dlls/mshtml/pluginhost.c

   1 /*
   2  * Copyright 2010 Jacek Caban for CodeWeavers
   3  *
   4  * This library is free software; you can redistribute it and/or
   5  * modify it under the terms of the GNU Lesser General Public
   6  * License as published by the Free Software Foundation; either
   7  * version 2.1 of the License, or (at your option) any later version.
   8  *
   9  * This library is distributed in the hope that it will be useful,
  10  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  11  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  12  * Lesser General Public License for more details.
  13  *
  14  * You should have received a copy of the GNU Lesser General Public
  15  * License along with this library; if not, write to the Free Software
  16  * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
  17  */
  18
  19 #include "config.h"
  20
  21 #include <stdarg.h>
  22 #include <assert.h>
  23
  24 #define COBJMACROS
  25
  26 #include "windef.h"
  27 #include "winbase.h"
  28 #include "winuser.h"
  29 #include "ole2.h"
  30 #include "shlobj.h"
  31 #include "mshtmdid.h"
  32
  33 #include "mshtml_private.h"
  34 #include "pluginhost.h"
  35
  36 #include "wine/debug.h"
  37
  38 WINE_DEFAULT_DEBUG_CHANNEL(mshtml);
  39
  40 static BOOL check_load_safety(PluginHost *host)
  41 {
  42     DWORD policy_size, policy;
  43     struct CONFIRMSAFETY cs;
  44     BYTE *ppolicy;
  45     HRESULT hres;
  46
  47     cs.clsid = host->clsid;
  48     cs.pUnk = host->plugin_unk;
  49     cs.dwFlags = CONFIRMSAFETYACTION_LOADOBJECT;
  50
  51     hres = IInternetHostSecurityManager_QueryCustomPolicy(&host->doc->IInternetHostSecurityManager_iface,
  52             &GUID_CUSTOM_CONFIRMOBJECTSAFETY, &ppolicy, &policy_size, (BYTE*)&cs, sizeof(cs), 0);
  53     if(FAILED(hres))
  54         return FALSE;
  55
  56     policy = *(DWORD*)ppolicy;
  57     CoTaskMemFree(ppolicy);
  58     return policy == URLPOLICY_ALLOW;
  59 }
  60
  61 static BOOL check_script_safety(PluginHost *host)
  62 {
  63     DISPPARAMS params = {NULL,NULL,0,0};
  64     DWORD policy_size, policy;
  65     struct CONFIRMSAFETY cs;
  66     BYTE *ppolicy;
  67     ULONG err = 0;
  68     VARIANT v;
  69     HRESULT hres;
  70
  71     cs.clsid = host->clsid;
  72     cs.pUnk = host->plugin_unk;
  73     cs.dwFlags = 0;
  74
  75     hres = IInternetHostSecurityManager_QueryCustomPolicy(&host->doc->IInternetHostSecurityManager_iface,
  76             &GUID_CUSTOM_CONFIRMOBJECTSAFETY, &ppolicy, &policy_size, (BYTE*)&cs, sizeof(cs), 0);
  77     if(FAILED(hres))
  78         return FALSE;
  79
  80     policy = *(DWORD*)ppolicy;
  81     CoTaskMemFree(ppolicy);
  82
  83     if(policy != URLPOLICY_ALLOW)
  84         return FALSE;
  85
  86     V_VT(&v) = VT_EMPTY;
  87     hres = IDispatch_Invoke(host->disp, DISPID_SECURITYCTX, &IID_NULL, 0, DISPATCH_PROPERTYGET, &params, &v, NULL, &err);
  88     if(SUCCEEDED(hres)) {
  89         FIXME("Handle security ctx %s\n", debugstr_variant(&v));
  90         return FALSE;
  91     }
  92
  93     return TRUE;
  94 }
  95
  96 static void update_readystate(PluginHost *host)
  97 {
  98     DISPPARAMS params = {NULL,NULL,0,0};
  99     IDispatchEx *dispex;
 100     IDispatch *disp;
 101     ULONG err = 0;
 102     VARIANT v;
 103     HRESULT hres;
 104
 105     hres = IUnknown_QueryInterface(host->plugin_unk, &IID_IDispatchEx, (void**)&dispex);
 106     if(SUCCEEDED(hres)) {
 107         FIXME("Use IDispatchEx\n");
 108         IDispatchEx_Release(dispex);
 109     }
 110
 111     hres = IUnknown_QueryInterface(host->plugin_unk, &IID_IDispatch, (void**)&disp);
 112     if(FAILED(hres))
 113         return;
 114
 115     hres = IDispatch_Invoke(disp, DISPID_READYSTATE, &IID_NULL, 0, DISPATCH_PROPERTYGET, &params, &v, NULL, &err);
 116     IDispatch_Release(disp);
 117     if(SUCCEEDED(hres)) {
 118         /* FIXME: make plugin readystate affect document readystate */
 119         TRACE("readystate = %s\n", debugstr_variant(&v));
 120         VariantClear(&v);
 121     }
 122 }
 123
 124 /* FIXME: We shouldn't need this function and we should embed plugin directly in the main document */
 125 static void get_pos_rect(PluginHost *host, RECT *ret)
 126 {
 127     ret->top = 0;
 128     ret->left = 0;
 129     ret->bottom = host->rect.bottom - host->rect.top;
 130     ret->right = host->rect.right - host->rect.left;
 131 }
 132
 133 static void load_prop_bag(PluginHost *host, IPersistPropertyBag *persist_prop_bag)
 134 {
 135     IPropertyBag *prop_bag;
 136     HRESULT hres;
 137
 138     hres = create_param_prop_bag(host->element->element.nselem, &prop_bag);
 139     if(FAILED(hres))
 140         return;
 141
 142     if(prop_bag && !check_load_safety(host)) {
 143         IPropertyBag_Release(prop_bag);
 144         prop_bag = NULL;
 145     }
 146
 147     if(prop_bag) {
 148         hres = IPersistPropertyBag_Load(persist_prop_bag, prop_bag, NULL);
 149         IPropertyBag_Release(prop_bag);
 150         if(FAILED(hres))
 151             WARN("Load failed: %08x\n", hres);
 152     }else {
 153         hres = IPersistPropertyBag_InitNew(persist_prop_bag);
 154         if(FAILED(hres))
 155             WARN("InitNew failed: %08x\n", hres);
 156     }
 157 }
 158
 159 static void load_plugin(PluginHost *host)
 160 {
 161     IPersistPropertyBag2 *persist_prop_bag2;
 162     IPersistPropertyBag *persist_prop_bag;
 163     HRESULT hres;
 164
 165     hres = IUnknown_QueryInterface(host->plugin_unk, &IID_IPersistPropertyBag2, (void**)&persist_prop_bag2);
 166     if(SUCCEEDED(hres)) {
 167         FIXME("Use IPersistPropertyBag2 iface\n");
 168         IPersistPropertyBag2_Release(persist_prop_bag2);
 169         return;
 170     }
 171
 172     hres = IUnknown_QueryInterface(host->plugin_unk, &IID_IPersistPropertyBag, (void**)&persist_prop_bag);
 173     if(SUCCEEDED(hres)) {
 174         load_prop_bag(host, persist_prop_bag);
 175         IPersistPropertyBag_Release(persist_prop_bag);
 176         return;
 177     }
 178
 179     FIXME("No IPersistPropertyBag iface\n");
 180 }
 181
 182 static void initialize_plugin_object(PluginHost *host)
 183 {
 184     IClientSecurity *client_security;
 185     IQuickActivate *quick_activate;
 186     IOleObject *ole_obj = NULL;
 187     IOleCommandTarget *cmdtrg;
 188     IViewObjectEx *view_obj;
 189     IDispatchEx *dispex;
 190     IDispatch *disp;
 191     HRESULT hres;
 192
 193     /* Note native calls QI on plugin for an undocumented IID and CLSID_HTMLDocument */
 194
 195     /* FIXME: call FreezeEvents(TRUE) */
 196
 197     hres = IUnknown_QueryInterface(host->plugin_unk, &IID_IClientSecurity, (void**)&client_security);
 198     if(SUCCEEDED(hres)) {
 199         FIXME("Handle IClientSecurity\n");
 200         IClientSecurity_Release(client_security);
 201         return;
 202     }
 203
 204     hres = IUnknown_QueryInterface(host->plugin_unk, &IID_IQuickActivate, (void**)&quick_activate);
 205     if(SUCCEEDED(hres)) {
 206         QACONTAINER container = {sizeof(container)};
 207         QACONTROL control = {sizeof(control)};
 208
 209         TRACE("Using IQuickActivate\n");
 210
 211         container.pClientSite = &host->IOleClientSite_iface;
 212         container.dwAmbientFlags = QACONTAINER_SUPPORTSMNEMONICS|QACONTAINER_MESSAGEREFLECT|QACONTAINER_USERMODE;
 213         container.pAdviseSink = &host->IAdviseSinkEx_iface;
 214         container.pPropertyNotifySink = &host->IPropertyNotifySink_iface;
 215
 216         hres = IQuickActivate_QuickActivate(quick_activate, &container, &control);
 217         IQuickActivate_Release(quick_activate);
 218         if(FAILED(hres))
 219             FIXME("QuickActivate failed: %08x\n", hres);
 220     }else {
 221         DWORD status = 0;
 222
