[Bug]: Camera plugin allows to access the photo gallery and pick the photo(s) even if the user has not granted the required permission

[ryaa]

Capacitor Version

💊 Capacitor Doctor 💊

Latest Dependencies:

@capacitor/cli: 5.7.2
@capacitor/core: 5.7.2
@capacitor/android: 5.7.2
@capacitor/ios: 5.7.2

Installed Dependencies:

@capacitor/ios: not installed
@capacitor/cli: 5.7.2
@capacitor/android: 5.7.2
@capacitor/core: 5.7.2

Other API Details

alexryltsov@Alexs-MacBook-Pro-2 master % npm --version
10.5.0
alexryltsov@Alexs-MacBook-Pro-2 master % node --version
v20.11.1
alexryltsov@Alexs-MacBook-Pro-2 master % pod --version
Ignoring ffi-1.15.5 because its extensions are not built. Try: gem pristine ffi --version 1.15.5
Ignoring ffi-1.15.5 because its extensions are not built. Try: gem pristine ffi --version 1.15.5
1.15.2

Platforms Affected

• iOS
• Android
• Web

Current Behavior

When the user chooses to pick images/photos and does not grant the permission to access the gallery, the camera plugin ignores this and allows to access the images/photos in the gallery - see here

Please note that camera plugin taking photos feature does respect the permission.

For the detailed reproduction scenario please see https://github.com/ryaa/camera-pick-images-denied-permission-ignored

Expected Behavior

My assumption is that the behavior should be consistent for both the photo picker and the camera. The user should not be allowed to select a photo from the gallery if the permission has not been granted.

Project Reproduction

https://github.com/ryaa/camera-pick-images-denied-permission-ignored

Additional Information

The problem seems to be because the permission callback simply opens the photo gallery and ignores the denied permission status - see https://github.com/ionic-team/capacitor-plugins/blob/5.x/camera/android/src/main/java/com/capacitorjs/plugins/camera/CameraPlugin.java#L244
Here is the PR with a potential fix - see ionic-team/capacitor-plugins#2052

It also seems that this issue might be fixed in Capacitor 6.x