Disable outdated non-sandboxed plugins.

BUG=47731
TEST=Run with --disable-outdated-plugins

Review URL: http://codereview.chromium.org/3038051

git-svn-id: svn://svn.chromium.org/chrome/trunk/src@55227 0039d316-1c4b-4281-b951-d872f2087c98

20 files changed, 258 insertions, 43 deletions

diff --git a/chrome/app/generated_resources.grd b/chrome/app/generated_resources.grd
index 2873ec6..68fa2e4 100644
--- a/chrome/app/generated_resources.grd
+++ b/chrome/app/generated_resources.grd
@@ -2386,7 +2386,7 @@ each locale. -->
         Manage plug-in blocking...
       </message>
       <message name="IDS_BLOCKED_PLUGINS_LOAD_ALL" desc="Button to load all blocked plugins on a page, displayed in bubble when a page tries to display plug-ins.">
-        Load all plug-ins on this page
+        Run all plug-ins this time
       </message>
 
       <!-- SSL error strings -->
@@ -3757,6 +3757,12 @@ Keep your key file in a safe place. You will need it to create new versions of y
       <message name="IDS_PLUGIN_LOAD" desc="The link for loading a blocked plug-in.">
         Run plug-in this time
       </message>
+      <message name="IDS_PLUGIN_LOAD_SHORT" desc="The link for loading a blocked plug-in.">
+        Run this time
+      </message>
+      <message name="IDS_PLUGIN_UPDATE" desc="The link for updating an outdated plug-in.">
+        Update plug-in
+      </message>
 
       <!-- Session Crashed Info Bar-->
       <message name="IDS_SESSION_CRASHED_VIEW_RESTORE_BUTTON" desc="Title of the restore button in the session crashed view.">
@@ -6506,6 +6512,12 @@ Keep your key file in a safe place. You will need it to create new versions of y
       <message name="IDS_PLUGIN_BLOCKED_PROMPT" desc="Info Bar message when a non-sandboxed plugin was blocked">
         The <ph name="PLUGIN_NAME">$1<ex>Flash</ex></ph> plug-in was blocked on this site because it could access your computer directly.
       </message>
+      <message name="IDS_PLUGIN_OUTDATED_PROMPT" desc="Info Bar message when an outdated plugin was disabled">
+        The <ph name="PLUGIN_NAME">$1<ex>Flash</ex></ph> plug-in was disabled on this site because it is outdated and could access your computer directly.
+      </message>
+      <message name="IDS_PLUGIN_ENABLE_TEMPORARILY" desc="Info Bar button to temporarily re-enable a disabled plugin">
+        Re-enable for this session
+      </message>
       <message name="IDS_PLUGIN_CRASHED_PROMPT" desc="Info Bar message to notify about a crashed plugin">
         The following plug-in has crashed: <ph name="PLUGIN_NAME">$1<ex>Shockwave</ex></ph>
       </message>
diff --git a/chrome/browser/blocked_plugin_manager.cc b/chrome/browser/blocked_plugin_manager.cc
index e0290c5..92b7c91 100644
--- a/chrome/browser/blocked_plugin_manager.cc
+++ b/chrome/browser/blocked_plugin_manager.cc
@@ -31,7 +31,7 @@ int BlockedPluginManager::GetButtons() const {
 
 std::wstring BlockedPluginManager::GetButtonLabel(InfoBarButton button) const {
   if (button == BUTTON_OK)
-    return l10n_util::GetString(IDS_PLUGIN_LOAD);
+    return l10n_util::GetString(IDS_PLUGIN_LOAD_SHORT);
   return ConfirmInfoBarDelegate::GetButtonLabel(button);
 }
 
diff --git a/chrome/browser/plugin_service.cc b/chrome/browser/plugin_service.cc
index c87f3fd..fb15c54 100644
--- a/chrome/browser/plugin_service.cc
+++ b/chrome/browser/plugin_service.cc
@@ -63,6 +63,11 @@ void PluginService::InitGlobalInstance(Profile* profile) {
   // We first group the plugins and then figure out which groups to disable.
   plugin_updater::DisablePluginGroupsFromPrefs(profile);
 