 223         hres = IUnknown_QueryInterface(host->plugin_unk, &IID_IOleObject, (void**)&ole_obj);
 224         if(SUCCEEDED(hres)) {
 225             hres = IOleObject_GetMiscStatus(ole_obj, DVASPECT_CONTENT, &status);
 226             TRACE("GetMiscStatus returned %08x %x\n", hres, status);
 227
 228             hres = IOleObject_SetClientSite(ole_obj, &host->IOleClientSite_iface);
 229             IOleObject_Release(ole_obj);
 230             if(FAILED(hres)) {
 231                 FIXME("SetClientSite failed: %08x\n", hres);
 232                 return;
 233             }
 234         }else {
 235             TRACE("Plugin does not support IOleObject\n");
 236         }
 237     }
 238
 239     load_plugin(host);
 240
 241     if(ole_obj) {
 242         hres = IUnknown_QueryInterface(host->plugin_unk, &IID_IViewObjectEx, (void**)&view_obj);
 243         if(SUCCEEDED(hres)) {
 244             DWORD view_status = 0;
 245
 246             hres = IViewObjectEx_SetAdvise(view_obj, DVASPECT_CONTENT, 0, (IAdviseSink*)&host->IAdviseSinkEx_iface);
 247             if(FAILED(hres))
 248                 WARN("SetAdvise failed: %08x\n", hres);
 249
 250             hres = IViewObjectEx_GetViewStatus(view_obj, &view_status);
 251             IViewObjectEx_Release(view_obj);
 252             TRACE("GetViewStatus returned %08x %x\n", hres, view_status);
 253         }
 254     }
 255
 256     update_readystate(host);
 257
 258     /* NOTE: Native QIs for IActiveScript, an undocumented IID, IOleControl and IRunnableObject */
 259
 260     hres = IUnknown_QueryInterface(host->plugin_unk, &IID_IDispatchEx, (void**)&dispex);
 261     if(SUCCEEDED(hres)) {
 262         FIXME("Use IDispatchEx\n");
 263         host->disp = (IDispatch*)dispex;
 264     }else {
 265         hres = IUnknown_QueryInterface(host->plugin_unk, &IID_IDispatch, (void**)&disp);
 266         if(SUCCEEDED(hres))
 267             host->disp = disp;
 268         else
 269             TRACE("no IDispatch iface\n");
 270     }
 271
 272     hres = IUnknown_QueryInterface(host->plugin_unk, &IID_IOleCommandTarget, (void**)&cmdtrg);
 273     if(SUCCEEDED(hres)) {
 274         FIXME("Use IOleCommandTarget\n");
 275         IOleCommandTarget_Release(cmdtrg);
 276     }
 277 }
 278
 279 static void embed_plugin_object(PluginHost *host)
 280 {
 281     IOleObject *ole_obj;
 282     RECT rect;
 283     HRESULT hres;
 284
 285     hres = IUnknown_QueryInterface(host->plugin_unk, &IID_IOleObject, (void**)&ole_obj);
 286     if(FAILED(hres)) {
 287         FIXME("Plugin does not support IOleObject\n");
 288         return;
 289     }
 290
 291     get_pos_rect(host, &rect);
 292     hres = IOleObject_DoVerb(ole_obj, OLEIVERB_INPLACEACTIVATE, NULL, &host->IOleClientSite_iface, 0, host->hwnd, &rect);
 293     IOleObject_Release(ole_obj);
 294     if(FAILED(hres))
 295         WARN("DoVerb failed: %08x\n", hres);
 296
 297     if(host->ip_object) {
 298         HWND hwnd;
 299
 300         hres = IOleInPlaceObject_GetWindow(host->ip_object, &hwnd);
 301         if(SUCCEEDED(hres))
 302             TRACE("hwnd %p\n", hwnd);
 303     }
 304 }
 305
 306 void update_plugin_window(PluginHost *host, HWND hwnd, const RECT *rect)
 307 {
 308     BOOL rect_changed = FALSE;
 309
 310     if(!hwnd || (host->hwnd && host->hwnd != hwnd)) {
 311         FIXME("unhandled hwnd\n");
 312         return;
 313     }
 314
 315     TRACE("%p %s\n", hwnd, wine_dbgstr_rect(rect));
 316
 317     if(memcmp(rect, &host->rect, sizeof(RECT))) {
 318         host->rect = *rect;
 319         rect_changed = TRUE;
 320     }
 321
 322     if(!host->hwnd) {
 323         host->hwnd = hwnd;
 324         embed_plugin_object(host);
 325     }
 326
 327     if(rect_changed && host->ip_object)
 328         IOleInPlaceObject_SetObjectRects(host->ip_object, &host->rect, &host->rect);
 329 }
 330
 331 static void notif_enabled(PluginHost *plugin_host)
 332 {
 333     DISPPARAMS args = {NULL, NULL, 0, 0};
 334     IDispatch *disp;
 335     ULONG err = 0;
 336     VARIANT res;
 337     HRESULT hres;
 338
 339     hres = IUnknown_QueryInterface(plugin_host->plugin_unk, &IID_IDispatch, (void**)&disp);
 340     if(FAILED(hres)) {
 341         FIXME("Could not get IDispatch iface: %08x\n", hres);
 342         return;
 343     }
 344
 345     V_VT(&res) = VT_EMPTY;
 346     hres = IDispatch_Invoke(disp, DISPID_ENABLED, &IID_NULL, 0/*FIXME*/, DISPATCH_PROPERTYGET, &args, &res, NULL, &err);
 347     IDispatch_Release(disp);
 348     if(SUCCEEDED(hres)) {
 349         FIXME("Got enabled %s\n", debugstr_variant(&res));
 350         VariantClear(&res);
 351     }
 352 }
 353
 354 void notif_container_change(HTMLPluginContainer *plugin_container, DISPID dispid)
 355 {
 356     IOleControl *ole_control;
 357     HRESULT hres;
 358
 359     if(!plugin_container->plugin_host || !plugin_container->plugin_host->plugin_unk)
 360         return;
 361
 362     notif_enabled(plugin_container->plugin_host);
 363
 364     hres = IUnknown_QueryInterface(plugin_container->plugin_host->plugin_unk, &IID_IOleControl, (void**)&ole_control);
 365     if(SUCCEEDED(hres)) {
 366         IOleControl_OnAmbientPropertyChange(ole_control, dispid);
 367         IOleControl_Release(ole_control);
 368     }
 369 }
 370
 371 HRESULT get_plugin_disp(HTMLPluginContainer *plugin_container, IDispatch **ret)
 372 {
 373     PluginHost *host;
 374
 375     host = plugin_container->plugin_host;
 376     if(!host) {
 377         ERR("No plugin host\n");
 378         return E_UNEXPECTED;
 379     }
 380
 381     if(!host->disp) {
 382         *ret = NULL;
 383         return S_OK;
 384     }
 385
 386     if(!check_script_safety(host)) {
 387         FIXME("Insecure object\n");
 388         return E_FAIL;
 389     }
 390
 391     IDispatch_AddRef(host->disp);
 392     *ret = host->disp;
 393     return S_OK;
 394 }
 395
 396 HRESULT get_plugin_dispid(HTMLPluginContainer *plugin_container, WCHAR *name, DISPID *ret)
 397 {
 398     IDispatch *disp;
 399     DISPID id;
 400     DWORD i;
 401     HRESULT hres;
 402
 403     if(!plugin_container->plugin_host) {
 404         WARN("no plugin host\n");
 405         return DISP_E_UNKNOWNNAME;
 406     }
 407
 408     disp = plugin_container->plugin_host->disp;
 409     if(!disp)
 410         return DISP_E_UNKNOWNNAME;
 411
 412     hres = IDispatch_GetIDsOfNames(disp, &IID_NULL, &name, 1, 0, &id);
 413     if(FAILED(hres)) {
 414         TRACE("no prop %s\n", debugstr_w(name));
 415         return DISP_E_UNKNOWNNAME;
 416     }
 417
 418     for(i=0; i < plugin_container->props_len; i++) {
 419         if(id == plugin_container->props[i]) {
 420             *ret = MSHTML_DISPID_CUSTOM_MIN+i;
 421             return S_OK;
 422         }
 423     }
 424
 425     if(!plugin_container->props) {
 426         plugin_container->props = heap_alloc(8*sizeof(DISPID));
 427         if(!plugin_container->props)
 428             return E_OUTOFMEMORY;
 429         plugin_container->props_size = 8;
 430     }else if(plugin_container->props_len == plugin_container->props_size) {
 431         DISPID *new_props;
 432
 433         new_props = heap_realloc(plugin_container->props, plugin_container->props_size*2*sizeof(DISPID));
 434         if(!new_props)
 435             return E_OUTOFMEMORY;
 436
 437         plugin_container->props = new_props;
 438         plugin_container->props_size *= 2;
 439     }
 440
 441     plugin_container->props[plugin_container->props_len] = id;
 442     *ret = MSHTML_DISPID_CUSTOM_MIN+plugin_container->props_len;
 443     plugin_container->props_len++;
 444     return S_OK;
 445 }
 446
 447 HRESULT invoke_plugin_prop(HTMLPluginContainer *plugin_container, DISPID id, LCID lcid, WORD flags, DISPPARAMS *params,
 448         VARIANT *res, EXCEPINFO *ei)
 449 {
 450     PluginHost *host;
 451
