media: Restrict ProtectedMediaIdentifier permission to secure origins

chrome/browser/media/protected_media_identifier_permission_context.cc

 // Copyright 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/media/protected_media_identifier_permission_context.h"
 
 #include "base/command_line.h"
 #include "base/metrics/user_metrics.h"
 #include "build/build_config.h"
 #include "chrome/browser/content_settings/tab_specific_content_settings.h"
@@ skipping 127 matching lines @@
   // WebContents may have gone away.
   TabSpecificContentSettings* content_settings =
       TabSpecificContentSettings::GetForFrame(id.render_process_id(),
                                               id.render_frame_id());
   if (content_settings) {
     content_settings->OnProtectedMediaIdentifierPermissionSet(
         requesting_frame.GetOrigin(), allowed);
   }
 }
 
-bool
-ProtectedMediaIdentifierPermissionContext::IsRestrictedToSecureOrigins() const {
-  return false;
+bool ProtectedMediaIdentifierPermissionContext::IsRestrictedToSecureOrigins()
+    const {
+  // EME is not supported on insecure origins, see https://goo.gl/Ks5zf7
+  // Note that origins whitelisted by --unsafely-treat-insecure-origin-as-secure
+  // flag will be treated as "secure" so they will not be affected.
+  return true;
 }
 
 // TODO(xhwang): We should consolidate the "protected content" related pref
 // across platforms.
 bool ProtectedMediaIdentifierPermissionContext::
     IsProtectedMediaIdentifierEnabled() const {
 #if defined(OS_CHROMEOS)
   // Platform verification is not allowed in incognito or guest mode.
   if (profile()->IsOffTheRecord() || profile()->IsGuestSession()) {
     DVLOG(1) << "Protected media identifier disabled in incognito or guest "
@@ skipping 63 matching lines @@
       content_setting = CONTENT_SETTING_BLOCK;
       persist = true;
       break;
   }
 
   NotifyPermissionSet(
       id, requesting_origin, embedding_origin, callback,
       persist, content_setting);
 }
 #endif