Index: chrome/browser/ui/autofill/autofill_dialog_controller_impl.cc |
diff --git a/chrome/browser/ui/autofill/autofill_dialog_controller_impl.cc b/chrome/browser/ui/autofill/autofill_dialog_controller_impl.cc |
index 3465f8d0ebc537627c72adbbbacf192f8d0cf95e..69f664b77e361316c34795c4005a5ed7d9c6b22c 100644 |
--- a/chrome/browser/ui/autofill/autofill_dialog_controller_impl.cc |
+++ b/chrome/browser/ui/autofill/autofill_dialog_controller_impl.cc |
@@ -576,10 +576,14 @@ base::WeakPtr<AutofillDialogController> AutofillDialogController::Create( |
void AutofillDialogControllerImpl::Show() { |
dialog_shown_timestamp_ = base::Time::Now(); |
- content::NavigationEntry* entry = |
- web_contents()->GetController().GetActiveEntry(); |
- const GURL& active_url = entry ? entry->GetURL() : web_contents()->GetURL(); |
- invoked_from_same_origin_ = active_url.GetOrigin() == source_url_.GetOrigin(); |
+ // Autocomplete is shown in response to a message from the renderer and as |
Ilya Sherman
2013/11/19 23:43:13
nit: "Autocomplete" -> "The Autofill dialog"
jww
2013/11/19 23:52:08
Done.
|
+ // such, it can only be made in the context of the current document. A call to |
+ // GetActiveEntry would return a pending entry, if there was one, which would |
+ // be a security bug. Therefore, we must use the last committed URL for the |
Ilya Sherman
2013/11/19 23:43:13
nit: I'd recommend omitting "we must".
jww
2013/11/19 23:52:08
Done.
|
+ // access checks. |
+ const GURL& current_url = web_contents()->GetLastCommittedURL(); |
+ invoked_from_same_origin_ = |
+ current_url.GetOrigin() == source_url_.GetOrigin(); |
// Log any relevant UI metrics and security exceptions. |
GetMetricLogger().LogDialogUiEvent(AutofillMetrics::DIALOG_UI_SHOWN); |