+  if (CommandLine::ForCurrentProcess()->HasSwitch(
+      switches::kDisableOutdatedPlugins)) {
+    plugin_updater::DisableOutdatedPluginGroups();
+  }
+
   // Have Chrome plugins write their data to the profile directory.
   GetInstance()->SetChromePluginDataDir(profile->GetPath());
 }
diff --git a/chrome/browser/plugin_updater.cc b/chrome/browser/plugin_updater.cc
index 03846aa..90a8daa 100644
--- a/chrome/browser/plugin_updater.cc
+++ b/chrome/browser/plugin_updater.cc
@@ -7,6 +7,7 @@
 #include <string>
 #include <vector>
 
+#include "base/command_line.h"
 #include "base/path_service.h"
 #include "base/scoped_ptr.h"
 #include "base/values.h"
@@ -14,6 +15,7 @@
 #include "chrome/browser/pref_service.h"
 #include "chrome/browser/profile.h"
 #include "chrome/common/chrome_paths.h"
+#include "chrome/common/chrome_switches.h"
 #include "chrome/common/plugin_group.h"
 #include "chrome/common/pref_names.h"
 #include "webkit/glue/plugins/plugin_list.h"
@@ -207,6 +209,19 @@ void DisablePluginGroupsFromPrefs(Profile* profile) {
   }
 }
 
+void DisableOutdatedPluginGroups() {
+  std::vector<linked_ptr<PluginGroup> > groups;
+  GetPluginGroups(&groups);
+  for (std::vector<linked_ptr<PluginGroup> >::iterator it =
+       groups.begin();
+       it != groups.end();
+       ++it) {
+    if ((*it)->IsVulnerable()) {
+      (*it)->Enable(false);
+    }
+  }
+}
+
 void UpdatePreferences(Profile* profile) {
   ListValue* plugins_list = profile->GetPrefs()->GetMutableList(
       prefs::kPluginsPluginsList);
@@ -234,7 +249,9 @@ void UpdatePreferences(Profile* profile) {
        it != plugin_groups.end();
        ++it) {
     // Don't save preferences for vulnerable pugins.
-    if (!(*it)->IsVulnerable()) {
+    if (!CommandLine::ForCurrentProcess()->HasSwitch(
+          switches::kDisableOutdatedPlugins) ||
+        !(*it)->IsVulnerable()) {
       plugins_list->Append((*it)->GetSummary());
     }
   }
diff --git a/chrome/browser/plugin_updater.h b/chrome/browser/plugin_updater.h
index f294ce4..b847162 100644
--- a/chrome/browser/plugin_updater.h
+++ b/chrome/browser/plugin_updater.h
@@ -28,6 +28,11 @@ void EnablePluginFile(bool enable, const FilePath::StringType& file_path);
 // Disable all plugin groups as defined by the user's preference file.
 void DisablePluginGroupsFromPrefs(Profile* profile);
 
+// Disable all plugins groups that are known to be outdated, according to the
+// information hardcoded in PluginGroup, to make sure that they can't be loaded
+// on a web page and instead show a UI to update to the latest version.
+void DisableOutdatedPluginGroups();
+
 // Write the enable/disable status to the user's preference file.
 void UpdatePreferences(Profile* profile);
 
