so I assume it's sufficient to install an older release of the Floccus Chromium extension and let the auto-update do its job. ### Debug log provided - [ ] I have provided a debug log file

kerem

2026-02-25 22:38:57 +03:00

closed this issue
added the
question
label

kerem commented

2026-02-25 22:38:58 +03:00

Author

Owner

@github-actions[bot] commented on GitHub (Jun 12, 2024):

Hello 👋

Thank you for taking the time to open this issue with floccus. I know it's frustrating when software
causes problems. You have made the right choice to come here and open an issue to make sure your problem gets looked at
and if possible solved.
I'm Marcel and I created floccus and have been maintaining it ever since.
I currently work for Nextcloud which leaves me with less time for side projects like this one
than I used to have.
I still try to answer all issues and if possible fix all bugs here, but it sometimes takes a while until I get to it.
Until then, please be patient.
Note also that GitHub is a place where people meet to make software better together. Nobody here is under any obligation
to help you, solve your problems or deliver on any expectations or demands you may have, but if enough people come together we can
collaborate to make this software better. For everyone.
Thus, if you can, you could also have a look at other issues to see whether you can help other people with your knowledge
and experience. If you have coding experience it would also be awesome if you could step up to dive into the code and
try to fix the odd bug yourself. Everyone will be thankful for extra helping hands!
One last word: If you feel, at any point, like you need to vent, this is not the place for it; you can go to the forum,
to twitter or somewhere else. But this is a technical issue tracker, so please make sure to
focus on the tech and keep your opinions to yourself.

I look forward to working with you on this issue
Cheers 💙

@github-actions[bot] commented on GitHub (Jun 12, 2024): Hello :wave: Thank you for taking the time to open this issue with floccus. I know it's frustrating when software causes problems. You have made the right choice to come here and open an issue to make sure your problem gets looked at and if possible solved. I'm Marcel and I created floccus and have been maintaining it ever since. I currently work for Nextcloud which leaves me with less time for side projects like this one than I used to have. I still try to answer all issues and if possible fix all bugs here, but it sometimes takes a while until I get to it. Until then, please be patient. Note also that GitHub is a place where people meet to make software better *together*. Nobody here is under any obligation to help you, solve your problems or deliver on any expectations or demands you may have, but if enough people come together we can collaborate to make this software better. For everyone. Thus, if you can, you could also have a look at other issues to see whether you can help other people with your knowledge and experience. If you have coding experience it would also be awesome if you could step up to dive into the code and try to fix the odd bug yourself. Everyone will be thankful for extra helping hands! One last word: If you feel, at any point, like you need to vent, this is not the place for it; you can go to the forum, to twitter or somewhere else. But this is a technical issue tracker, so please make sure to focus on the tech and keep your opinions to yourself. I look forward to working with you on this issue Cheers :blue_heart:

kerem commented

2026-02-25 22:38:58 +03:00

Author

Owner

@marcelklehr commented on GitHub (Jun 12, 2024):

Ah, I'm sorry for the lack of documentation. I've updated the website and the release changelog: https://github.com/floccusaddon/floccus/releases/tag/v5.2.0

@marcelklehr commented on GitHub (Jun 12, 2024): Ah, I'm sorry for the lack of documentation. I've updated the website and the release changelog: https://github.com/floccusaddon/floccus/releases/tag/v5.2.0

kerem commented

2026-02-25 22:38:58 +03:00

Author

Owner

@BloodyIron commented on GitHub (Jun 13, 2024):

That doesn't include the v5.2.0.3 sub-version though. And what's up with this aspect? (it can now) "read and change all your data on all websites".

I'm re-enabling it myself, but making these aspects forced and not optional is concerning to me. Something like this should be off by default and an option I can choose to enable. Is that not possible here?

As in, I probably care about the click history stuff, that sounds useful. But the... "change all your data on all websites" part, really do want to see an explanation on that please.