 452     host = plugin_container->plugin_host;
 453     if(!host || !host->disp) {
 454         FIXME("Called with no disp\n");
 455         return E_UNEXPECTED;
 456     }
 457
 458     if(!check_script_safety(host)) {
 459         FIXME("Insecure object\n");
 460         return E_FAIL;
 461     }
 462
 463     if(id < MSHTML_DISPID_CUSTOM_MIN || id > MSHTML_DISPID_CUSTOM_MIN + plugin_container->props_len) {
 464         ERR("Invalid id\n");
 465         return E_FAIL;
 466     }
 467
 468     return IDispatch_Invoke(host->disp, plugin_container->props[id-MSHTML_DISPID_CUSTOM_MIN], &IID_NULL,
 469             lcid, flags, params, res, ei, NULL);
 470 }
 471
 472 typedef struct {
 473     DISPID id;
 474     IDispatch *disp;
 475 } sink_entry_t;
 476
 477 struct PHEventSink {
 478     IDispatch IDispatch_iface;
 479
 480     LONG ref;
 481
 482     PluginHost *host;
 483     ITypeInfo *typeinfo;
 484     GUID iid;
 485     DWORD cookie;
 486     BOOL is_dispiface;
 487
 488     sink_entry_t *handlers;
 489     DWORD handlers_cnt;
 490     DWORD handlers_size;
 491 };
 492
 493 static sink_entry_t *find_sink_entry(PHEventSink *sink, DISPID id)
 494 {
 495     sink_entry_t *iter;
 496
 497     for(iter = sink->handlers; iter < sink->handlers+sink->handlers_cnt; iter++) {
 498         if(iter->id == id)
 499             return iter;
 500     }
 501
 502     return NULL;
 503 }
 504
 505 static void add_sink_handler(PHEventSink *sink, DISPID id, IDispatch *disp)
 506 {
 507     sink_entry_t *entry = find_sink_entry(sink, id);
 508
 509     if(entry) {
 510         if(entry->disp)
 511             IDispatch_Release(entry->disp);
 512     }else {
 513         if(!sink->handlers_size) {
 514             sink->handlers = heap_alloc(4*sizeof(*sink->handlers));
 515             if(!sink->handlers)
 516                 return;
 517             sink->handlers_size = 4;
 518         }else if(sink->handlers_cnt == sink->handlers_size) {
 519             sink_entry_t *new_handlers;
 520
 521             new_handlers = heap_realloc(sink->handlers, 2*sink->handlers_size*sizeof(*sink->handlers));
 522             if(!new_handlers)
 523                 return;
 524             sink->handlers = new_handlers;
 525             sink->handlers_size *= 2;
 526         }
 527         entry = sink->handlers + sink->handlers_cnt++;
 528         entry->id = id;
 529     }
 530
 531     IDispatch_AddRef(disp);
 532     entry->disp = disp;
 533 }
 534
 535 static inline PHEventSink *PHEventSink_from_IDispatch(IDispatch *iface)
 536 {
 537     return CONTAINING_RECORD(iface, PHEventSink, IDispatch_iface);
 538 }
 539
 540 static HRESULT WINAPI PHEventSink_QueryInterface(IDispatch *iface, REFIID riid, void **ppv)
 541 {
 542     PHEventSink *This = PHEventSink_from_IDispatch(iface);
 543
 544     if(IsEqualGUID(riid, &IID_IUnknown)) {
 545         TRACE("(%p)->(IID_IUnknown %p)\n", This, ppv);
 546         *ppv = &This->IDispatch_iface;
 547     }else if(IsEqualGUID(riid, &IID_IDispatch)) {
 548         TRACE("(%p)->(IID_IDispatch %p)\n", This, ppv);
 549         *ppv = &This->IDispatch_iface;
 550     }else if(This->is_dispiface && IsEqualGUID(riid, &This->iid)) {
 551         TRACE("(%p)->(%s %p)\n", This, debugstr_guid(riid), ppv);
 552         *ppv = &This->IDispatch_iface;
 553     }else {
 554         WARN("(%p)->(%s %p)\n", This, debugstr_guid(riid), ppv);
 555         *ppv = NULL;
 556         return E_NOINTERFACE;
 557     }
 558
 559     IUnknown_AddRef((IUnknown*)*ppv);
 560     return S_OK;
 561 }
 562
 563 static ULONG WINAPI PHEventSink_AddRef(IDispatch *iface)
 564 {
 565     PHEventSink *This = PHEventSink_from_IDispatch(iface);
 566     LONG ref = InterlockedIncrement(&This->ref);
 567
 568     TRACE("(%p)\n", This);
 569
 570     return ref;
 571 }
 572
 573 static ULONG WINAPI PHEventSink_Release(IDispatch *iface)
 574 {
 575     PHEventSink *This = PHEventSink_from_IDispatch(iface);
 576     LONG ref = InterlockedDecrement(&This->ref);
 577
 578     TRACE("(%p)\n", This);
 579
 580     if(!ref) {
 581         unsigned i;
 582
 583         assert(!This->host);
 584
 585         for(i=0; i < This->handlers_cnt; i++) {
 586             if(This->handlers[i].disp)
 587                 IDispatch_Release(This->handlers[i].disp);
 588         }
 589         heap_free(This->handlers);
 590         heap_free(This);
 591     }
 592
 593     return ref;
 594 }
 595
 596 static HRESULT WINAPI PHEventSink_GetTypeInfoCount(IDispatch *iface, UINT *pctinfo)
 597 {
 598     PHEventSink *This = PHEventSink_from_IDispatch(iface);
 599     FIXME("(%p)->(%p)\n", This, pctinfo);
 600     return E_NOTIMPL;
 601 }
 602
 603 static HRESULT WINAPI PHEventSink_GetTypeInfo(IDispatch *iface, UINT iTInfo,
 604         LCID lcid, ITypeInfo **ppTInfo)
 605 {
 606     PHEventSink *This = PHEventSink_from_IDispatch(iface);
 607     FIXME("(%p)->(%d %d %p)\n", This, iTInfo, lcid, ppTInfo);
 608     return E_NOTIMPL;
 609 }
 610
 611 static HRESULT WINAPI PHEventSink_GetIDsOfNames(IDispatch *iface, REFIID riid, LPOLESTR *rgszNames,
 612         UINT cNames, LCID lcid, DISPID *rgDispId)
 613 {
 614     PHEventSink *This = PHEventSink_from_IDispatch(iface);
 615     FIXME("(%p)->(%s %p %u %d %p)\n", This, debugstr_guid(riid), rgszNames, cNames, lcid, rgDispId);
 616     return E_NOTIMPL;
 617 }
 618
 619 static HRESULT WINAPI PHEventSink_Invoke(IDispatch *iface, DISPID dispIdMember, REFIID riid, LCID lcid,
 620         WORD wFlags, DISPPARAMS *pDispParams, VARIANT *pVarResult, EXCEPINFO *pExcepInfo, UINT *puArgErr)
 621 {
 622     PHEventSink *This = PHEventSink_from_IDispatch(iface);
 623     IDispatchEx *dispex;
 624     sink_entry_t *entry;
 625     HRESULT hres;
 626
 627     TRACE("(%p)->(%d %s %d %x %p %p %p %p)\n", This, dispIdMember, debugstr_guid(riid), lcid, wFlags,
 628           pDispParams, pVarResult, pExcepInfo, puArgErr);
 629
 630     if(!This->host) {
 631         WARN("No host\n");
 632         return E_UNEXPECTED;
 633     }
 634
 635     entry = find_sink_entry(This, dispIdMember);
 636     if(!entry || !entry->disp) {
 637         WARN("No handler %d\n", dispIdMember);
 638         if(pVarResult)
 639             V_VT(pVarResult) = VT_EMPTY;
 640         return S_OK;
 641     }
 642
 643     hres = IDispatch_QueryInterface(entry->disp, &IID_IDispatchEx, (void**)&dispex);
 644
 645     TRACE("(%p) %d >>>\n", This, entry->id);
 646     if(SUCCEEDED(hres)) {
 647         hres = IDispatchEx_InvokeEx(dispex, DISPID_VALUE, lcid, wFlags, pDispParams, pVarResult, pExcepInfo, NULL);
 648         IDispatchEx_Release(dispex);
 649     }else {
 650         hres = IDispatch_Invoke(entry->disp, DISPID_VALUE, riid, lcid, wFlags, pDispParams, pVarResult, pExcepInfo, puArgErr);
 651     }
 652     if(SUCCEEDED(hres))
 653         TRACE("(%p) %d <<<\n", This, entry->id);
 654     else
 655         WARN("(%p) %d <<< %08x\n", This, entry->id, hres);
 656     return hres;
 657 }
 658
 659 static const IDispatchVtbl PHCPDispatchVtbl = {
 660     PHEventSink_QueryInterface,
 661     PHEventSink_AddRef,
 662     PHEventSink_Release,
 663     PHEventSink_GetTypeInfoCount,
 664     PHEventSink_GetTypeInfo,
 665     PHEventSink_GetIDsOfNames,
 666     PHEventSink_Invoke
 667 };
 668
 669 static PHEventSink *create_event_sink(PluginHost *plugin_host, ITypeInfo *typeinfo)
 670 {
 671     IConnectionPointContainer *cp_container;
 672     PHEventSink *ret;
 673     IConnectionPoint *cp;
 674     TYPEATTR *typeattr;
 675     TYPEKIND typekind;
 676     GUID guid;
 677     HRESULT hres;
 678
 679     hres = ITypeInfo_GetTypeAttr(typeinfo, &typeattr);
 680     if(FAILED(hres))
 681         return NULL;
 682
 683     typekind = typeattr->typekind;
 684     guid = typeattr->guid;
 685     ITypeInfo_ReleaseTypeAttr(typeinfo, typeattr);
 686