diff --git a/chrome/browser/renderer_host/browser_render_process_host.cc b/chrome/browser/renderer_host/browser_render_process_host.cc
index 95cb7d4..757219b 100644
--- a/chrome/browser/renderer_host/browser_render_process_host.cc
+++ b/chrome/browser/renderer_host/browser_render_process_host.cc
@@ -574,6 +574,7 @@ void BrowserRenderProcessHost::PropagateBrowserCommandLineToRenderer(
     switches::kRemoteShellPort,
     switches::kEnablePepperTesting,
     switches::kBlockNonSandboxedPlugins,
+    switches::kDisableOutdatedPlugins,
     switches::kEnableRemoting,
     switches::kEnableClickToPlay,
     switches::kPrelaunchGpuProcess,
diff --git a/chrome/browser/renderer_host/render_view_host.cc b/chrome/browser/renderer_host/render_view_host.cc
index 6089f2a..7a6958b 100644
--- a/chrome/browser/renderer_host/render_view_host.cc
+++ b/chrome/browser/renderer_host/render_view_host.cc
@@ -802,6 +802,8 @@ void RenderViewHost::OnMessageReceived(const IPC::Message& msg) {
     IPC_MESSAGE_HANDLER(ViewHostMsg_BlockedPluginLoaded,
                         OnBlockedPluginLoaded);
     IPC_MESSAGE_HANDLER(ViewHostMsg_CrashedPlugin, OnCrashedPlugin);
+    IPC_MESSAGE_HANDLER(ViewHostMsg_DisabledOutdatedPlugin,
+                        OnDisabledOutdatedPlugin);
     IPC_MESSAGE_HANDLER(ViewHostMsg_SendCurrentPageAllSavableResourceLinks,
                         OnReceivedSavableResourceLinksForCurrentPage);
     IPC_MESSAGE_HANDLER(ViewHostMsg_SendSerializedHtmlData,
@@ -1557,6 +1559,14 @@ void RenderViewHost::OnCrashedPlugin(const FilePath& plugin_path) {
     integration_delegate->OnCrashedPlugin(plugin_path);
 }
 
+void RenderViewHost::OnDisabledOutdatedPlugin(const string16& name,
+                                              const GURL& update_url) {
+  RenderViewHostDelegate::BrowserIntegration* integration_delegate =
+      delegate_->GetBrowserIntegrationDelegate();
+  if (integration_delegate)
+    integration_delegate->OnDisabledOutdatedPlugin(name, update_url);
+}
+
 void RenderViewHost::GetAllSavableResourceLinksForCurrentPage(
     const GURL& page_url) {
   Send(new ViewMsg_GetAllSavableResourceLinksForCurrentPage(routing_id(),
diff --git a/chrome/browser/renderer_host/render_view_host.h b/chrome/browser/renderer_host/render_view_host.h
index 0dbb82e..10a86b4 100644
--- a/chrome/browser/renderer_host/render_view_host.h
+++ b/chrome/browser/renderer_host/render_view_host.h
@@ -600,6 +600,7 @@ class RenderViewHost : public RenderWidgetHost {
   void OnNonSandboxedPluginBlocked(const string16& name);
   void OnBlockedPluginLoaded();
   void OnCrashedPlugin(const FilePath& plugin_path);
+  void OnDisabledOutdatedPlugin(const string16& name, const GURL& update_url);
 
   void OnReceivedSavableResourceLinksForCurrentPage(
       const std::vector<GURL>& resources_list,
diff --git a/chrome/browser/renderer_host/render_view_host_delegate.h b/chrome/browser/renderer_host/render_view_host_delegate.h
index a1fb979..ca13233 100644
--- a/chrome/browser/renderer_host/render_view_host_delegate.h
+++ b/chrome/browser/renderer_host/render_view_host_delegate.h
@@ -244,6 +244,9 @@ class RenderViewHostDelegate {
     // Notification that a worker process has crashed.
     virtual void OnCrashedWorker() = 0;
 
+    virtual void OnDisabledOutdatedPlugin(const string16& name,
+                                          const GURL& update_url) = 0;
+
     // Notification that a request for install info has completed.
     virtual void OnDidGetApplicationInfo(
         int32 page_id,
diff --git a/chrome/browser/tab_contents/tab_contents.cc b/chrome/browser/tab_contents/tab_contents.cc
index 2992612..96c2411 100644
--- a/chrome/browser/tab_contents/tab_contents.cc
+++ b/chrome/browser/tab_contents/tab_contents.cc
@@ -236,6 +236,68 @@ void MakeNavigateParams(const NavigationController& controller,
   params->request_time = base::Time::Now();
 }
 
