Make TabCapture requests use the target render process and render view id's for UI permissions.

content/browser/renderer_host/media/media_stream_manager.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/browser/renderer_host/media/media_stream_manager.h"
 
 #include <list>
 
 #include "base/bind.h"
 #include "base/command_line.h"
@@ skipping 230 matching lines @@
 
   return label;
 }
 
 std::string MediaStreamManager::GenerateStreamForDevice(
     MediaStreamRequester* requester, int render_process_id, int render_view_id,
     const StreamOptions& options, const std::string& device_id,
     const GURL& security_origin) {
   DCHECK(BrowserThread::CurrentlyOn(BrowserThread::IO));
 
+  int target_render_process_id = -1;
+  int target_render_view_id = -1;
+  // We will post the request to the target render view, not the source (i.e.
+  // source is an extension, and target is the tab we want to capture).
+  CHECK(WebContentsCaptureUtil::ExtractTabCaptureTarget(

[no longer working on chromium, 2012/12/07 14:13:10]

what will trigger this GenerateStreamForDevice?
If this can be triggered by JS, you should not add CHECK here, since the hackers
can easily crash the chrome.

[justinlin, 2012/12/07 15:50:09]

Done. Good point. Fixed and tested this possible issue.

+            device_id, &target_render_process_id, &target_render_view_id));
+  DCHECK_NE(target_render_process_id, -1);
+  DCHECK_NE(target_render_view_id, -1);
+
   // Create a new request based on options.
   DeviceRequest* request = new DeviceRequest(requester, options,
                                              DeviceRequest::GENERATE_STREAM,
-                                             render_process_id,
-                                             render_view_id,
+                                             target_render_process_id,
+                                             target_render_view_id,
                                              security_origin);
   const std::string& label = AddRequest(request);
   request->requested_device_id = device_id;
 
   // Get user confirmation to use the capture device.
   PostRequestToUI(label);
 
   if (!security_origin.SchemeIs(kExtensionScheme) ||
       (options.audio_type != MEDIA_TAB_AUDIO_CAPTURE &&
        options.audio_type != MEDIA_NO_SERVICE) ||
@@ skipping 586 matching lines @@
     return;
   }
 
   // Process all newly-accepted devices for this request.
   DeviceRequest* request = request_it->second;
   bool found_audio = false, found_video = false;
   for (StreamDeviceInfoArray::const_iterator device_it = devices.begin();
        device_it != devices.end(); ++device_it) {
     StreamDeviceInfo device_info = *device_it;  // Make a copy.
 
+    // TODO(justinlin): Nicer way to do this?
+    // Re-append the device_id since we lost it when posting request to UI.
+    if (device_info.stream_type == content::MEDIA_TAB_VIDEO_CAPTURE ||
+        device_info.stream_type == content::MEDIA_TAB_AUDIO_CAPTURE)
+      device_info.device_id = request->requested_device_id;

[no longer working on chromium, 2012/12/07 14:13:10]

curiously, what is this device_id? is the process_id + view_id? or is it a real
device?

[justinlin, 2012/12/07 15:50:09]

It's 'process_id + view_id'. We need to pass it to the WebContentsVideoDevice
and eventually to the VirtualAudio streams too (right now for audio, we just use
whole browser audio, so it's not used) to know which tab to capture.

+
     // Set in_use to false to be able to track if this device has been
     // opened. in_use might be true if the device type can be used in more
     // than one session.
     DCHECK_EQ(request->getState(device_it->stream_type),
               MEDIA_REQUEST_STATE_PENDING_APPROVAL);
     device_info.in_use = false;
 
     device_info.session_id =
         GetDeviceManager(device_info.stream_type)->Open(device_info);
     request->setState(device_it->stream_type, MEDIA_REQUEST_STATE_OPENING);
@@ skipping 58 matching lines @@
   ui_controller_.reset();
 }
 
 void MediaStreamManager::NotifyDevicesOpened(const DeviceRequest& request) {
   DCHECK(BrowserThread::CurrentlyOn(BrowserThread::IO));
   MediaStreamDevices opened_devices;
   DevicesFromRequest(request, &opened_devices);
   if (opened_devices.empty())
     return;
 
-  int target_render_process_id = request.render_process_id;
-  int target_render_view_id = request.render_view_id;
-
-  // For tab capture requests, we should notify the UI to update the renderer
-  // that is the target of the capture instead of the requester.
-  if (request.options.audio_type == content::MEDIA_TAB_AUDIO_CAPTURE ||
-      request.options.video_type == content::MEDIA_TAB_VIDEO_CAPTURE) {
-    if (!WebContentsCaptureUtil::ExtractTabCaptureTarget(
-            request.requested_device_id,
-            &target_render_process_id,
-            &target_render_view_id))
-      return;
-  }
-
-  NotifyUIDevicesOpened(target_render_process_id,
-                        target_render_view_id,
+  NotifyUIDevicesOpened(request.render_process_id,
+                        request.render_view_id,
                         opened_devices);
 }
 
 void MediaStreamManager::NotifyDevicesClosed(const DeviceRequest& request) {
   DCHECK(BrowserThread::CurrentlyOn(BrowserThread::IO));
   MediaStreamDevices closed_devices;
   DevicesFromRequest(request, &closed_devices);
   if (closed_devices.empty())
     return;
 
-  int target_render_process_id = request.render_process_id;
-  int target_render_view_id = request.render_view_id;
-
-  // For tab capture requests, we should notify the UI to update the renderer
-  // that is the target of the capture instead of the requester.
-  if (request.options.audio_type == content::MEDIA_TAB_AUDIO_CAPTURE ||
-      request.options.video_type == content::MEDIA_TAB_VIDEO_CAPTURE) {
-    if (!WebContentsCaptureUtil::ExtractTabCaptureTarget(
-            request.requested_device_id,
-            &target_render_process_id,
-            &target_render_view_id))
-      return;
-  }
-
-  NotifyUIDevicesClosed(target_render_process_id,
-                        target_render_view_id,
+  NotifyUIDevicesClosed(request.render_process_id,
+                        request.render_view_id,
                         closed_devices);
 }
 
 void MediaStreamManager::DevicesFromRequest(
     const DeviceRequest& request, MediaStreamDevices* devices) {
   for (StreamDeviceInfoArray::const_iterator it = request.devices.begin();
        it != request.devices.end(); ++it) {
     devices->push_back(MediaStreamDevice(
         it->stream_type, it->device_id, it->name));
   }
@@ skipping 89 matching lines @@
   }
 
   // Always do enumeration even though some enumeration is in progress,
   // because those enumeration commands could be sent before these devices
   // change.
   ++active_enumeration_ref_count_[stream_type];
   GetDeviceManager(stream_type)->EnumerateDevices();
 }
 
 }  // namespace content