Always prompt for permission on fullscreen and mouse lock on file:// URLs

chrome/browser/ui/exclusive_access/fullscreen_controller.cc

Index: chrome/browser/ui/exclusive_access/fullscreen_controller.cc
diff --git a/chrome/browser/ui/exclusive_access/fullscreen_controller.cc b/chrome/browser/ui/exclusive_access/fullscreen_controller.cc
index b37d04ce3b40b7a1c52a889dd04b41b344ab8ec2..4f47fefc168499327d0ff857acbb2a2d89d5809c 100644
--- a/chrome/browser/ui/exclusive_access/fullscreen_controller.cc
+++ b/chrome/browser/ui/exclusive_access/fullscreen_controller.cc
@@ -107,6 +107,16 @@ void FullscreenController::EnterFullscreenModeForTab(WebContents* web_contents,
                                                      const GURL& origin) {
   DCHECK(web_contents);
 
+  // For file:// URLs, asking for permission would not be meaningful:
+  // the preference could be saved for the whole file:// origin, which
+  // is overly permissive, or for an individual file:// URL, which would
+  // not be meaningful because file:// URLs share an origin. So the only
+  // option is to block. This can be revisited when crbug.com/455882 is
+  // fixed.

[meacer, 2015/02/10 01:47:21]

"TODO(estark): Revisit this when crbug.com/455882 is fixed" sounds a bit more
formal :)

+  if (origin.SchemeIsFile()) {
+    return;
+  }

[meacer, 2015/02/10 01:47:21]

Perhaps you could add a browsertest or layout test so that this doesn't regress.
For browsertest you could use fullscreen_controller_browsertest.cc. For layout
test you could use one of the test cases under
third_party/WebKit/LayoutTests/fullscreen/ and use setBaseURL() to change the
document's url to a file url.

[estark, 2015/02/10 17:49:22]

Ah, that was actually a question that I had that I forgotten to ask. I didn't do
a browser test initially because it looked like most (all?) of the fullscreen
browser tests are disabled due to flakiness. I didn't know that layout tests
were an option though -- I'll add one of those (assuming we decide to go forward
with this change.)

+
   if (MaybeToggleFullscreenForCapturedTab(web_contents, true)) {
     // During tab capture of fullscreen-within-tab views, the browser window
     // fullscreen state is unchanged, so return now.
@@ -502,7 +512,7 @@ ContentSetting FullscreenController::GetFullscreenSetting() const {
 
   GURL url = GetRequestingOrigin();
 
-  if (IsPrivilegedFullscreenForTab() || url.SchemeIsFile())
+  if (IsPrivilegedFullscreenForTab())
     return CONTENT_SETTING_ALLOW;
 
   // If the permission was granted to the website with no embedder, it should