+class DisabledPluginInfoBar : public ConfirmInfoBarDelegate {
+ public:
+  DisabledPluginInfoBar(TabContents* tab_contents,
+                        const string16& name,
+                        const GURL& update_url)
+      : ConfirmInfoBarDelegate(tab_contents),
+        tab_contents_(tab_contents),
+        name_(name),
+        update_url_(update_url) {
+    tab_contents->AddInfoBar(this);
+  }
+
+  virtual int GetButtons() const {
+    return BUTTON_OK | BUTTON_CANCEL | BUTTON_OK_DEFAULT;
+  }
+
+  virtual std::wstring GetButtonLabel(InfoBarButton button) const {
+    if (button == BUTTON_CANCEL)
+      return l10n_util::GetString(IDS_PLUGIN_ENABLE_TEMPORARILY);
+    if (button == BUTTON_OK)
+      return l10n_util::GetString(IDS_PLUGIN_UPDATE);
+    return ConfirmInfoBarDelegate::GetButtonLabel(button);
+  }
+
+  virtual std::wstring GetMessageText() const {
+    return UTF16ToWide(l10n_util::GetStringFUTF16(IDS_PLUGIN_OUTDATED_PROMPT,
+                                                  name_));
+  }
+
+  virtual std::wstring GetLinkText() {
+    return l10n_util::GetString(IDS_LEARN_MORE);
+  }
+
+  virtual SkBitmap* GetIcon() const {
+    return ResourceBundle::GetSharedInstance().GetBitmapNamed(
+        IDR_INFOBAR_PLUGIN_INSTALL);
+  }
+
+  virtual bool Accept() {
+    tab_contents_->OpenURL(update_url_, GURL(),
+                           CURRENT_TAB, PageTransition::LINK);
+    return false;
+  }
+
+  virtual bool Cancel() {
+    tab_contents_->OpenURL(GURL(chrome::kChromeUIPluginsURL), GURL(),
+                           CURRENT_TAB, PageTransition::LINK);
+    return false;
+  }
+
+  virtual bool LinkClicked(WindowOpenDisposition disposition) {
+    // TODO(bauerb): Navigate to a help page explaining why we disabled
+    // the plugin, once we have one.
+    return false;
+  }
+
+ private:
+  TabContents* tab_contents_;
+  string16 name_;
+  GURL update_url_;
+};
+
 }  // namespace
 
 // -----------------------------------------------------------------------------
@@ -1967,6 +2029,11 @@ void TabContents::OnDidGetApplicationInfo(
     delegate()->OnDidGetApplicationInfo(this, page_id);
 }
 
+void TabContents::OnDisabledOutdatedPlugin(const string16& name,
+                                           const GURL& update_url) {
+  new DisabledPluginInfoBar(this, name, update_url);
+}
+
 void TabContents::OnPageContents(const GURL& url,
                                  int renderer_process_id,
                                  int32 page_id,
diff --git a/chrome/browser/tab_contents/tab_contents.h b/chrome/browser/tab_contents/tab_contents.h
index 3511b7c..ab4cf56 100644
--- a/chrome/browser/tab_contents/tab_contents.h
+++ b/chrome/browser/tab_contents/tab_contents.h
@@ -834,6 +834,8 @@ class TabContents : public PageNavigator,
   virtual void OnDidGetApplicationInfo(
       int32 page_id,
       const webkit_glue::WebApplicationInfo& info);
+  virtual void OnDisabledOutdatedPlugin(const string16& name,
+                                        const GURL& update_url);
   virtual void OnPageContents(const GURL& url,
                               int renderer_process_id,
                               int32 page_id,
diff --git a/chrome/common/chrome_switches.cc b/chrome/common/chrome_switches.cc
index 454fffd..cf12f1c 100644
--- a/chrome/common/chrome_switches.cc
+++ b/chrome/common/chrome_switches.cc
@@ -184,6 +184,9 @@ const char kDisableLogging[]                = "disable-logging";
 // notification.
 const char kDisableNewTabFirstRun[]         = "disable-new-tab-first-run";
 
