Allow cross-origin requests for relay http requests made in Transport API.

content/renderer/p2p/port_allocator.cc

 // Copyright (c) 2011 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/renderer/p2p/port_allocator.h"
 
 #include "base/bind.h"
 #include "base/string_number_conversions.h"
 #include "base/string_split.h"
 #include "base/string_util.h"
@@ skipping 159 matching lines @@
   }
 
   if (relay_session_attempts_ > kRelaySessionRetries)
     return;
   relay_session_attempts_++;
 
   relay_session_response_.clear();
 
   WebURLLoaderOptions options;
   options.allowCredentials = false;
+
+  // TODO(sergeyu): Set to CrossOriginRequestPolicyUseAccessControl
+  // when this code can be used by untrusted plugins.

[Wez, 2011/11/14 21:00:47]

Best to create a bug for this and refer to it here.  The bug can mention that
the content of the request we send here is sufficiently limited that restricting
origin may not actually be worthwhile.

   options.crossOriginRequestPolicy =
-      WebURLLoaderOptions::CrossOriginRequestPolicyUseAccessControl;
+      WebURLLoaderOptions::CrossOriginRequestPolicyAllow;
+
   relay_session_request_.reset(
       allocator_->web_frame_->createAssociatedURLLoader(options));
   if (!relay_session_request_.get()) {
     LOG(ERROR) << "Failed to create URL loader.";
     return;
   }
 
   WebURLRequest request;
   request.initialize();
   request.setURL(WebURL(GURL(
@@ skipping 81 matching lines @@
     if (relay_ssltcp_port_ > 0 && !allocator_->config_.disable_tcp_transport) {
       talk_base::SocketAddress address(relay_ip_.ip(), relay_ssltcp_port_);
       ports.push_back(cricket::ProtocolAddress(address, cricket::PROTO_SSLTCP));
     }
   }
   config->AddRelay(ports, 0.0f);
   ConfigReady(config);
 }
 
 }  // namespace content