Default to FOLDERID_Downloads on Windows Vista/7 when safe.

Landing for DCheng@.
Codereview: http://codereview.chromium.org/553040
TEST=none
BUG=13610

git-svn-id: svn://svn.chromium.org/chrome/trunk/src@37023 0039d316-1c4b-4281-b951-d872f2087c98

1 files changed, 23 insertions, 5 deletions

diff --git a/chrome/common/chrome_paths_win.cc b/chrome/common/chrome_paths_win.cc
index 5a860b9..40ef825 100644
--- a/chrome/common/chrome_paths_win.cc
+++ b/chrome/common/chrome_paths_win.cc
@@ -5,11 +5,15 @@
 #include "chrome/common/chrome_paths_internal.h"
 
 #include <windows.h>
+#include <knownfolders.h>
 #include <shellapi.h>
 #include <shlobj.h>
+#include <shobjidl.h>
 
+#include "app/win_util.h"
 #include "base/file_path.h"
 #include "base/path_service.h"
+#include "base/scoped_comptr_win.h"
 #include "chrome/common/chrome_constants.h"
 
 namespace chrome {
@@ -45,13 +49,11 @@ bool GetUserDocumentsDirectory(FilePath* result) {
   return true;
 }
 
-// On Vista, we can get the download path using a Win API
-// (http://msdn.microsoft.com/en-us/library/bb762584(VS.85).aspx),
-// but it can be set to Desktop, which is dangerous. Instead,
-// we just use 'Downloads' under DIR_USER_DOCUMENTS. Localizing
+// Return a default path for downloads that is safe.
+// We just use 'Downloads' under DIR_USER_DOCUMENTS. Localizing
 // 'downloads' is not a good idea because Chrome's UI language
 // can be changed.
-bool GetUserDownloadsDirectory(FilePath* result) {
+bool GetUserDownloadsDirectorySafe(FilePath* result) {
   if (!GetUserDocumentsDirectory(result))
     return false;
 
@@ -59,6 +61,22 @@ bool GetUserDownloadsDirectory(FilePath* result) {
   return true;
 }
 
+// On Vista and higher, use the downloads known folder. Since it can be
+// relocated to point to a "dangerous" folder, callers should validate that the
+// returned path is not dangerous before using it.
+bool GetUserDownloadsDirectory(FilePath* result) {
+  typedef HRESULT (WINAPI *GetKnownFolderPath)(
+      REFKNOWNFOLDERID, DWORD, HANDLE, PWSTR*);
+  GetKnownFolderPath f = reinterpret_cast<GetKnownFolderPath>(
+      GetProcAddress(GetModuleHandle(L"shell32.dll"), "SHGetKnownFolderPath"));
+  win_util::CoMemReleaser<wchar_t> path_buf;
+  if (f && SUCCEEDED(f(FOLDERID_Downloads, 0, NULL, &path_buf))) {
+    *result = FilePath(std::wstring(path_buf));
+    return true;
+  }
+  return GetUserDownloadsDirectorySafe(result);
+}
+
 bool GetUserDesktop(FilePath* result) {
   // We need to go compute the value. It would be nice to support paths
   // with names longer than MAX_PATH, but the system functions don't seem