+// Prevent outdated plugins from running.
+const char kDisableOutdatedPlugins[]        = "disable-outdated-plugins";
+
 // Prevent plugins from running.
 const char kDisablePlugins[]                = "disable-plugins";
 
diff --git a/chrome/common/chrome_switches.h b/chrome/common/chrome_switches.h
index cc69770..b8f1255 100644
--- a/chrome/common/chrome_switches.h
+++ b/chrome/common/chrome_switches.h
@@ -67,6 +67,7 @@ extern const char kDisableJava[];
 extern const char kDisableLocalStorage[];
 extern const char kDisableLogging[];
 extern const char kDisableNewTabFirstRun[];
+extern const char kDisableOutdatedPlugins[];
 extern const char kDisablePlugins[];
 extern const char kDisablePopupBlocking[];
 extern const char kDisablePromptOnRepost[];
diff --git a/chrome/common/plugin_group.h b/chrome/common/plugin_group.h
index 7990038..d4db0fc 100644
--- a/chrome/common/plugin_group.h
+++ b/chrome/common/plugin_group.h
@@ -28,9 +28,13 @@ struct PluginGroupDefinition {
   const char* update_url;  // Location of latest secure version.
 };
 
+// A PluginGroup can match a range of versions of a specific plugin (as defined
+// by matching a substring of its name).
+// It contains all WebPluginInfo structs (at least one) matching its definition.
+// In addition, it knows about a security "baseline", i.e. the minimum version
+// of a plugin that is needed in order not to exhibit known security
+// vulnerabilities.
 
-// A PluginGroup contains at least one WebPluginInfo.
-// In addition, it knows if the plugin is critically vulnerable.
 class PluginGroup {
  public:
   // Creates a PluginGroup from a PluginGroupDefinition.
@@ -41,7 +45,9 @@ class PluginGroup {
   // definition is found.
   static PluginGroup* FromWebPluginInfo(const WebPluginInfo& wpi);
 
-  // Find a plugin group matching |info| in the list of hardcoded plugins.
+  // Find a plugin group matching |info| in the list of hardcoded plugins and
+  // returns a copy of it if found, or a new group matching exactly this plugin
+  // otherwise.
   static PluginGroup* FindHardcodedPluginGroup(const WebPluginInfo& info);
 
   // Configures the set of plugin names that are disabled by policy.
diff --git a/chrome/common/render_messages_internal.h b/chrome/common/render_messages_internal.h
index ce787dd..a9efdc8 100644
--- a/chrome/common/render_messages_internal.h
+++ b/chrome/common/render_messages_internal.h
@@ -1696,6 +1696,11 @@ IPC_BEGIN_MESSAGES(ViewHost)
   IPC_MESSAGE_ROUTED1(ViewHostMsg_CrashedPlugin,
                       FilePath /* plugin_path */)
 
+  // Notifies when a plugin couldn't be loaded because it's outdated.
+  IPC_MESSAGE_ROUTED2(ViewHostMsg_DisabledOutdatedPlugin,
+                      string16, /* name */
+                      GURL      /* update_url */)
+
   // Displays a JavaScript out-of-memory message in the infobar.
   IPC_MESSAGE_ROUTED0(ViewHostMsg_JSOutOfMemory)
 
diff --git a/chrome/renderer/blocked_plugin.cc b/chrome/renderer/blocked_plugin.cc
index c6433c3..b3c0973 100644
--- a/chrome/renderer/blocked_plugin.cc
+++ b/chrome/renderer/blocked_plugin.cc
@@ -10,6 +10,7 @@
 #include "base/string_piece.h"
 #include "chrome/common/jstemplate_builder.h"
 #include "chrome/common/notification_service.h"
+#include "chrome/common/plugin_group.h"
 #include "chrome/common/render_messages.h"
 #include "chrome/renderer/render_view.h"
 #include "grit/generated_resources.h"
@@ -33,7 +34,8 @@ static const char* const kBlockedPluginDataURL = "chrome://blockedplugindata/";
 
 BlockedPlugin::BlockedPlugin(RenderView* render_view,
                              WebFrame* frame,
-                            const WebPluginParams& params)
+                             const WebPluginParams& params,
+                             PluginGroup* group)
     : render_view_(render_view),
       frame_(frame),
       plugin_params_(params) {
@@ -49,15 +51,19 @@ BlockedPlugin::BlockedPlugin(RenderView* render_view,
   DCHECK(!template_html.empty()) << "unable to load template. ID: "
                                  << resource_id;
 
