PS - Remove Clipboard Read permission from extensions in Public Sessions (except for whitelisted on…

chrome/browser/extensions/permissions_updater.cc

Index: chrome/browser/extensions/permissions_updater.cc
diff --git a/chrome/browser/extensions/permissions_updater.cc b/chrome/browser/extensions/permissions_updater.cc
index 26730a999aaa4510a01500c6c3bab92db4b18f12..ce530ac048a72d8ea9e29b82778efd4f04bd513f 100644
--- a/chrome/browser/extensions/permissions_updater.cc
+++ b/chrome/browser/extensions/permissions_updater.cc
@@ -9,6 +9,7 @@
 #include "base/memory/ref_counted.h"
 #include "base/values.h"
 #include "chrome/browser/extensions/api/permissions/permissions_api_helpers.h"
+#include "chrome/browser/extensions/permissions_updater_delegate_chromeos.h"
 #include "chrome/browser/extensions/scripting_permissions_modifier.h"
 #include "chrome/browser/profiles/profile.h"
 #include "chrome/common/extensions/api/permissions.h"
@@ -69,10 +70,16 @@ std::unique_ptr<const PermissionSet> GetBoundedActivePermissions(
   return adjusted_active;
 }
 
+PermissionsUpdater::Delegate* g_delegate = nullptr;
+
 }  // namespace
 
 PermissionsUpdater::PermissionsUpdater(content::BrowserContext* browser_context)
     : browser_context_(browser_context), init_flag_(INIT_FLAG_NONE) {
+#if defined(OS_CHROMEOS)
+  if (!g_delegate)

[Ivan Šandrk, 2017/04/04 15:41:56]

I'm not sure if the SetPlatformDelegate function is needed at all. And I'm also
not sure if doing it like this is ok.

[Devlin, 2017/04/05 14:35:20]

I think what would be better would be instead moving this call to SetDelegate to
chromeos session code.  I don't know that code well, but I'm assuming there's
some point at which we know that we're in a public session.  From there, we set
the delegate, since that's the only case we need.  Then, we don't need any
#ifdefs in this file! :)

[Ivan Šandrk, 2017/04/07 14:39:40]

Right, done.

+    SetPlatformDelegate(new PermissionsUpdaterDelegateChromeOS());
+#endif
 }
 
 PermissionsUpdater::PermissionsUpdater(content::BrowserContext* browser_context,
@@ -82,6 +89,11 @@ PermissionsUpdater::PermissionsUpdater(content::BrowserContext* browser_context,
 
 PermissionsUpdater::~PermissionsUpdater() {}
 
+// static
+void PermissionsUpdater::SetPlatformDelegate(Delegate* delegate) {
+  g_delegate = delegate;
+}
+
 void PermissionsUpdater::AddPermissions(const Extension* extension,
                                         const PermissionSet& permissions) {
   const PermissionSet& active =
@@ -199,6 +211,9 @@ void PermissionsUpdater::InitializePermissions(const Extension* extension) {
 
   SetPermissions(extension, std::move(granted_permissions),
                  std::move(withheld_permissions));
+
+  if (g_delegate)
+    g_delegate->InitializePermissions(this, extension);
 }
 
 void PermissionsUpdater::SetPermissions(
@@ -243,7 +258,7 @@ void PermissionsUpdater::NotifyPermissionsUpdated(
     EventType event_type,
     const Extension* extension,
     const PermissionSet& changed) {
-  DCHECK((init_flag_ & INIT_FLAG_TRANSIENT) == 0);
+  DCHECK_EQ(init_flag_ & INIT_FLAG_TRANSIENT, 0);

[Ivan Šandrk, 2017/04/04 15:41:57]

Fixed linter error.

[Devlin, 2017/04/05 14:35:20]

Thanks!  But prefer DCHECK_EQ(expected, actual), so
DCHECK_EQ(0, init_flag & INIT_FLAG_TRANSIENT);

[Ivan Šandrk, 2017/04/07 14:39:40]

Done.

   if (changed.IsEmpty())
     return;