Mixed Content: Make strict mode stricter.

Source/core/loader/MixedContentChecker.cpp

Index: Source/core/loader/MixedContentChecker.cpp
diff --git a/Source/core/loader/MixedContentChecker.cpp b/Source/core/loader/MixedContentChecker.cpp
index 474422bebfca90d597a5a63562fab7846cd0cc0b..ba7a3cb70126d16a00e34cbfe4845bd40a21b31f 100644
--- a/Source/core/loader/MixedContentChecker.cpp
+++ b/Source/core/loader/MixedContentChecker.cpp
@@ -329,8 +329,9 @@ bool MixedContentChecker::shouldBlockFetch(LocalFrame* frame, WebURLRequest::Req
         break;
 
     case ContextTypeShouldBeBlockable:
-        allowed = true;
-        client->didDisplayInsecureContent();
+        allowed = !strictMode && true;

[jww, 2015/02/23 18:23:17]

Why the '&& true'? Shouldn't !strictMode be sufficient?

[Mike West, 2015/02/24 07:43:34]

Because I'm an idiot. Thanks!

+        if (allowed)
+            client->didDisplayInsecureContent();
         break;
     };
 
@@ -349,14 +350,14 @@ bool MixedContentChecker::shouldBlockConnection(LocalFrame* frame, const KURL& u
     UseCounter::count(mixedFrame, UseCounter::MixedContentPresent);
     UseCounter::count(mixedFrame, UseCounter::MixedContentWebSocket);
 
-    // If we're in strict mode, we'll automagically fail everything, and intentionally skip
-    // the client checks in order to prevent degrading the site's security UI.
-    bool strictMode = mixedFrame->document()->shouldEnforceStrictMixedContentChecking();
-
     Settings* settings = mixedFrame->settings();
     FrameLoaderClient* client = mixedFrame->loader().client();
     SecurityOrigin* securityOrigin = mixedFrame->document()->securityOrigin();
-    bool allowedPerSettings = settings && (settings->allowRunningOfInsecureContent() || settings->allowConnectingInsecureWebSocket());
+
+    // If we're in strict mode, we'll automagically fail everything, and intentionally skip
+    // the client checks in order to prevent degrading the site's security UI.
+    bool strictMode = mixedFrame->document()->shouldEnforceStrictMixedContentChecking() || settings->strictMixedContentChecking();
+    bool allowedPerSettings = !strictMode && settings && (settings->allowRunningOfInsecureContent() || settings->allowConnectingInsecureWebSocket());
     bool allowed = !strictMode && client->allowRunningInsecureContent(allowedPerSettings, securityOrigin, url);
 
     if (reportingStatus == SendReport) {