Display confirmation dialog for untrusted signins

chrome/browser/ui/sync/one_click_signin_helper.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/ui/sync/one_click_signin_helper.h"
 
 #include <algorithm>
 #include <functional>
 #include <utility>
 #include <vector>
@@ skipping 211 matching lines @@
 }
 
 // Start syncing with the given user information.
 void StartSync(const StartSyncArgs& args,
                OneClickSigninSyncStarter::StartSyncMode start_mode) {
   if (start_mode == OneClickSigninSyncStarter::UNDO_SYNC) {
     LogOneClickHistogramValue(one_click_signin::HISTOGRAM_UNDO);
     return;
   }
 
-  // If we are giving the user the option to configure sync, then that will
-  // suffice as a confirmation.
-  OneClickSigninSyncStarter::ConfirmationRequired confirmation =
-      args.confirmation_required;
-  if (start_mode == OneClickSigninSyncStarter::CONFIGURE_SYNC_FIRST &&
-      confirmation == OneClickSigninSyncStarter::CONFIRM_UNTRUSTED_SIGNIN) {
-    confirmation = OneClickSigninSyncStarter::CONFIRM_AFTER_SIGNIN;
-  }
-
   // The starter deletes itself once its done.
   new OneClickSigninSyncStarter(args.profile, args.browser, args.session_index,
                                 args.email, args.password, start_mode,
                                 args.force_same_tab_navigation,
-                                confirmation);
+                                args.confirmation_required,
+                                args.source);
 
   int action = one_click_signin::HISTOGRAM_MAX;
   switch (args.auto_accept) {
     case OneClickSigninHelper::AUTO_ACCEPT_EXPLICIT:
       break;
     case OneClickSigninHelper::AUTO_ACCEPT_ACCEPTED:
       action =
           start_mode == OneClickSigninSyncStarter::SYNC_WITH_DEFAULT_SETTINGS ?
               one_click_signin::HISTOGRAM_AUTO_WITH_DEFAULTS :
               one_click_signin::HISTOGRAM_AUTO_WITH_ADVANCED;
@@ skipping 887 matching lines @@
       StartSync(StartSyncArgs(profile, browser, auto_accept_,
                               session_index_, email_, password_,
                               false /* force_same_tab_navigation */,
                               true /* confirmation_required */, source_),
                 OneClickSigninSyncStarter::SYNC_WITH_DEFAULT_SETTINGS);
       break;
     case AUTO_ACCEPT_CONFIGURE:
       LogOneClickHistogramValue(one_click_signin::HISTOGRAM_ACCEPTED);
       LogOneClickHistogramValue(one_click_signin::HISTOGRAM_WITH_ADVANCED);
       SigninManager::DisableOneClickSignIn(profile);
-      // Don't bother displaying an extra confirmation (even in the SAML case)
-      // since the user will get prompted to setup sync anyway.
+      // Display the extra confirmation (even in the SAML case) in case this
+      // was an untrusted renderer.
       StartSync(
           StartSyncArgs(profile, browser, auto_accept_, session_index_, email_,
                         password_, false /* force_same_tab_navigation */,
-                        false /* confirmation_required */, source_),
+                        true /* confirmation_required */, source_),

[Andrew T Wilson (Slow), 2013/06/24 08:48:13]

Why are we *always* displaying this confirmation, and not just only in the case
where untrusted_confirmation_required == true? Doesn't this display an extra
confirmation even in a trusted GAIA flow?

           OneClickSigninSyncStarter::CONFIGURE_SYNC_FIRST);
       break;
     case AUTO_ACCEPT_EXPLICIT: {
       if (switched_to_advanced_) {
         LogHistogramValue(original_source_,
                           one_click_signin::HISTOGRAM_WITH_ADVANCED);
         LogHistogramValue(original_source_,
                           one_click_signin::HISTOGRAM_ACCEPTED);
       } else {
         LogHistogramValue(source_, one_click_signin::HISTOGRAM_ACCEPTED);
@@ skipping 82 matching lines @@
     contents->GetController().LoadURL(redirect_url_,
                                       content::Referrer(),
                                       content::PAGE_TRANSITION_AUTO_TOPLEVEL,
                                       std::string());
   }
 
   // Clear the redirect URL.
   redirect_url_ = GURL();
   sync_service->RemoveObserver(this);
 }