doc(android): document AndroidInsecureFileModeEnabled

[NiklasMerz]

Platforms affected

Android

Motivation and Context

Document apache/cordova-android#1222

Description

Document setting and add warning from https://developer.android.com/reference/android/webkit/WebSettings#setAllowUniversalAccessFromFileURLs(boolean)

Testing

Checklist

• I've run the tests to see all new and existing tests pass
• I added automated test coverage as appropriate for this change
• Commit is prefixed with (platform) if this change only applies to one platform (e.g. (android))
• If this Pull Request resolves an issue, I linked to the issue in the text above (and used the correct keyword to close issues using keywords)
• I've updated the documentation if necessary

[jcesarmobile]

I think it should probably say something about backwards compatibility and avoid data loss on existing apps

Also, just noticed there is another section in the file where we put the actual preference tag with an example, can you add it there too?

[NiklasMerz]

I am not sure if this description of all config.xml preferences is the right place for that.

Maybe here on the general Android page? Of course we need it in the announce post.

[jcesarmobile]

I've fixed the merge conflicts after merging my PR that removed the AndroidX preference.
I edited right before you commented, so you probably didn't see, can you add the preference to the examples section too?

If you don't want to go into detail about the data loss in this PR it's ok, but it should still be about loading from file instead of accessing file urls, because it's not the same thing.
If you load from file url, you obviously need to access file urls, but you might still want to load from https and access file urls (i.e. take a picture from the camera and assign it to a img tag) and can wrongly enable this preference to do so.

BTW, that example made me think, do we have some helper like on iOS to convert file urls like the one you get from camera to https urls? would the assets loader be able to load those urls somehow?

[NiklasMerz]

We could add more information around migration and data loss once we have a good suggestion?

[NiklasMerz]

I've fixed the merge conflicts after merging my PR that removed the AndroidX preference.
I edited right before you commented, so you probably didn't see, can you add the preference to the examples section too?

Done

If you don't want to go into detail about the data loss in this PR it's ok, but it should still be about loading from file instead of accessing file urls, because it's not the same thing.

I changed the wording and found the right page to describe that. Maybe others can jump in and help to improve it.

If you load from file url, you obviously need to access file urls, but you might still want to load from https and access file urls (i.e. take a picture from the camera and assign it to a img tag) and can wrongly enable this preference to do so.

BTW, that example made me think, do we have some helper like on iOS to convert file urls like the one you get from camera to https urls? would the assets loader be able to load those urls somehow?

TBH I don't really what happens with camera and other files. Maybe it still works? I need to test it out.