[Mac] Add option to reauthenticate the OS user before revealing passwords.

chrome/browser/ui/webui/options/password_manager_handler.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/ui/webui/options/password_manager_handler.h"
 
 #include "base/bind.h"
+#include "base/command_line.h"
 #include "base/prefs/pref_service.h"
 #include "base/strings/string_number_conversions.h"
 #include "base/strings/utf_string_conversions.h"
 #include "base/values.h"
 #include "chrome/browser/chrome_notification_types.h"
+#include "chrome/browser/password_manager/password_manager_util.h"
 #include "chrome/browser/password_manager/password_store_factory.h"
 #include "chrome/browser/profiles/profile.h"
+#include "chrome/common/chrome_switches.h"
 #include "chrome/common/pref_names.h"
 #include "chrome/common/url_constants.h"
 #include "components/autofill/core/common/password_form.h"
 #include "content/public/browser/notification_details.h"
 #include "content/public/browser/notification_source.h"
 #include "content/public/browser/user_metrics.h"
 #include "content/public/browser/web_ui.h"
 #include "grit/chromium_strings.h"
 #include "grit/generated_resources.h"
 #include "net/base/net_util.h"
 #include "ui/base/l10n/l10n_util.h"
 
 namespace options {
 
 PasswordManagerHandler::PasswordManagerHandler()
     : populater_(this),
       exception_populater_(this),
       is_user_authenticated_(false) {
+  CommandLine* cl = CommandLine::ForCurrentProcess();
+  require_reauthentication_ =
+      cl->HasSwitch(switches::kEnablePasswordManagerReauthentication) &&
+      !(cl->HasSwitch(switches::kDisablePasswordManagerReauthentication));
 }
 
 PasswordManagerHandler::~PasswordManagerHandler() {
   PasswordStore* store = GetPasswordStore();
   if (store)
     store->RemoveObserver(this);
 }
 
 void PasswordManagerHandler::GetLocalizedValues(
     DictionaryValue* localized_strings) {
@@ skipping 107 matching lines @@
   }
 }
 
 void PasswordManagerHandler::RequestShowPassword(const ListValue* args) {
   int index;
   if (!ExtractIntegerValue(args, &index)) {
     NOTREACHED();
     return;
   }
 
-  if (!is_user_authenticated_) {
-    // TODO(dubroy): Insert actual authentication code here.
-    is_user_authenticated_ = true;
+  if (require_reauthentication_ && !is_user_authenticated_) {

[Will Harris, 2013/10/18 11:56:52]

for users who leave their browser open for several days, e.g. googlers, or
people who use 'suspend' on their laptop - perhaps we need a timeout rather than
remembering that an authentication succeeded forever?

[Patrick Dubroy, 2013/10/18 13:15:54]

Yeah. For some reason I was thinking I'd leave that for another CL, but it's
pretty easy, so I may as well do it here.

+    // If reauthentication fails, do nothing.
+    if (!(is_user_authenticated_ = password_manager_util::AuthenticateUser()))
+      return;
   }
 
   // Call back the front end to reveal the password.
   web_ui()->CallJavascriptFunction(
       "PasswordManager.showPassword",
       base::FundamentalValue(index),
       StringValue(password_list_[index]->password_value));
 }
 
 void PasswordManagerHandler::SetPasswordList() {
@@ skipping 112 matching lines @@
 
 void PasswordManagerHandler::PasswordExceptionListPopulater::
     OnGetPasswordStoreResults(
         const std::vector<autofill::PasswordForm*>& results) {
   // TODO(kaiwang): Implement when I refactor
   // PasswordStore::GetAutofillableLogins and PasswordStore::GetBlacklistLogins.
   NOTIMPLEMENTED();
 }
 
 }  // namespace options