-  DictionaryValue localized_strings;
-  localized_strings.SetString(L"loadPlugin",
+  DictionaryValue values;
+  values.SetString(L"loadPlugin",
       l10n_util::GetStringUTF16(IDS_PLUGIN_LOAD));
-  localized_strings.SetString(L"message",
+  values.SetString(L"updatePlugin",
+      l10n_util::GetStringUTF16(IDS_PLUGIN_UPDATE));
+  values.SetString(L"message",
       l10n_util::GetStringUTF16(IDS_BLOCKED_PLUGINS_TITLE));
+  if (group)
+    values.Set(L"pluginGroup", group->GetDataForUI());
 
   // "t" is the id of the templates root node.
   std::string htmlData = jstemplate_builder::GetTemplatesHtml(
-      template_html, &localized_strings, "t");
+      template_html, &values, "t");
 
   web_view->mainFrame()->loadHTMLString(htmlData,
                                         GURL(kBlockedPluginDataURL));
@@ -70,6 +76,7 @@ BlockedPlugin::BlockedPlugin(RenderView* render_view,
 void BlockedPlugin::BindWebFrame(WebFrame* frame) {
   BindToJavascript(frame, L"plugin");
   BindMethod("load", &BlockedPlugin::Load);
+  BindMethod("update", &BlockedPlugin::Update);
 }
 
 void BlockedPlugin::WillDestroyPlugin() {
@@ -90,6 +97,23 @@ void BlockedPlugin::Load(const CppArgumentList& args, CppVariant* result) {
   LoadPlugin();
 }
 
+void BlockedPlugin::Update(const CppArgumentList& args, CppVariant* result) {
+  if (args.size() > 0) {
+    CppVariant arg(args[0]);
+    if (arg.isString()) {
+      GURL url(arg.ToString());
+      OpenURL(url);
+    }
+  }
+}
+
+void BlockedPlugin::OpenURL(GURL& url) {
+  render_view_->Send(new ViewHostMsg_OpenURL(render_view_->routing_id(),
+                                             url,
+                                             GURL(),
+                                             CURRENT_TAB));
+}
+
 void BlockedPlugin::LoadPlugin() {
   CHECK(plugin_);
   WebPluginContainer* container = plugin_->container();
diff --git a/chrome/renderer/blocked_plugin.h b/chrome/renderer/blocked_plugin.h
index 014c489..40a601d 100644
--- a/chrome/renderer/blocked_plugin.h
+++ b/chrome/renderer/blocked_plugin.h
@@ -11,6 +11,8 @@
 #include "webkit/glue/cpp_bound_class.h"
 #include "webkit/glue/plugins/webview_plugin.h"
 
+class GURL;
+class PluginGroup;
 class RenderView;
 
 class BlockedPlugin : public CppBoundClass,
@@ -19,10 +21,8 @@ class BlockedPlugin : public CppBoundClass,
  public:
   BlockedPlugin(RenderView* render_view,
                 WebKit::WebFrame* frame,
-                const WebKit::WebPluginParams& params);
-
-  void Load(const CppArgumentList& args, CppVariant* result);
-  void LoadPlugin();
+                const WebKit::WebPluginParams& params,
+                PluginGroup* group);
 
   WebViewPlugin* plugin() { return plugin_; }
 
@@ -38,6 +38,22 @@ class BlockedPlugin : public CppBoundClass,
  private:
   virtual ~BlockedPlugin() { }
 
