For downloads requiring a user gesture, also require...

chrome/browser/download/download_manager.cc

 // Copyright (c) 2011 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/download/download_manager.h"
 
 #include "base/callback.h"
 #include "base/file_util.h"
 #include "base/i18n/case_conversion.h"
 #include "base/logging.h"
@@ skipping 262 matching lines @@
                                            bool is_dangerous_url) {
   DCHECK(BrowserThread::CurrentlyOn(BrowserThread::UI));
 
   DownloadItem* download = GetActiveDownloadItem(download_id);
   if (!download)
     return;
 
   if (is_dangerous_url)
     download->MarkUrlDangerous();
 
-  DownloadStateInfo state = download->state_info();
+  download_history_->CheckVisitedReferrerBefore(download_id,
+      download->referrer_url(),
+      NewCallback(this, &DownloadManager::CheckVisitedReferrerBeforeDone));
+}
+
+void DownloadManager::CheckVisitedReferrerBeforeDone(
+    int32 download_id,
+    bool visited_referrer_before) {
+  DCHECK(BrowserThread::CurrentlyOn(BrowserThread::UI));
+
+  DownloadItem* download = GetActiveDownloadItem(download_id);
+  if (!download)
+    return;
 
   // Check whether this download is for an extension install or not.
   // Allow extensions to be explicitly saved.
+  DownloadStateInfo state = download->state_info();
   if (!state.prompt_user_for_save_location) {
     if (UserScript::IsURLUserScript(download->GetURL(),
         download->mime_type()) ||
         (download->mime_type() == Extension::kMimeType)) {
       state.is_extension_install = true;
     }
   }
 
   if (state.force_file_name.empty()) {
     FilePath generated_name;
@@ skipping 27 matching lines @@
     if (state.prompt_user_for_save_location && !last_download_path_.empty()) {
       state.suggested_path = last_download_path_;
     } else {
       state.suggested_path = download_prefs_->download_path();
     }
     state.suggested_path = state.suggested_path.Append(generated_name);
   } else {
     state.suggested_path = state.force_file_name;
   }
 
-  if (!state.prompt_user_for_save_location && state.force_file_name.empty())
-    state.is_dangerous_file = IsDangerous(*download, state);
+  if (!state.prompt_user_for_save_location && state.force_file_name.empty()) {
+    state.is_dangerous_file =
+        IsDangerous(*download, state, visited_referrer_before);
+  }
 
   // We need to move over to the download thread because we don't want to stat
   // the suggested path on the UI thread.
   // We can only access preferences on the UI thread, so check the download path
   // now and pass the value to the FILE thread.
   BrowserThread::PostTask(
       BrowserThread::FILE, FROM_HERE,
       NewRunnableMethod(
           this,
           &DownloadManager::CheckIfSuggestedPathExists,
-          download_id,
+          download->id(),
           state,
           download_prefs()->download_path()));
 }
 
 void DownloadManager::CheckIfSuggestedPathExists(int32 download_id,
                                                  DownloadStateInfo state,
                                                  const FilePath& default_path) {
   DCHECK(BrowserThread::CurrentlyOn(BrowserThread::FILE));
 
   // Make sure the default download directory exists.
@@ skipping 73 matching lines @@
   }
 
   BrowserThread::PostTask(
       BrowserThread::UI, FROM_HERE,
       NewRunnableMethod(this,
                         &DownloadManager::OnPathExistenceAvailable,
                         download_id,
                         state));
 }
 
-void DownloadManager::OnPathExistenceAvailable(
-    int32 download_id, DownloadStateInfo new_state) {
+void DownloadManager::OnPathExistenceAvailable(int32 download_id,
+                                               DownloadStateInfo new_state) {
   DCHECK(BrowserThread::CurrentlyOn(BrowserThread::UI));
 
   DownloadItem* download = GetActiveDownloadItem(download_id);
   if (!download)
     return;
 
   VLOG(20) << __FUNCTION__ << "()"
            << " download = " << download->DebugString(true);
 
   download->SetFileCheckResults(new_state);
@@ skipping 578 matching lines @@
     return;
 
   VLOG(20) << __FUNCTION__ << "()"
            << " download = " << download->DebugString(true);
 
   DownloadCancelledInternal(download_id, download->process_handle());
 }
 
 // TODO(phajdan.jr): This is apparently not being exercised in tests.
 bool DownloadManager::IsDangerous(const DownloadItem& download,
-                                  const DownloadStateInfo& state) {
+                                  const DownloadStateInfo& state,
+                                  bool visited_referrer_before) {
   DCHECK(BrowserThread::CurrentlyOn(BrowserThread::UI));
 
   bool auto_open = ShouldOpenFileBasedOnExtension(state.suggested_path);
   download_util::DownloadDangerLevel danger_level =
       download_util::GetFileDangerLevel(state.suggested_path.BaseName());
 
   if (danger_level == download_util::Dangerous)
     return !(auto_open && state.has_user_gesture);
 
   if (danger_level == download_util::AllowOnUserGesture &&
-      !state.has_user_gesture)
+      (!state.has_user_gesture || !visited_referrer_before))
     return true;
 
   if (state.is_extension_install) {
     // Extensions that are not from the gallery are considered dangerous.
     ExtensionService* service = profile()->GetExtensionService();
     if (!service || !service->IsDownloadFromGallery(download.GetURL(),
                                                     download.referrer_url()))
       return true;
   }
   return false;
@@ skipping 199 matching lines @@
     observed_download_manager_->RemoveObserver(this);
 }
 
 void DownloadManager::OtherDownloadManagerObserver::ModelChanged() {
   observing_download_manager_->NotifyModelChanged();
 }
 
 void DownloadManager::OtherDownloadManagerObserver::ManagerGoingDown() {
   observed_download_manager_ = NULL;
 }