OAuth2LoginManager+MergeSessionThrottle hardening, multi-profle support

chrome/browser/chromeos/login/merge_session_throttle.cc

 // Copyright (c) 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/chromeos/login/merge_session_throttle.h"
 
 #include "base/bind.h"
 #include "base/logging.h"
 #include "base/memory/singleton.h"
 #include "base/metrics/histogram.h"
@@ skipping 11 matching lines @@
 #include "net/base/network_change_notifier.h"
 #include "net/url_request/url_request.h"
 #include "net/url_request/url_request_context.h"
 
 using content::BrowserThread;
 using content::RenderViewHost;
 using content::WebContents;
 
 namespace {
 
+const int kSessionThrottleWindowInSeconds = 10;
+
 void ShowDeleayedLoadingPage(
     int render_process_id,
     int render_view_id,
     const GURL& url,
     const chromeos::MergeSessionLoadPage::CompletionCallback& callback) {
   DCHECK(BrowserThread::CurrentlyOn(BrowserThread::UI));
 
   // Check again on UI thread and proceed if it's connected.
   if (chromeos::UserManager::Get()->GetMergeSessionState() !=
           chromeos::UserManager::MERGE_STATUS_IN_PROCESS) {
@@ skipping 20 matching lines @@
     : render_process_id_(render_process_id),
       render_view_id_(render_view_id),
       request_(request) {
 }
 
 MergeSessionThrottle::~MergeSessionThrottle() {
   DCHECK(BrowserThread::CurrentlyOn(BrowserThread::IO));
 }
 
 void MergeSessionThrottle::WillStartRequest(bool* defer) {
-  if (!ShouldShowMergeSessionPage(request_->url()))
+  if (!ShouldShowMergeSessionPage(request_->url())) {
     return;
+  }
 
-  DVLOG(1) << "WillStartRequest: url=" << request_->url();
+  DVLOG(1) << "WillStartRequest: defer " << request_->url();
   BrowserThread::PostTask(
       BrowserThread::UI,
       FROM_HERE,
       base::Bind(
           &ShowDeleayedLoadingPage,
           render_process_id_,
           render_view_id_,
           request_->url(),
           base::Bind(
               &MergeSessionThrottle::OnBlockingPageComplete,
               AsWeakPtr())));
   *defer = true;
 }
 
 void MergeSessionThrottle::OnBlockingPageComplete() {
   DCHECK(BrowserThread::CurrentlyOn(BrowserThread::IO));
   controller()->Resume();
 }
 
 bool MergeSessionThrottle::ShouldShowMergeSessionPage(const GURL& url) const {
   // If we are loading google properties while merge session is in progress,
   // we will show delayed loading page instead.
+  chromeos::UserManager* manager = chromeos::UserManager::Get();
+  int64 session_duration = manager->GetSessionDurationInSeconds();
   return !net::NetworkChangeNotifier::IsOffline() &&
-         chromeos::UserManager::Get()->GetMergeSessionState() ==
+      manager->GetMergeSessionState() ==
              chromeos::UserManager::MERGE_STATUS_IN_PROCESS &&
-         google_util::IsGoogleHostname(url.host(),
-                                       google_util::ALLOW_SUBDOMAIN);
+      session_duration >= 0 &&
+      session_duration < kSessionThrottleWindowInSeconds &&
+      google_util::IsGoogleHostname(url.host(),
+                                   google_util::ALLOW_SUBDOMAIN);
 }