Add extension permissions for Media Gallery API.

chrome/browser/extensions/api/media_gallery/media_gallery_api.cc

Index: chrome/browser/extensions/api/media_gallery/media_gallery_api.cc
diff --git a/chrome/browser/extensions/api/media_gallery/media_gallery_api.cc b/chrome/browser/extensions/api/media_gallery/media_gallery_api.cc
index 15698f6081fcc0582d9248ec50199fa61e7e28ee..6990056754705e9862922f0a89de65250727feb9 100644
--- a/chrome/browser/extensions/api/media_gallery/media_gallery_api.cc
+++ b/chrome/browser/extensions/api/media_gallery/media_gallery_api.cc
@@ -52,11 +52,16 @@ bool GetMediaFileSystemsFunction::RunImpl() {
         "dirname", Value::CreateStringValue("_"));
     list->Append(dict_value);
 
-    content::ChildProcessSecurityPolicy* policy =
-        ChildProcessSecurityPolicy::GetInstance();
-    if (!policy->CanReadFile(child_id, path))
-      policy->GrantReadFile(child_id, path);
-    policy->GrantReadFileSystem(child_id, fsid);
+
+    if (GetExtension()->HasAPIPermission(
+            extensions::APIPermission::kMediaGalleriesRead)) {
+      content::ChildProcessSecurityPolicy* policy =
+          ChildProcessSecurityPolicy::GetInstance();
+      if (!policy->CanReadFile(child_id, path))
+        policy->GrantReadFile(child_id, path);
+      policy->GrantReadFileSystem(child_id, fsid);
+    }

[Matt Perry, 2012/07/24 00:21:07]

What happens if the extension doesn't have read permission? Should we return an
error?

[vandebo (ex-Chrome), 2012/07/24 00:32:57]

It's an implementation detail that we could get here with the MediaGalleries
permission.  Only the MediaGalleriesRead/Write/Append permission should be
specified by extensions. If there's a cleaner way to do that then the implied
permission I've used here, I'd be happy to hear about it.  But given all that,
I'm happy to add an error case if only mediaGalleries is specified.

[Matt Perry, 2012/07/24 00:51:20]

But an extension could get here by only requesting the mediaGalleriesWrite
permission? Is calling this method an error in that case?

[vandebo (ex-Chrome), 2012/07/24 01:07:59]

Correct.  That's not an error.  But right now, only Read is defined, Write, and
Append will get defined later.

+    // TODO(vandebo) Handle write permission.
   }
 
   SetResult(list);