+  // Javascript callbacks:
+  // Load the blocked plugin by calling LoadPlugin() below.
+  // Takes no arguments, and returns nothing.
+  void Load(const CppArgumentList& args, CppVariant* result);
+
+  // Update an outdated plugin. Takes one argument, the URL to download the
+  // latest version, and returns nothing.
+  void Update(const CppArgumentList& args, CppVariant* result);
+
+  // Tells the browser to navigate to |url| (to download the latest version of
+  // the plugin there).
+  void OpenURL(GURL& url);
+
+  // Load the blocked plugin.
+  void LoadPlugin();
+
   RenderView* render_view_;
   WebKit::WebFrame* frame_;
   WebKit::WebPluginParams plugin_params_;
diff --git a/chrome/renderer/render_view.cc b/chrome/renderer/render_view.cc
index 6a8f8e8..f4f5c86 100644
--- a/chrome/renderer/render_view.cc
+++ b/chrome/renderer/render_view.cc
@@ -34,6 +34,7 @@
 #include "chrome/common/notification_service.h"
 #include "chrome/common/page_zoom.h"
 #include "chrome/common/pepper_plugin_registry.h"
+#include "chrome/common/plugin_group.h"
 #include "chrome/common/render_messages.h"
 #include "chrome/common/renderer_preferences.h"
 #include "chrome/common/thumbnail_score.h"
@@ -2236,15 +2237,30 @@ WebPlugin* RenderView::createPlugin(WebFrame* frame,
                                      &info,
                                      &actual_mime_type));
 
-  if (!found || !info.enabled)
+  if (!found)
     return NULL;
 
+  scoped_ptr<PluginGroup> group(PluginGroup::FindHardcodedPluginGroup(info));
+  group->AddPlugin(info, 0);
+
+  if (!info.enabled) {
+    if (CommandLine::ForCurrentProcess()->HasSwitch(
+            switches::kDisableOutdatedPlugins) &&
+        group->IsVulnerable()) {
+      Send(new ViewHostMsg_DisabledOutdatedPlugin(routing_id_,
+                                                  group->GetGroupName(),
+                                                  GURL(group->GetUpdateURL())));
+      return CreatePluginPlaceholder(frame, params, group.get());
+    }
+    return NULL;
+  }
+
   if (info.path.value() != kDefaultPluginLibraryName) {
     if (!AllowContentType(CONTENT_SETTINGS_TYPE_PLUGINS)) {
       DCHECK(CommandLine::ForCurrentProcess()->HasSwitch(
           switches::kEnableClickToPlay));
       didNotAllowPlugins(frame);
-      return CreatePluginPlaceholder(frame, params);
+      return CreatePluginPlaceholder(frame, params, NULL);
     }
     scoped_refptr<pepper::PluginModule> pepper_module =
         PepperPluginRegistry::GetInstance()->GetModule(info.path);
@@ -2252,8 +2268,9 @@ WebPlugin* RenderView::createPlugin(WebFrame* frame,
       return CreatePepperPlugin(frame, params, info.path, pepper_module.get());
     if (CommandLine::ForCurrentProcess()->HasSwitch(
             switches::kBlockNonSandboxedPlugins)) {
-      Send(new ViewHostMsg_NonSandboxedPluginBlocked(routing_id_, info.name));
-      return CreatePluginPlaceholder(frame, params);
+      Send(new ViewHostMsg_NonSandboxedPluginBlocked(routing_id_,
+                                                     group->GetGroupName()));
+      return CreatePluginPlaceholder(frame, params, NULL);
     }
   }
   return CreateNPAPIPlugin(frame, params, info.path, actual_mime_type);
@@ -3746,11 +3763,13 @@ WebPlugin* RenderView::CreateNPAPIPlugin(WebFrame* frame,
 }
 
 WebPlugin* RenderView::CreatePluginPlaceholder(WebFrame* frame,
-                                               const WebPluginParams& params) {
+                                               const WebPluginParams& params,
+                                               PluginGroup* group) {
   // |blocked_plugin| will delete itself when the WebViewPlugin is destroyed.
-  BlockedPlugin* blocked_plugin = new BlockedPlugin(this, frame, params);
+  BlockedPlugin* blocked_plugin = new BlockedPlugin(this, frame, params, group);
   WebViewPlugin* plugin = blocked_plugin->plugin();
-  webkit_preferences_.Apply(plugin->web_view());
+  WebView* web_view = plugin->web_view();
+  webkit_preferences_.Apply(web_view);
   return plugin;
 }
 