 687     TRACE("guid %s typekind %d\n", debugstr_guid(&guid), typekind);
 688
 689     if(typekind != TKIND_INTERFACE && typekind != TKIND_DISPATCH) {
 690         WARN("invalid typekind %d\n", typekind);
 691         return NULL;
 692     }
 693
 694     hres = IUnknown_QueryInterface(plugin_host->plugin_unk, &IID_IConnectionPointContainer, (void**)&cp_container);
 695     if(FAILED(hres)) {
 696         WARN("Could not get IConnectionPointContainer iface: %08x\n", hres);
 697         return NULL;
 698     }
 699
 700     hres = IConnectionPointContainer_FindConnectionPoint(cp_container, &guid, &cp);
 701     IConnectionPointContainer_Release(cp_container);
 702     if(FAILED(hres)) {
 703         WARN("Could not find %s connection point\n", debugstr_guid(&guid));
 704         return NULL;
 705     }
 706
 707     ret = heap_alloc_zero(sizeof(*ret));
 708     if(ret) {
 709         ret->IDispatch_iface.lpVtbl = &PHCPDispatchVtbl;
 710         ret->ref = 1;
 711         ret->host = plugin_host;
 712         ret->iid = guid;
 713         ret->is_dispiface = typekind == TKIND_DISPATCH;
 714
 715         ITypeInfo_AddRef(typeinfo);
 716         ret->typeinfo = typeinfo;
 717
 718         hres = IConnectionPoint_Advise(cp, (IUnknown*)&ret->IDispatch_iface, &ret->cookie);
 719     }else {
 720         hres = E_OUTOFMEMORY;
 721     }
 722
 723     IConnectionPoint_Release(cp);
 724     if(FAILED(hres)) {
 725         WARN("Advise failed: %08x\n", hres);
 726         return NULL;
 727     }
 728
 729     return ret;
 730 }
 731
 732 static ITypeInfo *get_eventiface_info(HTMLPluginContainer *plugin_container, ITypeInfo *class_info)
 733 {
 734     int impl_types, i, impl_flags;
 735     ITypeInfo *ret = NULL;
 736     TYPEATTR *typeattr;
 737     HREFTYPE ref;
 738     HRESULT hres;
 739
 740     hres = ITypeInfo_GetTypeAttr(class_info, &typeattr);
 741     if(FAILED(hres))
 742         return NULL;
 743
 744     if(typeattr->typekind != TKIND_COCLASS) {
 745         WARN("not coclass\n");
 746         ITypeInfo_ReleaseTypeAttr(class_info, typeattr);
 747         return NULL;
 748     }
 749
 750     impl_types = typeattr->cImplTypes;
 751     ITypeInfo_ReleaseTypeAttr(class_info, typeattr);
 752
 753     for(i=0; i<impl_types; i++) {
 754         hres = ITypeInfo_GetImplTypeFlags(class_info, i, &impl_flags);
 755         if(FAILED(hres))
 756             continue;
 757
 758         if((impl_flags & IMPLTYPEFLAG_FSOURCE)) {
 759             if(!(impl_flags & IMPLTYPEFLAG_FDEFAULT)) {
 760                 FIXME("Handle non-default source iface\n");
 761                 continue;
 762             }
 763
 764             hres = ITypeInfo_GetRefTypeOfImplType(class_info, i, &ref);
 765             if(FAILED(hres))
 766                 continue;
 767
 768             hres = ITypeInfo_GetRefTypeInfo(class_info, ref, &ret);
 769             if(FAILED(hres))
 770                 ret = NULL;
 771         }
 772     }
 773
 774     return ret;
 775 }
 776
 777 void bind_activex_event(HTMLDocumentNode *doc, HTMLPluginContainer *plugin_container, WCHAR *event, IDispatch *disp)
 778 {
 779     PluginHost *plugin_host = plugin_container->plugin_host;
 780     ITypeInfo *class_info, *source_info;
 781     DISPID id;
 782     HRESULT hres;
 783
 784     TRACE("(%p %p %s %p)\n", doc, plugin_host, debugstr_w(event), disp);
 785
 786     if(!plugin_host || !plugin_host->plugin_unk) {
 787         WARN("detached element %p\n", plugin_host);
 788         return;
 789     }
 790
 791     if(plugin_host->sink) {
 792         source_info = plugin_host->sink->typeinfo;
 793         ITypeInfo_AddRef(source_info);
 794     }else {
 795         IProvideClassInfo *provide_ci;
 796
 797         hres = IUnknown_QueryInterface(plugin_host->plugin_unk, &IID_IProvideClassInfo, (void**)&provide_ci);
 798         if(FAILED(hres)) {
 799             FIXME("No IProvideClassInfo, try GetTypeInfo?\n");
 800             return;
 801         }
 802
 803         hres = IProvideClassInfo_GetClassInfo(provide_ci, &class_info);
 804         IProvideClassInfo_Release(provide_ci);
 805         if(FAILED(hres) || !class_info) {
 806             WARN("GetClassInfo failed: %08x\n", hres);
 807             return;
 808         }
 809
 810         source_info = get_eventiface_info(plugin_container, class_info);
 811         ITypeInfo_Release(class_info);
 812         if(!source_info)
 813             return;
 814     }
 815
 816     hres = ITypeInfo_GetIDsOfNames(source_info, &event, 1, &id);
 817     if(FAILED(hres))
 818         WARN("Could not get disp id: %08x\n", hres);
 819     else if(!plugin_host->sink)
 820         plugin_host->sink = create_event_sink(plugin_host, source_info);
 821
 822     ITypeInfo_Release(source_info);
 823     if(FAILED(hres) || !plugin_host->sink)
 824         return;
 825
 826     add_sink_handler(plugin_host->sink, id, disp);
 827 }
 828
 829 static inline PluginHost *impl_from_IOleClientSite(IOleClientSite *iface)
 830 {
 831     return CONTAINING_RECORD(iface, PluginHost, IOleClientSite_iface);
 832 }
 833
 834 static HRESULT WINAPI PHClientSite_QueryInterface(IOleClientSite *iface, REFIID riid, void **ppv)
 835 {
 836     PluginHost *This = impl_from_IOleClientSite(iface);
 837
 838     if(IsEqualGUID(&IID_IUnknown, riid)) {
 839         TRACE("(%p)->(IID_IUnknown %p)\n", This, ppv);
 840         *ppv = &This->IOleClientSite_iface;
 841     }else if(IsEqualGUID(&IID_IOleClientSite, riid)) {
 842         TRACE("(%p)->(IID_IOleClientSite %p)\n", This, ppv);
 843         *ppv = &This->IOleClientSite_iface;
 844     }else if(IsEqualGUID(&IID_IAdviseSink, riid)) {
 845         TRACE("(%p)->(IID_IAdviseSink %p)\n", This, ppv);
 846         *ppv = &This->IAdviseSinkEx_iface;
 847     }else if(IsEqualGUID(&IID_IAdviseSinkEx, riid)) {
 848         TRACE("(%p)->(IID_IAdviseSinkEx %p)\n", This, ppv);
 849         *ppv = &This->IAdviseSinkEx_iface;
 850     }else if(IsEqualGUID(&IID_IPropertyNotifySink, riid)) {
 851         TRACE("(%p)->(IID_IPropertyNotifySink %p)\n", This, ppv);
 852         *ppv = &This->IPropertyNotifySink_iface;
 853     }else if(IsEqualGUID(&IID_IDispatch, riid)) {
 854         TRACE("(%p)->(IID_IDispatch %p)\n", This, ppv);
 855         *ppv = &This->IDispatch_iface;
 856     }else if(IsEqualGUID(&IID_IOleWindow, riid)) {
 857         TRACE("(%p)->(IID_IOleWindow %p)\n", This, ppv);
 858         *ppv = &This->IOleInPlaceSiteEx_iface;
 859     }else if(IsEqualGUID(&IID_IOleInPlaceSite, riid)) {
 860         TRACE("(%p)->(IID_IOleInPlaceSite %p)\n", This, ppv);
 861         *ppv = &This->IOleInPlaceSiteEx_iface;
 862     }else if(IsEqualGUID(&IID_IOleInPlaceSiteEx, riid)) {
 863         TRACE("(%p)->(IID_IOleInPlaceSiteEx %p)\n", This, ppv);
 864         *ppv = &This->IOleInPlaceSiteEx_iface;
 865     }else if(IsEqualGUID(&IID_IOleControlSite, riid)) {
 866         TRACE("(%p)->(IID_IOleControlSite %p)\n", This, ppv);
 867         *ppv = &This->IOleControlSite_iface;
 868     }else if(IsEqualGUID(&IID_IBindHost, riid)) {
 869         TRACE("(%p)->(IID_IBindHost %p)\n", This, ppv);
 870         *ppv = &This->IBindHost_iface;
 871     }else if(IsEqualGUID(&IID_IServiceProvider, riid)) {
 872         TRACE("(%p)->(IID_IServiceProvider %p)\n", This, ppv);
 873         *ppv = &This->IServiceProvider_iface;
 874     }else {
 875         WARN("Unsupported interface %s\n", debugstr_guid(riid));
 876         *ppv = NULL;
 877         return E_NOINTERFACE;
 878     }
 879
 880     IUnknown_AddRef((IUnknown*)*ppv);
 881     return S_OK;
 882 }
 883
 884 static ULONG WINAPI PHClientSite_AddRef(IOleClientSite *iface)
 885 {
 886     PluginHost *This = impl_from_IOleClientSite(iface);
 887     LONG ref = InterlockedIncrement(&This->ref);
 888
 889     TRACE("(%p) ref=%d\n", This, ref);
 890
 891     return ref;
 892 }
 893
