For downloads requiring a user gesture, also require...

chrome/browser/download/download_item.h

Index: chrome/browser/download/download_item.h
===================================================================
--- chrome/browser/download/download_item.h	(revision 86341)
+++ chrome/browser/download/download_item.h	(working copy)
@@ -277,7 +277,9 @@
   // Why |safety_state_| is not SAFE.
   DangerType GetDangerType() const;
   bool IsDangerous() const;
-  void MarkUrlDangerous();
+  void SetFileDangerous(bool dangerous);

[Randy Smith (Not in Mondays), 2011/05/24 18:28:25]

This accessor doesn't look like it's used outside of tests.  Could we get rid of
it?

[Peter Kasting, 2011/05/24 20:55:00]

You're right that it's only used in tests, but how can I get rid of it?  Do you
want me to add friend declarations to this class?

[Randy Smith (Not in Mondays), 2011/05/24 21:48:56]

You could use SetFileCheckResults based on a DownloadStateInfo structure; that's
the way that it gets set in normal processing.  But that would probably take
some re-working of the test, and I think the reason for this accessor is that
you're getting rid of superfluous members in DownloadCreateInfo, which is gravy
from my point of view even with the extra accessor in DownloadItem, so don't
worry about it unless you feel an urge to do the extra cleanup.

+  void SetUrlDangerous(bool dangerous);

[Randy Smith (Not in Mondays), 2011/05/24 18:28:25]

This may be an area where we disagree, but I'm trying to limit the "bag of bits"
feeling about the DownloadItem, and hence I'd rather have exposed as accessor
only the state transition that the item actually undergoes.  So (assuming you
can get rid of the TriState enum as per my other comment) would you be willing
to make this accessor only do the transition from safe to dangerous?

+  void SetVisitedBefore(bool visited_referrer_before);

[Randy Smith (Not in Mondays), 2011/05/24 18:28:25]

Similarly, could you drop the argument and just call this if you need to mark
the DownloadItem as visited before?  (Or not visited before; I don't care what
the default state is.)

 
   bool auto_opened() { return auto_opened_; }
   FilePath target_name() const { return state_info_.target_name; }