Index: extensions/browser/url_request_util.cc |
diff --git a/extensions/browser/url_request_util.cc b/extensions/browser/url_request_util.cc |
index 20e32c61b77d19208bb7ce156c7bc4a895d2415c..ec581dd6cf1d7141a3091710d24425f3f97f9640 100644 |
--- a/extensions/browser/url_request_util.cc |
+++ b/extensions/browser/url_request_util.cc |
@@ -155,7 +155,13 @@ bool AllowCrossRendererResourceLoadHelper(bool is_guest, |
if (is_guest) { |
// An extension's resources should only be accessible to WebViews owned by |
// that extension. |
- if (owner_extension != extension) { |
+ // The only exception is the sign-in extension loaded by |
lfg
2017/04/26 16:24:18
Please, add a TODO that this should be removed onc
msarda
2017/04/27 12:28:45
Done.
|
+ // chrome://chrome-signin, which is allowed to load web-accessible resources |
+ // even if the webview that is loading the resource does not belong to the |
+ // extension. |
+ bool is_signin_extension = |
+ extension && extension->id() == "mfffpogegjflfpflabcdkioaeobkgjik"; |
+ if (owner_extension != extension && !is_signin_extension) { |
*allowed = false; |
return true; |
} |