 894 static void release_plugin_ifaces(PluginHost *This)
 895 {
 896     if(This->disp) {
 897         IDispatch_Release(This->disp);
 898         This->disp = NULL;
 899     }
 900
 901     if(This->ip_object) {
 902         IOleInPlaceObject_Release(This->ip_object);
 903         This->ip_object = NULL;
 904     }
 905
 906     if(This->plugin_unk) {
 907         IUnknown *unk = This->plugin_unk;
 908         LONG ref;
 909
 910         This->plugin_unk = NULL;
 911         ref = IUnknown_Release(unk);
 912
 913         TRACE("plugin ref = %d\n", ref);
 914     }
 915 }
 916
 917 static ULONG WINAPI PHClientSite_Release(IOleClientSite *iface)
 918 {
 919     PluginHost *This = impl_from_IOleClientSite(iface);
 920     LONG ref = InterlockedDecrement(&This->ref);
 921
 922     TRACE("(%p) ref=%d\n", This, ref);
 923
 924     if(!ref) {
 925         release_plugin_ifaces(This);
 926         if(This->sink) {
 927             This->sink->host = NULL;
 928             IDispatch_Release(&This->sink->IDispatch_iface);
 929             This->sink = NULL;
 930         }
 931         list_remove(&This->entry);
 932         if(This->element)
 933             This->element->plugin_host = NULL;
 934         heap_free(This);
 935     }
 936
 937     return ref;
 938 }
 939
 940 static HRESULT WINAPI PHClientSite_SaveObject(IOleClientSite *iface)
 941 {
 942     PluginHost *This = impl_from_IOleClientSite(iface);
 943     FIXME("(%p)\n", This);
 944     return E_NOTIMPL;
 945 }
 946
 947 static HRESULT WINAPI PHClientSite_GetMoniker(IOleClientSite *iface, DWORD dwAssign,
 948         DWORD dwWhichMoniker, IMoniker **ppmk)
 949 {
 950     PluginHost *This = impl_from_IOleClientSite(iface);
 951
 952     TRACE("(%p)->(%d %d %p)\n", This, dwAssign, dwWhichMoniker, ppmk);
 953
 954     switch(dwWhichMoniker) {
 955     case OLEWHICHMK_CONTAINER:
 956         if(!This->doc || !This->doc->window || !This->doc->window->mon) {
 957             FIXME("no moniker\n");
 958             return E_UNEXPECTED;
 959         }
 960
 961         *ppmk = This->doc->window->mon;
 962         IMoniker_AddRef(*ppmk);
 963         break;
 964     default:
 965         FIXME("which %d\n", dwWhichMoniker);
 966         return E_NOTIMPL;
 967     }
 968
 969     return S_OK;
 970 }
 971
 972 static HRESULT WINAPI PHClientSite_GetContainer(IOleClientSite *iface, IOleContainer **ppContainer)
 973 {
 974     PluginHost *This = impl_from_IOleClientSite(iface);
 975
 976     TRACE("(%p)->(%p)\n", This, ppContainer);
 977
 978     if(!This->doc) {
 979         ERR("Called on detached object\n");
 980         return E_UNEXPECTED;
 981     }
 982
 983     *ppContainer = &This->doc->basedoc.IOleContainer_iface;
 984     IOleContainer_AddRef(*ppContainer);
 985     return S_OK;
 986 }
 987
 988 static HRESULT WINAPI PHClientSite_ShowObject(IOleClientSite *iface)
 989 {
 990     PluginHost *This = impl_from_IOleClientSite(iface);
 991
 992     TRACE("(%p)\n", This);
 993
 994     return S_OK;
 995 }
 996
 997 static HRESULT WINAPI PHClientSite_OnShowWindow(IOleClientSite *iface, BOOL fShow)
 998 {
 999     PluginHost *This = impl_from_IOleClientSite(iface);
1000     FIXME("(%p)->(%x)\n", This, fShow);
1001     return E_NOTIMPL;
1002 }
1003
1004 static HRESULT WINAPI PHClientSite_RequestNewObjectLayout(IOleClientSite *iface)
1005 {
1006     PluginHost *This = impl_from_IOleClientSite(iface);
1007     FIXME("(%p)\n", This);
1008     return E_NOTIMPL;
1009 }
1010
1011 static const IOleClientSiteVtbl OleClientSiteVtbl = {
1012     PHClientSite_QueryInterface,
1013     PHClientSite_AddRef,
1014     PHClientSite_Release,
1015     PHClientSite_SaveObject,
1016     PHClientSite_GetMoniker,
1017     PHClientSite_GetContainer,
1018     PHClientSite_ShowObject,
1019     PHClientSite_OnShowWindow,
1020     PHClientSite_RequestNewObjectLayout
1021 };
1022
1023 static inline PluginHost *impl_from_IAdviseSinkEx(IAdviseSinkEx *iface)
1024 {
1025     return CONTAINING_RECORD(iface, PluginHost, IAdviseSinkEx_iface);
1026 }
1027
1028 static HRESULT WINAPI PHAdviseSinkEx_QueryInterface(IAdviseSinkEx *iface, REFIID riid, void **ppv)
1029 {
1030     PluginHost *This = impl_from_IAdviseSinkEx(iface);
1031     return IOleClientSite_QueryInterface(&This->IOleClientSite_iface, riid, ppv);
1032 }
1033
1034 static ULONG WINAPI PHAdviseSinkEx_AddRef(IAdviseSinkEx *iface)
1035 {
1036     PluginHost *This = impl_from_IAdviseSinkEx(iface);
1037     return IOleClientSite_AddRef(&This->IOleClientSite_iface);
1038 }
1039
1040 static ULONG WINAPI PHAdviseSinkEx_Release(IAdviseSinkEx *iface)
1041 {
1042     PluginHost *This = impl_from_IAdviseSinkEx(iface);
1043     return IOleClientSite_Release(&This->IOleClientSite_iface);
1044 }
1045
1046 static void WINAPI PHAdviseSinkEx_OnDataChange(IAdviseSinkEx *iface, FORMATETC *pFormatetc, STGMEDIUM *pStgMedium)
1047 {
1048     PluginHost *This = impl_from_IAdviseSinkEx(iface);
1049     FIXME("(%p)->(%p %p)\n", This, pFormatetc, pStgMedium);
1050 }
1051
1052 static void WINAPI PHAdviseSinkEx_OnViewChange(IAdviseSinkEx *iface, DWORD dwAspect, LONG lindex)
1053 {
1054     PluginHost *This = impl_from_IAdviseSinkEx(iface);
1055     FIXME("(%p)->(%d %d)\n", This, dwAspect, lindex);
1056 }
1057
1058 static void WINAPI PHAdviseSinkEx_OnRename(IAdviseSinkEx *iface, IMoniker *pmk)
1059 {
1060     PluginHost *This = impl_from_IAdviseSinkEx(iface);
1061     FIXME("(%p)->(%p)\n", This, pmk);
1062 }
1063
1064 static void WINAPI PHAdviseSinkEx_OnSave(IAdviseSinkEx *iface)
1065 {
1066     PluginHost *This = impl_from_IAdviseSinkEx(iface);
1067     FIXME("(%p)\n", This);
1068 }
1069
1070 static void WINAPI PHAdviseSinkEx_OnClose(IAdviseSinkEx *iface)
1071 {
1072     PluginHost *This = impl_from_IAdviseSinkEx(iface);
1073     FIXME("(%p)\n", This);
1074 }
1075
1076 static void WINAPI PHAdviseSinkEx_OnViewStatusChange(IAdviseSinkEx *iface, DWORD dwViewStatus)
1077 {
1078     PluginHost *This = impl_from_IAdviseSinkEx(iface);
1079     FIXME("(%p)->(%d)\n", This, dwViewStatus);
1080 }
1081
1082 static const IAdviseSinkExVtbl AdviseSinkExVtbl = {
1083     PHAdviseSinkEx_QueryInterface,
1084     PHAdviseSinkEx_AddRef,
1085     PHAdviseSinkEx_Release,
1086     PHAdviseSinkEx_OnDataChange,
1087     PHAdviseSinkEx_OnViewChange,
1088     PHAdviseSinkEx_OnRename,
1089     PHAdviseSinkEx_OnSave,
1090     PHAdviseSinkEx_OnClose,
1091     PHAdviseSinkEx_OnViewStatusChange
1092 };
1093
1094 static inline PluginHost *impl_from_IPropertyNotifySink(IPropertyNotifySink *iface)
1095 {
1096     return CONTAINING_RECORD(iface, PluginHost, IPropertyNotifySink_iface);
1097 }
1098
1099 static HRESULT WINAPI PHPropertyNotifySink_QueryInterface(IPropertyNotifySink *iface, REFIID riid, void **ppv)
1100 {
1101     PluginHost *This = impl_from_IPropertyNotifySink(iface);
1102     return IOleClientSite_QueryInterface(&This->IOleClientSite_iface, riid, ppv);
1103 }
1104
1105 static ULONG WINAPI PHPropertyNotifySink_AddRef(IPropertyNotifySink *iface)
1106 {
1107     PluginHost *This = impl_from_IPropertyNotifySink(iface);
1108     return IOleClientSite_AddRef(&This->IOleClientSite_iface);
1109 }
1110
1111 static ULONG WINAPI PHPropertyNotifySink_Release(IPropertyNotifySink *iface)
1112 {
1113     PluginHost *This = impl_from_IPropertyNotifySink(iface);
1114     return IOleClientSite_Release(&This->IOleClientSite_iface);
1115 }
1116
1117 static HRESULT WINAPI PHPropertyNotifySink_OnChanged(IPropertyNotifySink *iface, DISPID dispID)
1118 {
1119     PluginHost *This = impl_from_IPropertyNotifySink(iface);
1120
1121     TRACE("(%p)->(%d)\n", This, dispID);
1122
1123     switch(dispID) {
1124     case DISPID_READYSTATE:
1125         update_readystate(This);
1126         break;
1127     default :
1128         FIXME("Unimplemented dispID %d\n", dispID);
1129         return E_NOTIMPL;
1130     }
1131
