Android: Disallow iframes from requesting to auto-log-in.

chrome/browser/renderer_host/chrome_resource_dispatcher_host_delegate.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/renderer_host/chrome_resource_dispatcher_host_delegate.h"
 
 #include <string>
 #include <vector>
 
 #include "base/base64.h"
@@ skipping 624 matching lines @@
     net::URLRequest* request,
     content::ResourceContext* resource_context,
     content::ResourceResponse* response,
     IPC::Sender* sender) {
   const ResourceRequestInfo* info = ResourceRequestInfo::ForRequest(request);
 
 #if defined(OS_ANDROID)
   // See if the response contains the X-Auto-Login header.  If so, this was
   // a request for a login page, and the server is allowing the browser to
   // suggest auto-login, if available.
-  AutoLoginPrompter::ShowInfoBarIfPossible(request, info->GetChildID(),
-                                           info->GetRouteID());
+  if (info->IsMainFrame()) {
+    AutoLoginPrompter::ShowInfoBarIfPossible(request, info->GetChildID(),
+                                             info->GetRouteID());
+  }
 #endif
 
   ProfileIOData* io_data = ProfileIOData::FromResourceContext(resource_context);
 
 #if defined(ENABLE_ONE_CLICK_SIGNIN)
   // See if the response contains the Google-Accounts-SignIn header.  If so,
   // then the user has just finished signing in, and the server is allowing the
   // browser to suggest connecting the user's profile to the account.
   OneClickSigninHelper::ShowInfoBarIfPossible(request, io_data,
                                               info->GetChildID(),
@@ skipping 92 matching lines @@
                                        url_request->GetTotalReceivedBytes()));
   }
 }
 
 // static
 void ChromeResourceDispatcherHostDelegate::
     SetExternalProtocolHandlerDelegateForTesting(
     ExternalProtocolHandler::Delegate* delegate) {
   g_external_protocol_handler_delegate = delegate;
 }