[Tracking Requested - why for this release]: *Environment* Firefox: Nightly 54.0a1 Server: -dev OS: Windows 10 *Steps to reproduce* 1. Install a webextension with permissions. 2. Go to about:addons and verify the permissions can be accessed to be reviewed by the user. *Expected results* Being a more sensible feature, Permissions should also be displayed in about:addons, to be accessible at any time the user would want to review them. *Actual results* Permissions are not available in about:addons for the installed extensions. *Notes* 1. Chrome has already implemented this in a details popup for the respective extension.

Markus is working on UX for this...andy duping bug

https://trello.com/c/APtW1sdF/128-user-test-extension-install-flow-surfacing-permissions, couldn't find a bug for it so perhaps this will become the main tracker. I don't think this is a blocker for 57.

I agree, not a blocker. I think it is enough for a first implementation if we list permissions on the detail page of the extension in about:addons as part of the table below the extensions description.

Any idea when this might get worked on? It seems pretty helpful for tracking down abusive add-ons.

So this is fairly simple to implement: aAddon.userPermissions already lists required permissions, and currently active optional permissions can be queried with ExtensionPermissions.get(). ExtensionData.formatPermissionStrings() can then convert said perms into the same user-facing strings/explanations as the install doorhanger uses. The real issues are over the UX design. - Should perms just be listed in the usual details page for an extension, or should it maybe be a subpage accessed by a permissions button (comment 3 suggests the first for now) - Should the same omission of permissions be performed as in the doorhanger (e.g. no listing of menus, storage etc.) - Should the same domain elision be performed as in the doorhanger for domains > 5 - Should optional permissions be listed separately or intermingled - Should "origins" and "permissions" be listed separately or intermingled - Should there be a "revoke all" button for optional permissions (or even individual revoke buttons) (could be a separate bug if yes) I'd be willing to work on this, with some guidance on the above issues (I whipped together a rough prototype quickly, to figure out how doable it is)

I noticed today that permissions for already installed add-ons are not visible. Would be great if this could be worked on, it's a very important part of the add-ons system! A short note about the permission omission: Be careful not to omit too many basic permissions. For example, in Android, the "access Internet" permission is not shown anymore, even though an app can request it or not. If the permission is not shown to the user, the app developers have very little incentive to always request it, even if they don't need it (since it does not look like a "permission hungry" app to the user either way). What might be interesting is showing all permissions, but grouping them by criticality. Accessing all website data is much more critical than being able to query installed add-ons or changing styling.