Friday, June 28, 2019

Welcome - AI Itineraries app for iOS - share extension on TOS, Privacy Policy and Attribution pages does not work

Welcome - AI Itineraries app for iOS (version 1.0.4)
Date: 06/28/2019

Description:

The share extension on the Terms of Service, Privacy Policy and Attribution pages accessible from the Settings area of the app does work. Pressing them does nothing.

Please take a look at the attached screenshots below.

Steps to Reproduce:

1. Download and launch the Welcome - AI Itineraries app for iOS (version 1.0.4)
2. Create an account
3. Head to Settings for the account
4. Select either Terms of Service, Privacy Policy or Attribution
5. From any one of these pages, press the share extension in the bottom right hand corner of the screen

Result: The share extension on the Terms of Service, Privacy Policy and Attribution pages does not work - nothing happens when it is selected

Expected: The share extension on the Terms of Service, Privacy Policy and Attribution pages should work - or it should be removed

Head to this page and select either Terms of Service, Privacy Policy or Attribution...

Select the share extension in the bottom right. Nothing happens!
Non-working share extension.

Non-working share extension.

Wednesday, June 26, 2019

Blue Nile app for iOS - App crashes when offline

Blue Nile app for iOS (version 4.3.6)
Date: 06/26/2019

Description:

The Blue Nile app for iOS frequently crashes when offline:

While I doubt this is important to many end users, I have seen these crashes quickly fixed with other apps.

Steps to Reproduce:

1. Turn off the internet connection to the iOS device
2. Launch the Blue Nile app (version 4.3.6)
3. Select "Dream Box"
4. Wait two seconds - tap on the share option

Result: The Blue Nile app for iOS frequently crashes when offline, if the user selects "Dream Box" and then presses the share option

Expected: The Blue Nile app for iOS should never crash when offline

Here are some screenshots:

Select "Dream Box"....

Take a look at the sharing option in the upper right...

Select the share option - app crashes.


Sunday, June 23, 2019

JOANN - Shopping & Crafts app for iOS: Selecting EXPORT VIDEO crashes the app

JOANN - Shopping & Crafts app for iOS (version 6.2.3)
Date: 06/23/2019

Description:

There is an easy to reproduce crash with the current (version 6.2.3) version of the JOANN - Shopping & Crafts app for iOS.

The app will continually crash if the user denies camera access for recording videos, and then selects the Export video option.

This crash looks to reproduce 100% of the time.

This is easier to show than it is to describe, so please see this video:


Steps to Reproduce:

1. Download and launch the JOANN app
2. Create an account
3. Select the "... More" option from the bottom right
4. Select the "Submit Your Story" option
5. From the "Submit Your Story" screen, select the "Submit Your Story" black button option
6. Select the "+ Create Video" option
7. From the "JOANN Would Like to Access Your Photos" prompt, select "Don't Allow"
8. Click on "RECORD VIDEO"
9. From the "Please open Settings and give the JoAnn application access to your photos." prompt select "Close"
10. Back and out and select "+ Create Video"
11. Select "EXPORT VIDEO"

Result: Selecting the "EXPORT VIDEO" option will crash the app, if the user has denied camera access to the app

Expected: The app should not crash if the user select "EXPORT VIDEO" with camera access denied

Monday, June 17, 2019

Win-Kel app for iOS: XSS: Account name of "plaintext" breaks the Rental Agreement

Win-Kel Storage app for iOS (version 4.6.2)
Date: 06/17/2019

Description:

If you create an account using "<plaintext>" as your first and last names, this will result in the Legal Text on the EULA breaking.

Here is a screenshot of the Rental Agreement Legal Page, using a regular name of "Roger William":

The page looks normal, as you can see.

Let's take a look at what happens when you changer your first and last name to "<plaintext>"

Change your first and last name to "<plaintext>"...

The first and last names have been changed to "<plaintext>" - now go back and look at the rental agreement...

As you can see, this page cannot handle "<plaintext>" being inserted.

