Show confirmation dialog for unsecure signin

chrome/browser/resources/gaia_auth/background.js

 // Copyright 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 /**
  * @fileoverview
  * A background script of the auth extension that bridges the communication
  * between the main and injected scripts.
  *
  * Here is an overview of the communication flow when SAML is being used:
@@ skipping 106 matching lines @@
   isConstrainedWindow_: null,
 
   // Email of the newly authenticated user based on the gaia response header
   // 'google-accounts-signin'.
   email_: null,
 
   // Session index of the newly authenticated user based on the gaia response
   // header 'google-accounts-signin'.
   sessionIndex_: null,
 
+  // Whether the user needs to confirm signin because of insecure content.
+  confirmUntrustedSignin_: false,
+
   // Gaia URL base that is set from main auth script.
   gaiaUrl_: null,
 
   // Whether to abort the authentication flow and show an error messagen when
   // content served over an unencrypted connection is detected.
   blockInsecureContent_: false,
 
   // Whether auth flow has started. It is used as a signal of whether the
   // injected script should scrape passwords.
   authStarted_: false,
@@ skipping 72 matching lines @@
     if (!this.isDesktopFlow_ || details.parentFrameId <= 0)
       return;
 
     var msg = null;
     if (this.continueUrl_ &&
         details.url.lastIndexOf(this.continueUrl_, 0) == 0) {
       var skipForNow = false;
       if (details.url.indexOf('ntp=1') >= 0)
         skipForNow = true;
 
       // TOOD(guohui): Show password confirmation UI.

[Roger Tawa OOO till Jul 10th, 2014/06/08 03:01:56]

Is this todo done now?  Remove/fix comment?

[guohui, 2014/06/09 19:23:29]

nope, this is not done yet, for more details please see crbug/348002.

       var passwords = this.onGetScrapedPasswords_();
       msg = {
         'name': 'completeLogin',
         'email': this.email_,
         'password': passwords[0],
         'sessionIndex': this.sessionIndex_,
-        'skipForNow': skipForNow
+        'skipForNow': skipForNow,
+        'confirmUntrustedSignin': this.confirmUntrustedSignin_
       };
       this.channelMain_.send(msg);
     } else if (this.isConstrainedWindow_) {
       // The header google-accounts-embedded is only set on gaia domain.
       if (this.gaiaUrl_ && details.url.lastIndexOf(this.gaiaUrl_) == 0) {
         var headers = details.responseHeaders;
         for (var i = 0; headers && i < headers.length; ++i) {
           if (headers[i].name.toLowerCase() == 'google-accounts-embedded')
             return;
         }
       }
       msg = {
         'name': 'switchToFullTab',
         'url': details.url
       };
       this.channelMain_.send(msg);
     }
   },
 
   /**
    * Handler for webRequest.onBeforeRequest, invoked when content served over an
    * unencrypted connection is detected. Determines whether the request should
    * be blocked and if so, signals that an error message needs to be shown.
    * @param {string} url The URL that was blocked.
    * @return {!Object} Decision whether to block the request.
    */
   onInsecureRequest: function(url) {
-    if (!this.blockInsecureContent_)
+    if (!this.blockInsecureContent_) {
+      this.confirmUntrustedSignin_ = true;
       return {};
+    }
     this.channelMain_.send({name: 'onInsecureContentBlocked', url: url});
     return {cancel: true};
   },
 
   /**
    * Handler or webRequest.onHeadersReceived. It reads the authenticated user
    * email from google-accounts-signin-header.
    */
   onHeadersReceived: function(details) {
     if (!this.isDesktopFlow_ ||
@@ skipping 98 matching lines @@
   },
 
   onPageLoaded_: function(msg) {
     if (this.channelMain_)
       this.channelMain_.send({name: 'onAuthPageLoaded', url: msg.url});
   }
 };
 
 var backgroundBridgeManager = new BackgroundBridgeManager();
 backgroundBridgeManager.run();