diff --git a/chrome/renderer/render_view.h b/chrome/renderer/render_view.h
index 1834ba1..f31d27e 100644
--- a/chrome/renderer/render_view.h
+++ b/chrome/renderer/render_view.h
@@ -64,6 +64,7 @@ class ListValue;
 class NavigationState;
 class NotificationProvider;
 class PepperDeviceTest;
+class PluginGroup;
 class PrintWebViewHelper;
 class RenderViewVisitor;
 class SkBitmap;
@@ -868,7 +869,8 @@ class RenderView : public RenderWidget,
   // Create a new placeholder for a blocked plugin.
   WebKit::WebPlugin* CreatePluginPlaceholder(
       WebKit::WebFrame* frame,
-      const WebKit::WebPluginParams& params);
+      const WebKit::WebPluginParams& params,
+      PluginGroup* group);
 
   // Sends an IPC notification that the specified content type was blocked.
   void DidBlockContentType(ContentSettingsType settings_type);
diff --git a/chrome/renderer/resources/blocked_plugin.html b/chrome/renderer/resources/blocked_plugin.html
index 4310e98..b643b4d 100644
--- a/chrome/renderer/resources/blocked_plugin.html
+++ b/chrome/renderer/resources/blocked_plugin.html
@@ -1,12 +1,26 @@
 <!DOCTYPE html>
 <html>
 <head>
+<script>
+function debug(msg) {
+  document.getElementById('debug').textContent = msg;
+}
+
+function bodyClicked() {
+  var group = templateData.pluginGroup;
+  if (group) {
+    plugin.update(group.update_url);
+  } else {
+    plugin.load();
+  }
+}
+</script>
 <style>
 body {
-    background-color: rgb(252, 235, 162);
-    margin: 0;
-    text-align: center;
-    font-family: sans-serif;
+  background-color: rgb(252, 235, 162);
+  margin: 0;
+  text-align: center;
+  font-family: sans-serif;
 }
 
 h1 {
@@ -16,7 +30,7 @@ h1 {
 }
 
 #outer:hover h1 {
-    text-decoration: underline;
+  text-decoration: underline;
 }
 
 p {
@@ -25,32 +39,32 @@ p {
 }
 
 #outer {
-    width: 100%;
-    height: 100%;
-    cursor: pointer;
-    position: absolute;
+  width: 100%;
+  height: 100%;
+  cursor: pointer;
+  position: absolute;
 }
 
 #inner {
-    position: relative;
-    top: 50%;
-    margin-top: -50px;
+  position: relative;
+  top: 50%;
+  margin-top: -50px;
 }
 
 #top, #bottom, #left, #right {
-	background: black;
-	position: fixed;
+  background: black;
+  position: fixed;
 }
 #left, #right {
-	top: 0; bottom: 0;
-	width: 1px;
+  top: 0; bottom: 0;
+  width: 1px;
 }
 #left { left: 0; }
 #right { right: 0; }
 
 #top, #bottom {
-	left: 0; right: 0;
-	height: 1px;
+  left: 0; right: 0;
+  height: 1px;
 }
 #top { top: 0; }
 #bottom { bottom: 0; }
@@ -58,15 +72,17 @@ p {
 </head>
 
 <body id="t">
-<div id="outer" onclick="plugin.load()">
+<div id="outer" onclick="bodyClicked()">
 <div id="left"></div>
 <div id="right"></div>
 <div id="top"></div>
 <div id="bottom"></div>
 <div id="inner">
 <div><img src="../../app/theme/extensions_section.png" /></div>
-<h1 i18n-content="loadPlugin">PLUGIN_LOAD</h1>
+<h1 jsdisplay="!hasOwnProperty('pluginGroup') || !pluginGroup.critical"  i18n-content="loadPlugin">PLUGIN_LOAD</h1>
+<h1 jsdisplay="hasOwnProperty('pluginGroup')" i18n-content="updatePlugin">UPDATE_PLUGIN</h1>
 <p><span class="help" i18n-content="message">BLOCKED_PLUGINS_TITLE</span></p>
+<p id="debug"> </p>
 </div>
 </div>
 </body>