| Index: content/public/browser/download_url_parameters.h
|
| diff --git a/content/public/browser/download_url_parameters.h b/content/public/browser/download_url_parameters.h
|
| index 7a580a3f9c7268f7a8e1a29d22d5e1cca2f57ef7..1496236a427bf9b3a355efeb7d768045ee3bf7fa 100644
|
| --- a/content/public/browser/download_url_parameters.h
|
| +++ b/content/public/browser/download_url_parameters.h
|
| @@ -61,31 +61,28 @@ class CONTENT_EXPORT DownloadUrlParameters {
|
| typedef std::vector<RequestHeadersNameValuePair> RequestHeadersType;
|
|
|
| // Construct DownloadUrlParameters for downloading the resource at |url| and
|
| - // associating the download with |web_contents|.
|
| - //
|
| - // DEPRECATED: Using this method can cause the request to be associated with
|
| - // the wrong site instance where multiple iframes are involved. Use the
|
| - // DownloadUrlParameters constructor below and specify the process and frame
|
| - // IDs explicitly.
|
| - static std::unique_ptr<DownloadUrlParameters> FromWebContents(
|
| + // associating the download with the main frame of the given WebContents.
|
| + static std::unique_ptr<DownloadUrlParameters> CreateForWebContentsMainFrame(
|
| WebContents* web_contents,
|
| const GURL& url);
|
|
|
| - // Construct DownloadUrlParameters for downloading the resource at |url| and
|
| - // associating the download with the WebContents identified by
|
| - // |render_process_host_id| and |render_view_host_routing_id|.
|
| - //
|
| - // If the download is not associated with a WebContents, then set the IDs to
|
| - // -1.
|
| + // Constructs a download not associated with a frame.
|
| //
|
| - // NOTE: Initiating downloads that are not associated with a WebContents is
|
| - // not safe and should only be done in a limited set of cases where the
|
| - // download URL has been previously vetted. A download that's initiated
|
| - // without associating it with a WebContents don't receive the same security
|
| - // checks as a request that's associated with one. Hence, downloads that are
|
| - // not associated with a WebContents should only be made for URLs that are
|
| - // either trusted or URLs that have previously been successfully issued using
|
| - // a non-privileged WebContents.
|
| + // It is not safe to have downloads not associated with a frame and
|
| + // this should only be done in a limited set of cases where the download URL
|
| + // has been previously vetted. A download that's initiated without
|
| + // associating it with a fraem don't receive the same security checks
|
| + // as a request that's associated with one. Hence, downloads that are not
|
| + // associated with a frame should only be made for URLs that are either
|
| + // trusted or URLs that have previously been successfully issued using a
|
| + // non-privileged frame.
|
| + DownloadUrlParameters(
|
| + const GURL& url,
|
| + net::URLRequestContextGetter* url_request_context_getter);
|
| +
|
| + // The RenderView routing ID must correspond to the RenderView of the
|
| + // RenderFrame, both of which share the same RenderProcess. This may be a
|
| + // different RenderView than the WebContents' main RenderView.
|
| DownloadUrlParameters(
|
| const GURL& url,
|
| int render_process_host_id,
|
| @@ -214,6 +211,9 @@ class CONTENT_EXPORT DownloadUrlParameters {
|
| bool prefer_cache() const { return prefer_cache_; }
|
| const Referrer& referrer() const { return referrer_; }
|
| const std::string& referrer_encoding() const { return referrer_encoding_; }
|
| +
|
| + // These will be -1 if the request is not associated with a frame. See
|
| + // the constructors for more.
|
| int render_process_host_id() const { return render_process_host_id_; }
|
| int render_view_host_routing_id() const {
|
| return render_view_host_routing_id_;
|
| @@ -221,6 +221,7 @@ class CONTENT_EXPORT DownloadUrlParameters {
|
| int render_frame_host_routing_id() const {
|
| return render_frame_host_routing_id_;
|
| }
|
| +
|
| const RequestHeadersType& request_headers() const { return request_headers_; }
|
| net::URLRequestContextGetter* url_request_context_getter() {
|
| return url_request_context_getter_.get();
|
|
|