Security fix for untrusted signin confirm dialog

Security fix for untrusted signin confirm dialog

When the window associated with the confirm dialog is closed without user clicking 'ok got it', chrome starts sync with default settings. This could be exploited to sign a user's Chrome into an attacker's account, as reported in crbug 321940.

BUG=321940
Committed: https://src.chromium.org/viewvc/chrome?view=rev&revision=237115

[guohui, 2013-11-21 20:54:07]

Hey Roger,

could you please take a look at the fix? For details please see my last comment
in the bug.

Thanks,

Hui

[Roger Tawa OOO till Jul 10th, 2013-11-22 00:21:50]

This change looks good, but what about one_click_signin_view_controller.mm, line
70?

[guohui, 2013-11-22 16:59:31]

On 2013/11/22 00:21:50, Roger Tawa wrote:
> This change looks good, but what about one_click_signin_view_controller.mm,
line
> 70?

You are right, fixed in the patch 2.

[Roger Tawa OOO till Jul 10th, 2013-11-22 17:09:35]

lgtm

[commit-bot: I haz the power, 2013-11-22 18:28:38]

CQ is trying da patch. Follow status at
https://chromium-status.appspot.com/cq/guohui@chromium.org/79553004/140001

[guohui, 2013-11-22 18:29:03]

+sky for owner review

[sky, 2013-11-22 21:19:55]

LGTM

[commit-bot: I haz the power, 2013-11-25 16:56:15]

CQ is trying da patch. Follow status at
https://chromium-status.appspot.com/cq/guohui@chromium.org/79553004/140001

[commit-bot: I haz the power, 2013-11-25 19:12:20]

Change committed as 237115