[WebView] Disallow geolocation on insecure origins for apps targeting N and higher.

android_webview/java/src/org/chromium/android_webview/AwSettings.java

Index: android_webview/java/src/org/chromium/android_webview/AwSettings.java
diff --git a/android_webview/java/src/org/chromium/android_webview/AwSettings.java b/android_webview/java/src/org/chromium/android_webview/AwSettings.java
index a7f1afdb548f7774045c11f98f9c3292ebb438e2..c1cad0292b7f1e0ad81c1a1849301ce7f48004e6 100644
--- a/android_webview/java/src/org/chromium/android_webview/AwSettings.java
+++ b/android_webview/java/src/org/chromium/android_webview/AwSettings.java
@@ -112,6 +112,7 @@ public class AwSettings {
     private boolean mSupportZoom = true;
     private boolean mBuiltInZoomControls = false;
     private boolean mDisplayZoomControls = true;
+    private boolean mAllowGeolocationOnInsecureOrigins = true;

[Torne, 2016/04/13 15:33:01]

The other API level settings are final; I assume they just set it in
construction in the relevant tests? Is it a problem to make this work the same
way?

[timvolodine, 2016/04/13 16:38:57]

right, not a problem ;) done.

 
     static class LazyDefaultUserAgent{
         // Lazy Holder pattern
@@ -210,7 +211,8 @@ public class AwSettings {
     public AwSettings(Context context,
             boolean isAccessFromFileURLsGrantedByDefault,
             boolean supportsLegacyQuirks,
-            boolean allowEmptyDocumentPersistence) {
+            boolean allowEmptyDocumentPersistence,
+            boolean allowGeolocationOnInsecureOrigins) {
         boolean hasInternetPermission = context.checkPermission(
                 android.Manifest.permission.INTERNET,
                 Process.myPid(),
@@ -240,6 +242,7 @@ public class AwSettings {
 
             mSupportLegacyQuirks = supportsLegacyQuirks;
             mAllowEmptyDocumentPersistence = allowEmptyDocumentPersistence;
+            mAllowGeolocationOnInsecureOrigins = allowGeolocationOnInsecureOrigins;
         }
         // Defer initializing the native side until a native WebContents instance is set.
     }
@@ -1255,6 +1258,12 @@ public class AwSettings {
         return mAllowEmptyDocumentPersistence;
     }
 
+    @CalledByNative
+    private boolean getAllowGeolocationOnInsecureOrigins() {
+        assert Thread.holdsLock(mAwSettingsLock);
+        return mAllowGeolocationOnInsecureOrigins;
+    }
+
     /**
      * See {@link android.webkit.WebSettings#setUseWideViewPort}.
      */
@@ -1741,6 +1750,13 @@ public class AwSettings {
     }
 
     @VisibleForTesting
+    public void setAllowGeolocationOnInsecureOriginsForTests(final boolean allow) {
+        synchronized (mAwSettingsLock) {
+            mAllowGeolocationOnInsecureOrigins = allow;
+        }
+    }
+
+    @VisibleForTesting
     public void updateAcceptLanguages() {
         synchronized (mAwSettingsLock) {
             mEventHandler.runOnUiThreadBlockingAndLocked(new Runnable() {