1132     return S_OK;
1133 }
1134
1135 static HRESULT WINAPI PHPropertyNotifySink_OnRequestEdit(IPropertyNotifySink *iface, DISPID dispID)
1136 {
1137     PluginHost *This = impl_from_IPropertyNotifySink(iface);
1138     FIXME("(%p)->(%d)\n", This, dispID);
1139     return E_NOTIMPL;
1140 }
1141
1142 static const IPropertyNotifySinkVtbl PropertyNotifySinkVtbl = {
1143     PHPropertyNotifySink_QueryInterface,
1144     PHPropertyNotifySink_AddRef,
1145     PHPropertyNotifySink_Release,
1146     PHPropertyNotifySink_OnChanged,
1147     PHPropertyNotifySink_OnRequestEdit
1148 };
1149
1150 static inline PluginHost *impl_from_IDispatch(IDispatch *iface)
1151 {
1152     return CONTAINING_RECORD(iface, PluginHost, IDispatch_iface);
1153 }
1154
1155 static HRESULT WINAPI PHDispatch_QueryInterface(IDispatch *iface, REFIID riid, void **ppv)
1156 {
1157     PluginHost *This = impl_from_IDispatch(iface);
1158     return IOleClientSite_QueryInterface(&This->IOleClientSite_iface, riid, ppv);
1159 }
1160
1161 static ULONG WINAPI PHDispatch_AddRef(IDispatch *iface)
1162 {
1163     PluginHost *This = impl_from_IDispatch(iface);
1164     return IOleClientSite_AddRef(&This->IOleClientSite_iface);
1165 }
1166
1167 static ULONG WINAPI PHDispatch_Release(IDispatch *iface)
1168 {
1169     PluginHost *This = impl_from_IDispatch(iface);
1170     return IOleClientSite_Release(&This->IOleClientSite_iface);
1171 }
1172
1173 static HRESULT WINAPI PHDispatch_GetTypeInfoCount(IDispatch *iface, UINT *pctinfo)
1174 {
1175     PluginHost *This = impl_from_IDispatch(iface);
1176     FIXME("(%p)->(%p)\n", This, pctinfo);
1177     return E_NOTIMPL;
1178 }
1179
1180 static HRESULT WINAPI PHDispatch_GetTypeInfo(IDispatch *iface, UINT iTInfo,
1181         LCID lcid, ITypeInfo **ppTInfo)
1182 {
1183     PluginHost *This = impl_from_IDispatch(iface);
1184     FIXME("(%p)->(%d %d %p)\n", This, iTInfo, lcid, ppTInfo);
1185     return E_NOTIMPL;
1186 }
1187
1188 static HRESULT WINAPI PHDispatch_GetIDsOfNames(IDispatch *iface, REFIID riid,
1189         LPOLESTR *rgszNames, UINT cNames, LCID lcid, DISPID *rgDispId)
1190 {
1191     PluginHost *This = impl_from_IDispatch(iface);
1192     FIXME("(%p)->(%s %p %d %d %p)\n", This, debugstr_guid(riid), rgszNames, cNames, lcid, rgDispId);
1193     return E_NOTIMPL;
1194 }
1195
1196 static HRESULT WINAPI PHDispatch_Invoke(IDispatch *iface, DISPID dispid,  REFIID riid, LCID lcid,
1197         WORD wFlags, DISPPARAMS *pDispParams, VARIANT *pVarResult, EXCEPINFO *pExcepInfo, UINT *puArgErr)
1198 {
1199     PluginHost *This = impl_from_IDispatch(iface);
1200     FIXME("(%p)->(%d %x %p %p)\n", This, dispid, wFlags, pDispParams, pVarResult);
1201     return E_NOTIMPL;
1202 }
1203
1204 static const IDispatchVtbl DispatchVtbl = {
1205     PHDispatch_QueryInterface,
1206     PHDispatch_AddRef,
1207     PHDispatch_Release,
1208     PHDispatch_GetTypeInfoCount,
1209     PHDispatch_GetTypeInfo,
1210     PHDispatch_GetIDsOfNames,
1211     PHDispatch_Invoke
1212 };
1213
1214 static inline PluginHost *impl_from_IOleInPlaceSiteEx(IOleInPlaceSiteEx *iface)
1215 {
1216     return CONTAINING_RECORD(iface, PluginHost, IOleInPlaceSiteEx_iface);
1217 }
1218
1219 static HRESULT WINAPI PHInPlaceSite_QueryInterface(IOleInPlaceSiteEx *iface, REFIID riid, void **ppv)
1220 {
1221     PluginHost *This = impl_from_IOleInPlaceSiteEx(iface);
1222     return IOleClientSite_QueryInterface(&This->IOleClientSite_iface, riid, ppv);
1223 }
1224
1225 static ULONG WINAPI PHInPlaceSite_AddRef(IOleInPlaceSiteEx *iface)
1226 {
1227     PluginHost *This = impl_from_IOleInPlaceSiteEx(iface);
1228     return IOleClientSite_AddRef(&This->IOleClientSite_iface);
1229 }
1230
1231 static ULONG WINAPI PHInPlaceSite_Release(IOleInPlaceSiteEx *iface)
1232 {
1233     PluginHost *This = impl_from_IOleInPlaceSiteEx(iface);
1234     return IOleClientSite_Release(&This->IOleClientSite_iface);
1235 }
1236
1237 static HRESULT WINAPI PHInPlaceSite_GetWindow(IOleInPlaceSiteEx *iface, HWND *phwnd)
1238 {
1239     PluginHost *This = impl_from_IOleInPlaceSiteEx(iface);
1240
1241     TRACE("(%p)->(%p)\n", This, phwnd);
1242
1243     *phwnd = This->hwnd;
1244     return S_OK;
1245 }
1246
1247 static HRESULT WINAPI PHInPlaceSite_ContextSensitiveHelp(IOleInPlaceSiteEx *iface, BOOL fEnterMode)
1248 {
1249     PluginHost *This = impl_from_IOleInPlaceSiteEx(iface);
1250     FIXME("(%p)->(%x)\n", This, fEnterMode);
1251     return E_NOTIMPL;
1252 }
1253
1254 static HRESULT WINAPI PHInPlaceSite_CanInPlaceActivate(IOleInPlaceSiteEx *iface)
1255 {
1256     PluginHost *This = impl_from_IOleInPlaceSiteEx(iface);
1257
1258     TRACE("(%p)\n", This);
1259
1260     return S_OK;
1261 }
1262
1263 static HRESULT WINAPI PHInPlaceSite_OnInPlaceActivate(IOleInPlaceSiteEx *iface)
1264 {
1265     PluginHost *This = impl_from_IOleInPlaceSiteEx(iface);
1266     FIXME("(%p)\n", This);
1267     return E_NOTIMPL;
1268 }
1269
1270 static HRESULT WINAPI PHInPlaceSite_OnUIActivate(IOleInPlaceSiteEx *iface)
1271 {
1272     PluginHost *This = impl_from_IOleInPlaceSiteEx(iface);
1273
1274     TRACE("(%p)\n", This);
1275
1276     if(!This->plugin_unk) {
1277         ERR("No plugin object\n");
1278         return E_UNEXPECTED;
1279     }
1280
1281     This->ui_active = TRUE;
1282
1283     notif_enabled(This);
1284     return S_OK;
1285 }
1286
1287 static HRESULT WINAPI PHInPlaceSite_GetWindowContext(IOleInPlaceSiteEx *iface,
1288         IOleInPlaceFrame **ppFrame, IOleInPlaceUIWindow **ppDoc, RECT *lprcPosRect,
1289         RECT *lprcClipRect, OLEINPLACEFRAMEINFO *frame_info)
1290 {
1291     PluginHost *This = impl_from_IOleInPlaceSiteEx(iface);
1292     IOleInPlaceUIWindow *ip_window;
1293     IOleInPlaceFrame *ip_frame;
1294     RECT pr, cr;
1295     HRESULT hres;
1296
1297     TRACE("(%p)->(%p %p %p %p %p)\n", This, ppFrame, ppDoc, lprcPosRect, lprcClipRect, frame_info);
1298
1299     if(!This->doc || !This->doc->basedoc.doc_obj || !This->doc->basedoc.doc_obj->ipsite) {
1300         FIXME("No ipsite\n");
1301         return E_UNEXPECTED;
1302     }
1303
1304     hres = IOleInPlaceSite_GetWindowContext(This->doc->basedoc.doc_obj->ipsite, &ip_frame, &ip_window, &pr, &cr, frame_info);
1305     if(FAILED(hres)) {
1306         WARN("GetWindowContext failed: %08x\n", hres);
1307         return hres;
1308     }
1309
1310     if(ip_window)
1311         IOleInPlaceUIWindow_Release(ip_window);
1312     if(ip_frame)
1313         IOleInPlaceFrame_Release(ip_frame);
1314
1315     hres = create_ip_frame(&ip_frame);
1316     if(FAILED(hres))
1317         return hres;
1318
1319     hres = create_ip_window(ppDoc);
1320     if(FAILED(hres)) {
1321         IOleInPlaceFrame_Release(ip_frame);
1322         return hres;
1323     }
1324
1325     *ppFrame = ip_frame;
1326     *lprcPosRect = This->rect;
1327     *lprcClipRect = This->rect;
1328     return S_OK;
1329 }
1330
1331 static HRESULT WINAPI PHInPlaceSite_Scroll(IOleInPlaceSiteEx *iface, SIZE scrollExtent)
1332 {
1333     PluginHost *This = impl_from_IOleInPlaceSiteEx(iface);
1334     FIXME("(%p)->({%d %d})\n", This, scrollExtent.cx, scrollExtent.cy);
1335     return E_NOTIMPL;
1336 }
1337
1338 static HRESULT WINAPI PHInPlaceSite_OnUIDeactivate(IOleInPlaceSiteEx *iface, BOOL fUndoable)
1339 {
1340     PluginHost *This = impl_from_IOleInPlaceSiteEx(iface);
1341     FIXME("(%p)->(%x)\n", This, fUndoable);
1342     return E_NOTIMPL;
1343 }
1344
1345 static HRESULT WINAPI PHInPlaceSite_OnInPlaceDeactivate(IOleInPlaceSiteEx *iface)
1346 {
1347     PluginHost *This = impl_from_IOleInPlaceSiteEx(iface);
1348
1349     TRACE("(%p)\n", This);
1350
1351     if(This->ip_object) {
1352         IOleInPlaceObject_Release(This->ip_object);
1353         This->ip_object = NULL;
1354     }
1355
1356     return S_OK;
1357 }
1358
1359 static HRESULT WINAPI PHInPlaceSite_DiscardUndoState(IOleInPlaceSiteEx *iface)
