Fix our handling of mixed SSL / non-SSL content....

Fix our handling of mixed SSL / non-SSL content.

Now we keep state per origin and propagate the state to the correct security indicators, taking origin propagation into account.

BUG=8706

[jcampan, 2009-03-16 18:43:54]

Great change!
I like the clean-up of the SSLPolicy.

Few comments.

http://codereview.chromium.org/46094/diff/2001/2002
File chrome/browser/ssl/ssl_manager.cc (right):

http://codereview.chromium.org/46094/diff/2001/2002#newcode493
Line 493: SSLPolicy::IsMixedContent(request->url(),
Don't you want to return false if IsMixedContent returns false?

http://codereview.chromium.org/46094/diff/2001/2005
File chrome/browser/ssl/ssl_policy.cc (right):

http://codereview.chromium.org/46094/diff/2001/2005#newcode119
Line 119: SECURITY_STYLE_AUTHENTICATED : SECURITY_STYLE_UNAUTHENTICATED;
Nit: indent 4 spaces

http://codereview.chromium.org/46094/diff/2001/2024
File net/base/x509_certificate.h (right):

http://codereview.chromium.org/46094/diff/2001/2024#newcode116
Line 116: // Returns true if this policy has allowed at least one certificate.
allowed ->denied

http://codereview.chromium.org/46094/diff/2001/2022
File webkit/glue/webview_delegate.h (right):

http://codereview.chromium.org/46094/diff/2001/2022#newcode353
Line 353: const std::string& frame_origin,
Would it make sense to make the frame origins gettable from the WebResponse
(like we do with the security info)? That way these params would not have to be
passed around in method calls  that take a WebResponse.

[abarth-chromium, 2009-03-16 21:34:21]

Thanks the comments!  I'm going to try to break this change up in to some
smaller pieces to it's easier to review.

http://codereview.chromium.org/46094/diff/2001/2002
File chrome/browser/ssl/ssl_manager.cc (right):

http://codereview.chromium.org/46094/diff/2001/2002#newcode493
Line 493: SSLPolicy::IsMixedContent(request->url(),
Yes.  :)

http://codereview.chromium.org/46094/diff/2001/2005
File chrome/browser/ssl/ssl_policy.cc (right):

http://codereview.chromium.org/46094/diff/2001/2005#newcode119
Line 119: SECURITY_STYLE_AUTHENTICATED : SECURITY_STYLE_UNAUTHENTICATED;
Fixed.

http://codereview.chromium.org/46094/diff/2001/2024
File net/base/x509_certificate.h (right):

http://codereview.chromium.org/46094/diff/2001/2024#newcode116
Line 116: // Returns true if this policy has allowed at least one certificate.
Done.

http://codereview.chromium.org/46094/diff/2001/2022
File webkit/glue/webview_delegate.h (right):

http://codereview.chromium.org/46094/diff/2001/2022#newcode353
Line 353: const std::string& frame_origin,
I'm not sure that makes sense.  It's not really a property of the response. 
It's a property of the context that's receiving the response.  Maybe we should
add it to WebFrame?