Steps to Reproduce:

1. Download the Win-Kel app for iOS
2. Create an account with the first and last name of "<plaintext>"
3. Look at the Rental Agreement

Result: Using "<plaintext>" as a first and last name for a Win-Kel account breaks the HTML on the Rental Agreement page

Expected: The "<>" characters should probably be restricted in the first and last name fields of the app

Sunday, June 16, 2019

Win-Kel app for iOS: Minor Typo: The word "successfully" is misspelled

Win-Kel app for iOS (version 4.6.2)
Date: 06/16/2019

Description:

There is a minor typo that appears in the app during account creation.

Take a look:

The app misspells "successfully" in this message.

Steps to Reproduce:

1. Download the Win-Kel app for iOS (version 4.6.2)
2. Proceed through the account creation process
3. Note the error message: "You have just sucessfuly registered!"

Result: There is a typo in a confirmation message during the account creation process

Expected: No typo during the account creation process

Flyhomes for iOS: Restricting Microphone access doesn't seem to work

Flyhomes app for iOS (version 2.1.7)
Date: 06/16/2019

Description:

I found an interesting problem with the Flyhomes app for iOS. When using the Flyhomes app for a first time, a permissions message will appear.

This permissions message looks like this:

As you can see in this permissions message, it states that "Flyhomes would like to use your speech recognition to autocomplete fields."

Selecting "Don't Allow" to this message doesn't seem to do anything. I've read through this, and it sure seems to imply that if I select "Don't Allow" you are supposed to through up a request about how i've denied access.

Why isn't there an error message? Should you be showing this microphone prompt at all? I've seen other apps that just grant microphone access, without a prompt, after the user presses the button on the keyboard. Flyhomes is the first app i've seen that gives me such a prompt, then disregards my "Don't Allow" selection. This is confusing!

I understand that I could not really be understanding the specifics of using dictation, via the microphone, on the iOS keyboard. I've also seen more than one problem with permissions and the iOS device that left me extremely confused - and i've searched the internet to see people have also been confused.

I've never seen this particular problem before.

This could be:


  • A specific problem with a permissions dialog in the Flyhomes app (possible)
  • Me not understanding permissions with the iOS device (possible)
  • A very poorly worded permissions message in the Flyhomes app (less likely)
  • An incorrectly places and/or unnecessary prompt in the Flyhomes app (most likely)
  • A problem with the iOS (least possible)
This one is much harder to describe, than it is to show, so please take a look at the following video...


In the video, dictation is allowed on the iOS device, while "Siri and Search" is disabled. You then launch the app for the first time, and are presented with the prompt. The prompt specifically says that you are requesting to use speech recognition to autocomplete fields!

Steps to Reproduce.

1. On either an iPhone or an iPad Mini, download the RealFlyhomes app for iOS
2. Before launching the app - make sure dictation is enabled on the keyboard
3. Launch the app - decline location and notifications
4. Click inside the search box
5. Press the microphone on the keyboard
6. Select "Don't Allow" for microphone access
7. Exit out and look at the Flyhomes area in the Settings section of the iPhone device
8. Note that "Speech Recognition" is OFF
9. Enter back into the app, press the microphone on the keyboard, say a term, and watch the text box autocomplete

Result: The "Don't Allow" option of the Microphone Permissions dialog box doesn't seem to work - even after declining Speech Recognition" permission, the app still uses it for subsequent searches

Expected: I don't think you should even be showing this message at this point - you certainly shouldn't be disregarding a "Don't Allow" response from the user...

Download the app fresh onto an iOS device...

Select "Don't Allow" from this prompt. My expectation is that the app will NOT use speech recognition to autocomplete fields....

Exit out of the app. In Settings, the fact that "Speech Recognition" is prohibited is clearly displayed.

Select the microphone prompt (why does it appear if I selected "Don't Allow" from the prompt?) and then say a term like "Seattle Washington"....

After I said a term, it uses speech recognition to autocomplete the form. I SPECIFICALLY denied this permission in the dialog!!!