1360 {
1361     PluginHost *This = impl_from_IOleInPlaceSiteEx(iface);
1362     FIXME("(%p)\n", This);
1363     return E_NOTIMPL;
1364 }
1365
1366 static HRESULT WINAPI PHInPlaceSite_DeactivateAndUndo(IOleInPlaceSiteEx *iface)
1367 {
1368     PluginHost *This = impl_from_IOleInPlaceSiteEx(iface);
1369     FIXME("(%p)\n", This);
1370     return E_NOTIMPL;
1371 }
1372
1373 static HRESULT WINAPI PHInPlaceSite_OnPosRectChange(IOleInPlaceSiteEx *iface, LPCRECT lprcPosRect)
1374 {
1375     PluginHost *This = impl_from_IOleInPlaceSiteEx(iface);
1376     FIXME("(%p)->(%p)\n", This, lprcPosRect);
1377     return E_NOTIMPL;
1378 }
1379
1380 static HRESULT WINAPI PHInPlaceSiteEx_OnInPlaceActivateEx(IOleInPlaceSiteEx *iface, BOOL *pfNoRedraw, DWORD dwFlags)
1381 {
1382     PluginHost *This = impl_from_IOleInPlaceSiteEx(iface);
1383     HWND hwnd;
1384     HRESULT hres;
1385
1386     TRACE("(%p)->(%p %x)\n", This, pfNoRedraw, dwFlags);
1387
1388     if(This->ip_object)
1389         return S_OK;
1390
1391     hres = IUnknown_QueryInterface(This->plugin_unk, &IID_IOleInPlaceObject, (void**)&This->ip_object);
1392     if(FAILED(hres))
1393         return hres;
1394
1395     hres = IOleInPlaceObject_GetWindow(This->ip_object, &hwnd);
1396     if(SUCCEEDED(hres))
1397         FIXME("Use hwnd %p\n", hwnd);
1398
1399     *pfNoRedraw = FALSE;
1400     return S_OK;
1401 }
1402
1403 static HRESULT WINAPI PHInPlaceSiteEx_OnInPlaceDeactivateEx(IOleInPlaceSiteEx *iface, BOOL fNoRedraw)
1404 {
1405     PluginHost *This = impl_from_IOleInPlaceSiteEx(iface);
1406     FIXME("(%p)->(%x)\n", This, fNoRedraw);
1407     return E_NOTIMPL;
1408 }
1409
1410 static HRESULT WINAPI PHInPlaceSiteEx_RequestUIActivate(IOleInPlaceSiteEx *iface)
1411 {
1412     PluginHost *This = impl_from_IOleInPlaceSiteEx(iface);
1413     FIXME("(%p)\n", This);
1414     return E_NOTIMPL;
1415 }
1416
1417 static const IOleInPlaceSiteExVtbl OleInPlaceSiteExVtbl = {
1418     PHInPlaceSite_QueryInterface,
1419     PHInPlaceSite_AddRef,
1420     PHInPlaceSite_Release,
1421     PHInPlaceSite_GetWindow,
1422     PHInPlaceSite_ContextSensitiveHelp,
1423     PHInPlaceSite_CanInPlaceActivate,
1424     PHInPlaceSite_OnInPlaceActivate,
1425     PHInPlaceSite_OnUIActivate,
1426     PHInPlaceSite_GetWindowContext,
1427     PHInPlaceSite_Scroll,
1428     PHInPlaceSite_OnUIDeactivate,
1429     PHInPlaceSite_OnInPlaceDeactivate,
1430     PHInPlaceSite_DiscardUndoState,
1431     PHInPlaceSite_DeactivateAndUndo,
1432     PHInPlaceSite_OnPosRectChange,
1433     PHInPlaceSiteEx_OnInPlaceActivateEx,
1434     PHInPlaceSiteEx_OnInPlaceDeactivateEx,
1435     PHInPlaceSiteEx_RequestUIActivate
1436 };
1437
1438 static inline PluginHost *impl_from_IOleControlSite(IOleControlSite *iface)
1439 {
1440     return CONTAINING_RECORD(iface, PluginHost, IOleControlSite_iface);
1441 }
1442
1443 static HRESULT WINAPI PHControlSite_QueryInterface(IOleControlSite *iface, REFIID riid, void **ppv)
1444 {
1445     PluginHost *This = impl_from_IOleControlSite(iface);
1446     return IOleClientSite_QueryInterface(&This->IOleClientSite_iface, riid, ppv);
1447 }
1448
1449 static ULONG WINAPI PHControlSite_AddRef(IOleControlSite *iface)
1450 {
1451     PluginHost *This = impl_from_IOleControlSite(iface);
1452     return IOleClientSite_AddRef(&This->IOleClientSite_iface);
1453 }
1454
1455 static ULONG WINAPI PHControlSite_Release(IOleControlSite *iface)
1456 {
1457     PluginHost *This = impl_from_IOleControlSite(iface);
1458     return IOleClientSite_Release(&This->IOleClientSite_iface);
1459 }
1460
1461 static HRESULT WINAPI PHControlSite_OnControlInfoChanged(IOleControlSite *iface)
1462 {
1463     PluginHost *This = impl_from_IOleControlSite(iface);
1464     FIXME("(%p)\n", This);
1465     return E_NOTIMPL;
1466 }
1467
1468 static HRESULT WINAPI PHControlSite_LockInPlaceActive(IOleControlSite *iface, BOOL fLock)
1469 {
1470     PluginHost *This = impl_from_IOleControlSite(iface);
1471     FIXME("(%p)->(%x)\n", This, fLock);
1472     return E_NOTIMPL;
1473 }
1474
1475 static HRESULT WINAPI PHControlSite_GetExtendedControl(IOleControlSite *iface, IDispatch **ppDisp)
1476 {
1477     PluginHost *This = impl_from_IOleControlSite(iface);
1478     FIXME("(%p)->(%p)\n", This, ppDisp);
1479     return E_NOTIMPL;
1480 }
1481
1482 static HRESULT WINAPI PHControlSite_TransformCoords(IOleControlSite *iface, POINTL *pPtlHimetric, POINTF *pPtfContainer, DWORD dwFlags)
1483 {
1484     PluginHost *This = impl_from_IOleControlSite(iface);
1485     FIXME("(%p)->(%p %p %x)\n", This, pPtlHimetric, pPtfContainer, dwFlags);
1486     return E_NOTIMPL;
1487 }
1488
1489 static HRESULT WINAPI PHControlSite_TranslateAccelerator(IOleControlSite *iface, MSG *pMsg, DWORD grfModifiers)
1490 {
1491     PluginHost *This = impl_from_IOleControlSite(iface);
1492     FIXME("(%p)->(%x)\n", This, grfModifiers);
1493     return E_NOTIMPL;
1494 }
1495
1496 static HRESULT WINAPI PHControlSite_OnFocus(IOleControlSite *iface, BOOL fGotFocus)
1497 {
1498     PluginHost *This = impl_from_IOleControlSite(iface);
1499     FIXME("(%p)->(%x)\n", This, fGotFocus);
1500     return E_NOTIMPL;
1501 }
1502
1503 static HRESULT WINAPI PHControlSite_ShowPropertyFrame(IOleControlSite *iface)
1504 {
1505     PluginHost *This = impl_from_IOleControlSite(iface);
1506     FIXME("(%p)\n", This);
1507     return E_NOTIMPL;
1508 }
1509
1510 static const IOleControlSiteVtbl OleControlSiteVtbl = {
1511     PHControlSite_QueryInterface,
1512     PHControlSite_AddRef,
1513     PHControlSite_Release,
1514     PHControlSite_OnControlInfoChanged,
1515     PHControlSite_LockInPlaceActive,
1516     PHControlSite_GetExtendedControl,
1517     PHControlSite_TransformCoords,
1518     PHControlSite_TranslateAccelerator,
1519     PHControlSite_OnFocus,
1520     PHControlSite_ShowPropertyFrame
1521 };
1522
1523 static inline PluginHost *impl_from_IBindHost(IBindHost *iface)
1524 {
1525     return CONTAINING_RECORD(iface, PluginHost, IBindHost_iface);
1526 }
1527
1528 static HRESULT WINAPI PHBindHost_QueryInterface(IBindHost *iface, REFIID riid, void **ppv)
1529 {
1530     PluginHost *This = impl_from_IBindHost(iface);
1531     return IOleClientSite_QueryInterface(&This->IOleClientSite_iface, riid, ppv);
1532 }
1533
1534 static ULONG WINAPI PHBindHost_AddRef(IBindHost *iface)
1535 {
1536     PluginHost *This = impl_from_IBindHost(iface);
1537     return IOleClientSite_AddRef(&This->IOleClientSite_iface);
1538 }
1539
1540 static ULONG WINAPI PHBindHost_Release(IBindHost *iface)
1541 {
1542     PluginHost *This = impl_from_IBindHost(iface);
1543     return IOleClientSite_Release(&This->IOleClientSite_iface);
1544 }
1545
1546 static HRESULT WINAPI PHBindHost_CreateMoniker(IBindHost *iface, LPOLESTR szName, IBindCtx *pBC, IMoniker **ppmk, DWORD dwReserved)
1547 {
1548     PluginHost *This = impl_from_IBindHost(iface);
1549
1550     TRACE("(%p)->(%s %p %p %x)\n", This, debugstr_w(szName), pBC, ppmk, dwReserved);
1551
1552     if(!This->doc || !This->doc->window || !This->doc->window->mon) {
1553         FIXME("no moniker\n");
1554         return E_UNEXPECTED;
1555     }
1556
1557     return CreateURLMoniker(This->doc->window->mon, szName, ppmk);
1558 }
1559
1560 static HRESULT WINAPI PHBindHost_MonikerBindToStorage(IBindHost *iface, IMoniker *pMk, IBindCtx *pBC,
1561         IBindStatusCallback *pBSC, REFIID riid, void **ppvObj)
1562 {
1563     PluginHost *This = impl_from_IBindHost(iface);
1564     FIXME("(%p)->(%p %p %p %s %p)\n", This, pMk, pBC, pBSC, debugstr_guid(riid), ppvObj);
1565     return E_NOTIMPL;
1566 }
1567
1568 static HRESULT WINAPI PHBindHost_MonikerBindToObject(IBindHost *iface, IMoniker *pMk, IBindCtx *pBC,
1569         IBindStatusCallback *pBSC, REFIID riid, void **ppvObj)
1570 {
1571     PluginHost *This = impl_from_IBindHost(iface);
