Always prompt for permission on fullscreen and mouse lock on file:// URLs

chrome/browser/ui/exclusive_access/mouse_lock_controller.cc

 // Copyright (c) 2015 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/ui/exclusive_access/mouse_lock_controller.h"
 
 #include "chrome/browser/chrome_notification_types.h"
 #include "chrome/browser/profiles/profile.h"
 #include "chrome/browser/ui/browser.h"
 #include "chrome/browser/ui/exclusive_access/fullscreen_controller.h"
@@ skipping 125 matching lines @@
   if (mouse_lock && !IsMouseLocked()) {
     DCHECK(IsMouseLockRequested());
 
     HostContentSettingsMap* settings_map =
         profile()->GetHostContentSettingsMap();
 
     GURL url = GetExclusiveAccessBubbleURL();
     ContentSettingsPattern pattern = ContentSettingsPattern::FromURL(url);
 
     // TODO(markusheintz): We should allow patterns for all possible URLs here.
-    if (pattern.IsValid()) {
+    //
+    // Do not store preference on file:// URLs, they don't have a clean
+    // origin policy.
+    // TODO(estark): Revisit this when crbug.com/455882 is fixed.
+    if (!url.SchemeIsFile() && pattern.IsValid()) {
       settings_map->SetContentSetting(pattern,
                                       ContentSettingsPattern::Wildcard(),
                                       CONTENT_SETTINGS_TYPE_MOUSELOCK,
                                       std::string(), CONTENT_SETTING_ALLOW);
     }
 
     WebContents* tab = exclusive_access_tab();
     if (tab && tab->GotResponseToLockMouseRequest(true)) {
       mouse_lock_state_ = MOUSELOCK_ACCEPTED;
     } else {
@@ skipping 58 matching lines @@
     RenderViewHost* const rvh = exclusive_access_tab()->GetRenderViewHost();
     if (rvh)
       mouse_lock_view = rvh->GetView();
   }
 
   if (mouse_lock_view)
     mouse_lock_view->UnlockMouse();
 }
 
 ContentSetting MouseLockController::GetMouseLockSetting(const GURL& url) const {
+  // Always ask on file:// URLs, since we can't meaningfully make the
+  // decision stick for a particular origin.
+  // TODO(estark): Revisit this when crbug.com/455882 is fixed.
+  if (url.SchemeIsFile())
+    return CONTENT_SETTING_ASK;
+
   if (exclusive_access_manager()
           ->fullscreen_controller()
-          ->IsPrivilegedFullscreenForTab() ||
-      url.SchemeIsFile())
+          ->IsPrivilegedFullscreenForTab())
     return CONTENT_SETTING_ALLOW;
 
   HostContentSettingsMap* settings_map = profile()->GetHostContentSettingsMap();
   return settings_map->GetContentSetting(
       url, url, CONTENT_SETTINGS_TYPE_MOUSELOCK, std::string());
 }