@BloodyIron commented on GitHub (Jun 13, 2024): That doesn't include the v5.2.0.3 sub-version though. And what's up with this aspect? (it can now) "read and change all your data on all websites". I'm re-enabling it myself, but making these aspects forced and not optional is concerning to me. Something like this should be off by default and an option I can choose to enable. Is that not possible here? As in, I probably care about the click history stuff, that sounds useful. But the... "change all your data on all websites" part, really do want to see an explanation on that please.

kerem commented

2026-02-25 22:38:58 +03:00

Author

Owner

@marcelklehr commented on GitHub (Jun 13, 2024):

That doesn't include the v5.2.0.3 sub-version though

So, due to technical limitations, v5.2.0.3 is the same as v5.2.0; v5.2.0.{0-2} were beta versions.

read and change all your data on all websites

This has always been there. I wrote it down as "Unlimited web access". Due to how browsers implement this I can only ask for one permission to both send requests to all possible web hosts as well as read and change data on all websites. There is no distinction.

@marcelklehr commented on GitHub (Jun 13, 2024): > That doesn't include the v5.2.0.3 sub-version though So, due to technical limitations, v5.2.0.3 is the same as v5.2.0; v5.2.0.{0-2} were beta versions. > read and change all your data on all websites This has always been there. I wrote it down as "Unlimited web access". Due to how browsers implement this I can only ask for one permission to both *send requests to all possible web hosts* as well as *read and change data on all websites*. There is no distinction.

kerem commented

2026-02-25 22:38:58 +03:00

Author

Owner

@BloodyIron commented on GitHub (Jun 13, 2024):

That doesn't include the v5.2.0.3 sub-version though

So, due to technical limitations, v5.2.0.3 is the same as v5.2.0; v5.2.0.{0-2} were beta versions.

read and change all your data on all websites

This has always been there. I wrote it down as "Unlimited web access". Due to how browsers implement this I can only ask for one permission to both send requests to all possible web hosts as well as read and change data on all websites. There is no distinction.

Thanks for clarifying on the versioning, I see how that comes to be. Maybe make the "release" version (next time?) match the non-beta version to avoid confusion? :P So in this case in the releases section I'd think it reasonable to see v5.2.0.3 so that I know it matches what I'm running on my compie. I don't necessarily need to see the beta versions in the "releases" section of github, but the "prod" style versions would be appreciated in general please. :)
I hear you on the limited options on your end, and appreciate you clarifying on that. I don't think you necessarily inappropriately communicated the state of things in the release notes, just due to the nuances you just described there was a touch of alarm in my experience. And yeah it sounds like your options are rather limited, I empathise with your side of that.

Thanks for clarifying on all that and continuing your work on this tool! I love this extension and use it constantly on multiple computers. Yay! :D

@BloodyIron commented on GitHub (Jun 13, 2024): > > That doesn't include the v5.2.0.3 sub-version though > > So, due to technical limitations, v5.2.0.3 is the same as v5.2.0; v5.2.0.{0-2} were beta versions. > > > read and change all your data on all websites > > This has always been there. I wrote it down as "Unlimited web access". Due to how browsers implement this I can only ask for one permission to both _send requests to all possible web hosts_ as well as _read and change data on all websites_. There is no distinction. 1. Thanks for clarifying on the versioning, I see how that comes to be. Maybe make the "release" version (next time?) match the non-beta version to avoid confusion? :P So in this case in the releases section I'd think it reasonable to see v5.2.0.3 so that I know it matches what I'm running on my compie. I don't _necessarily_ need to see the beta versions in the "releases" section of github, but the "prod" style versions would be appreciated in general please. :) 2. I hear you on the limited options on your end, and appreciate you clarifying on that. I don't think you necessarily inappropriately communicated the state of things in the release notes, just due to the nuances you just described there was a touch of alarm in my experience. And yeah it sounds like your options are rather limited, I empathise with your side of that. Thanks for clarifying on all that and continuing your work on this tool! I love this extension and use it constantly on multiple computers. Yay! :D

kerem commented

2026-02-25 22:38:58 +03:00

Author

Owner

@github-actions[bot] commented on GitHub (Jun 14, 2025):

This issue has been automatically locked since there has not been any recent activity after it was closed. Please open a new issue for related bugs.

@github-actions[bot] commented on GitHub (Jun 14, 2025): This issue has been automatically locked since there has not been any recent activity after it was closed. Please open a new issue for related bugs.

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

starred/floccus#1085

No description provided.

Rows
Columns