Don't autofill credit cards on non-secure pages

components/autofill/core/browser/autofill_manager.cc

Index: components/autofill/core/browser/autofill_manager.cc
diff --git a/components/autofill/core/browser/autofill_manager.cc b/components/autofill/core/browser/autofill_manager.cc
index 5df3ca14bda7fa0fee2dde5a92456f091613c803..09356c829c6cbdd26e7d64c77b3df2092034a611 100644
--- a/components/autofill/core/browser/autofill_manager.cc
+++ b/components/autofill/core/browser/autofill_manager.cc
@@ -86,10 +86,6 @@ bool SectionIsAutofilled(const FormStructure& form_structure,
   return false;
 }
 
-bool FormIsHTTPS(const FormStructure& form) {
-  return form.source_url().SchemeIs(url::kHttpsScheme);

[Evan Stade, 2015/05/15 16:54:46]

we can't just make this content::IsOriginSecure() or something?

[Evan Stade, 2015/05/15 16:56:24]

I mean, I guess we can't reach into content:: because iOS uses this code.
(Speaking of which, this patch breaks iOS.) But palmer@ will know the correct
way to check URL security.

-}
-
 // Uses the existing personal data in |profiles| and |credit_cards| to determine
 // possible field types for the |submitted_form|.  This is potentially
 // expensive -- on the order of 50ms even for a small set of |stored_data|.
@@ -491,9 +487,10 @@ void AutofillManager::OnQueryFormFieldAutofill(int query_id,
           GetProfileSuggestions(*form_structure, field, *autofill_field);
     }
     if (!suggestions.empty()) {
-      // Don't provide credit card suggestions for non-HTTPS pages. However,
-      // do provide a warning to the user.
-      if (is_filling_credit_card && !FormIsHTTPS(*form_structure)) {
+      // Don't provide credit card suggestions for non-secure pages. However,
+      // do provide a warning to the user. This will generate warnings on pages
+      // with mixed content (which includes forms with an http target).
+      if (is_filling_credit_card && !client_->IsContextSecure()) {
         Suggestion warning_suggestion(l10n_util::GetStringUTF16(
             IDS_AUTOFILL_WARNING_INSECURE_CONNECTION));
         warning_suggestion.frontend_id = POPUP_ITEM_ID_WARNING_MESSAGE;