Added refreshing of elevation policy on first run of new version for all user...

ceee/ie/common/ceee_module_util.cc

Index: ceee/ie/common/ceee_module_util.cc
===================================================================
--- ceee/ie/common/ceee_module_util.cc	(revision 68863)
+++ ceee/ie/common/ceee_module_util.cc	(working copy)
@@ -6,13 +6,17 @@
 
 #include "ceee/ie/common/ceee_module_util.h"
 
+#include <iepmapi.h>
+
 #include "base/file_path.h"
 #include "base/file_util.h"
 #include "base/logging.h"
 #include "base/path_service.h"
 #include "base/stringize_macros.h"
 #include "base/win/registry.h"
+#include "ceee/common/com_utils.h"
 #include "ceee/common/process_utils_win.h"
+#include "ceee/ie/common/ie_util.h"
 #include "chrome/installer/util/google_update_constants.h"
 
 #include "version.h"  // NOLINT
@@ -306,4 +310,34 @@
   return (1 == value);
 }
 
+bool RefreshElevationPolicyIfNeeded() {
+  if (ie_util::GetIeVersion() < ie_util::IEVERSION_IE7)
+    return false;
+
+  // This may access to InternetRegistry instead of real one. However this is

[Sigurður Ásgeirsson, 2010/12/11 01:03:58]

access to -> access

[Vitaly Buka (NO REVIEWS), 2010/12/11 01:17:44]

Done.

+  // acceptable, we just refresh policy twice.
+  base::win::RegKey hkcu(HKEY_CURRENT_USER, kRegistryPath, KEY_ALL_ACCESS);

[Sigurður Ásgeirsson, 2010/12/11 01:03:58]

is KEY_WRITE sufficient here?

[Vitaly Buka (NO REVIEWS), 2010/12/11 01:17:44]

KEY_WRITE does not allow read value.

[Jói, 2010/12/11 02:23:14]

How about KEY_WRITE | KEY_QUERY_VALUE ?

[Vitaly Buka (NO REVIEWS), 2010/12/11 08:26:24]

Than may be KEY_READ | KEY_WRITE?

KEY_READ | KEY_WRITE is almost the same as KEY_ALL_ACCESS. But KEY_ALL_ACCESS
fits to 80 chars :-) We never had problems with KEY_ALL_ACCESS on my "previouse
project".

With KEY_WRITE | KEY_QUERY_VALUE you just omit KEY_ENUMERATE_SUB_KEYS
KEY_NOTIFY. I don't expect that registry key will be configured to provide
everything except them.


On 2010/12/11 02:23:14, Jói wrote:

[Jói, 2010/12/11 21:30:45]

I agree it's unlikely, but as a general principle you're better off requesting
the minimum access that you need. You lose no functionality that way, and there
might be a computer or two out there that have some weird configuration or
security software that you might just stay compatible with.

[Vitaly Buka (NO REVIEWS), 2010/12/11 23:58:14]

Done.

+  LOG_IF(ERROR, !hkcu.Valid()) << "Failed to open reg key: " << kRegistryPath;
+  if (!hkcu.Valid())
+    return false;
+
+  std::wstring expected_version = TO_L_STRING(CHROME_VERSION_STRING);
+
+  static const wchar_t kValueName[] = L"last_elevation_refresh";
+  std::wstring last_elevation_refresh_version;
+  bool result = hkcu.ReadValue(kValueName, &last_elevation_refresh_version);
+  if (last_elevation_refresh_version == expected_version)
+    return false;
+
+  HRESULT hr = ::IERefreshElevationPolicy();
+  VLOG(1) << "Elevation policy refresh result: " << com::LogHr(hr);
+
+  // Write after refreshing because if two thread get here simultaneously

[Sigurður Ásgeirsson, 2010/12/11 01:03:58]

two thread -> two threads

[Vitaly Buka (NO REVIEWS), 2010/12/11 01:17:44]

Done.

+  // better to refresh twice than pass one thread without refreshing.

[Sigurður Ásgeirsson, 2010/12/11 01:03:58]

maybe rephrase to 
it's better to refresh twice, than to miss once
?

[Vitaly Buka (NO REVIEWS), 2010/12/11 01:17:44]

Done.

+  result = hkcu.WriteValue(kValueName, expected_version.c_str());
+  LOG_IF(ERROR, !result) << "Failed to write a registry value: " << kValueName;
+
+  return true;
+}
+
 }  // namespace ceee_module_util