1572     FIXME("(%p)->(%p %p %p %s %p)\n", This, pMk, pBC, pBSC, debugstr_guid(riid), ppvObj);
1573     return E_NOTIMPL;
1574 }
1575
1576 static const IBindHostVtbl BindHostVtbl = {
1577     PHBindHost_QueryInterface,
1578     PHBindHost_AddRef,
1579     PHBindHost_Release,
1580     PHBindHost_CreateMoniker,
1581     PHBindHost_MonikerBindToStorage,
1582     PHBindHost_MonikerBindToObject
1583 };
1584
1585 static inline PluginHost *impl_from_IServiceProvider(IServiceProvider *iface)
1586 {
1587     return CONTAINING_RECORD(iface, PluginHost, IServiceProvider_iface);
1588 }
1589
1590 static HRESULT WINAPI PHServiceProvider_QueryInterface(IServiceProvider *iface, REFIID riid, void **ppv)
1591 {
1592     PluginHost *This = impl_from_IServiceProvider(iface);
1593     return IOleClientSite_QueryInterface(&This->IOleClientSite_iface, riid, ppv);
1594 }
1595
1596 static ULONG WINAPI PHServiceProvider_AddRef(IServiceProvider *iface)
1597 {
1598     PluginHost *This = impl_from_IServiceProvider(iface);
1599     return IOleClientSite_AddRef(&This->IOleClientSite_iface);
1600 }
1601
1602 static ULONG WINAPI PHServiceProvider_Release(IServiceProvider *iface)
1603 {
1604     PluginHost *This = impl_from_IServiceProvider(iface);
1605     return IOleClientSite_Release(&This->IOleClientSite_iface);
1606 }
1607
1608 static HRESULT WINAPI PHServiceProvider_QueryService(IServiceProvider *iface, REFGUID guidService, REFIID riid, void **ppv)
1609 {
1610     PluginHost *This = impl_from_IServiceProvider(iface);
1611
1612     if(IsEqualGUID(guidService, &SID_SBindHost)) {
1613         TRACE("SID_SBindHost service\n");
1614         return IOleClientSite_QueryInterface(&This->IOleClientSite_iface, riid, ppv);
1615     }
1616
1617     TRACE("(%p)->(%s %s %p)\n", This, debugstr_guid(guidService), debugstr_guid(riid), ppv);
1618
1619     if(!This->doc || !This->doc->basedoc.window) {
1620         *ppv = NULL;
1621         return E_NOINTERFACE;
1622     }
1623
1624     return IServiceProvider_QueryService(&This->doc->basedoc.window->base.IServiceProvider_iface,
1625             guidService, riid, ppv);
1626 }
1627
1628 static const IServiceProviderVtbl ServiceProviderVtbl = {
1629     PHServiceProvider_QueryInterface,
1630     PHServiceProvider_AddRef,
1631     PHServiceProvider_Release,
1632     PHServiceProvider_QueryService
1633 };
1634
1635 static BOOL parse_classid(const PRUnichar *classid, CLSID *clsid)
1636 {
1637     const WCHAR *ptr;
1638     unsigned len;
1639     HRESULT hres;
1640
1641     static const PRUnichar clsidW[] = {'c','l','s','i','d',':'};
1642
1643     if(strncmpiW(classid, clsidW, sizeof(clsidW)/sizeof(WCHAR)))
1644         return FALSE;
1645
1646     ptr = classid + sizeof(clsidW)/sizeof(WCHAR);
1647     len = strlenW(ptr);
1648
1649     if(len == 38) {
1650         hres = CLSIDFromString(ptr, clsid);
1651     }else if(len == 36) {
1652         WCHAR buf[39];
1653
1654         buf[0] = '{';
1655         memcpy(buf+1, ptr, len*sizeof(WCHAR));
1656         buf[37] = '}';
1657         buf[38] = 0;
1658         hres = CLSIDFromString(buf, clsid);
1659     }else {
1660         return FALSE;
1661     }
1662
1663     return SUCCEEDED(hres);
1664 }
1665
1666 static BOOL get_elem_clsid(nsIDOMHTMLElement *elem, CLSID *clsid)
1667 {
1668     const PRUnichar *val;
1669     nsAString val_str;
1670     nsresult nsres;
1671     BOOL ret = FALSE;
1672
1673     static const PRUnichar classidW[] = {'c','l','a','s','s','i','d',0};
1674
1675     nsres = get_elem_attr_value(elem, classidW, &val_str, &val);
1676     if(NS_SUCCEEDED(nsres)) {
1677         if(*val)
1678             ret = parse_classid(val, clsid);
1679         nsAString_Finish(&val_str);
1680     }
1681
1682     return ret;
1683 }
1684
1685 typedef struct {
1686     IBindStatusCallback IBindStatusCallback_iface;
1687     IWindowForBindingUI IWindowForBindingUI_iface;
1688     LONG ref;
1689 } InstallCallback;
1690
1691 static inline InstallCallback *impl_from_IBindStatusCallback(IBindStatusCallback *iface)
1692 {
1693     return CONTAINING_RECORD(iface, InstallCallback, IBindStatusCallback_iface);
1694 }
1695
1696 static HRESULT WINAPI InstallCallback_QueryInterface(IBindStatusCallback *iface,
1697         REFIID riid, void **ppv)
1698 {
1699     InstallCallback *This = impl_from_IBindStatusCallback(iface);
1700
1701     if(IsEqualGUID(&IID_IUnknown, riid)) {
1702         TRACE("(%p)->(IID_IUnknown %p)\n", This, ppv);
1703         *ppv = &This->IBindStatusCallback_iface;
1704     }else if(IsEqualGUID(&IID_IBindStatusCallback, riid)) {
1705         TRACE("(%p)->(IID_IBindStatusCallback %p)\n", This, ppv);
1706         *ppv = &This->IBindStatusCallback_iface;
1707     }else if(IsEqualGUID(&IID_IWindowForBindingUI, riid)) {
1708         TRACE("(%p)->(IID_IWindowForBindingUI %p)\n", This, ppv);
1709         *ppv = &This->IWindowForBindingUI_iface;
1710     }else {
1711         TRACE("(%p)->(%s %p)\n", This, debugstr_guid(riid), ppv);
1712         *ppv = NULL;
1713         return E_NOINTERFACE;
1714     }
1715
1716     IUnknown_AddRef((IUnknown*)*ppv);
1717     return S_OK;
1718 }
1719
1720 static ULONG WINAPI InstallCallback_AddRef(IBindStatusCallback *iface)
1721 {
1722     InstallCallback *This = impl_from_IBindStatusCallback(iface);
1723     LONG ref = InterlockedIncrement(&This->ref);
1724
1725     TRACE("(%p) ref=%d\n", This, ref);
1726
1727     return ref;
1728 }
1729
1730 static ULONG WINAPI InstallCallback_Release(IBindStatusCallback *iface)
1731 {
1732     InstallCallback *This = impl_from_IBindStatusCallback(iface);
1733     LONG ref = InterlockedIncrement(&This->ref);
1734
1735     TRACE("(%p) ref=%d\n", This, ref);
1736
1737     if(!ref)
1738         heap_free(This);
1739
1740     return ref;
1741 }
1742
1743 static HRESULT WINAPI InstallCallback_OnStartBinding(IBindStatusCallback *iface,
1744         DWORD dwReserved, IBinding *pib)
1745 {
1746     InstallCallback *This = impl_from_IBindStatusCallback(iface);
1747     TRACE("(%p)->(%x %p)\n", This, dwReserved, pib);
1748     return S_OK;
1749 }
1750
1751 static HRESULT WINAPI InstallCallback_GetPriority(IBindStatusCallback *iface, LONG *pnPriority)
1752 {
1753     InstallCallback *This = impl_from_IBindStatusCallback(iface);
1754     TRACE("(%p)->(%p)\n", This, pnPriority);
1755     return E_NOTIMPL;
1756 }
1757
1758 static HRESULT WINAPI InstallCallback_OnLowResource(IBindStatusCallback *iface, DWORD dwReserved)
1759 {
1760     InstallCallback *This = impl_from_IBindStatusCallback(iface);
1761     TRACE("(%p)->(%x)\n", This, dwReserved);
1762     return S_OK;
1763 }
1764
1765 static HRESULT WINAPI InstallCallback_OnProgress(IBindStatusCallback *iface, ULONG ulProgress,
1766         ULONG ulProgressMax, ULONG ulStatusCode, LPCWSTR szStatusText)
1767 {
1768     InstallCallback *This = impl_from_IBindStatusCallback(iface);
1769     TRACE("(%p)->(%u %u %u %s)\n", This, ulProgress, ulProgressMax, ulStatusCode, debugstr_w(szStatusText));
1770     return S_OK;
1771 }
1772
1773 static HRESULT WINAPI InstallCallback_OnStopBinding(IBindStatusCallback *iface,
1774         HRESULT hresult, LPCWSTR szError)
1775 {
1776     InstallCallback *This = impl_from_IBindStatusCallback(iface);
1777     TRACE("(%p)->(%08x %s)\n", This, hresult, debugstr_w(szError));
1778     return S_OK;
1779 }
1780
1781 static HRESULT WINAPI InstallCallback_GetBindInfo(IBindStatusCallback *iface,
1782         DWORD* grfBINDF, BINDINFO* pbindinfo)
1783 {
1784     InstallCallback *This = impl_from_IBindStatusCallback(iface);
1785
1786     TRACE("(%p)->(%p %p)\n", This, grfBINDF, pbindinfo);
1787
1788     *grfBINDF = BINDF_ASYNCHRONOUS;
1789     return S_OK;
1790 }
1791
1792 static HRESULT WINAPI InstallCallback_OnDataAvailable(IBindStatusCallback *iface, DWORD grfBSCF,
1793         DWORD dwSize, FORMATETC* pformatetc, STGMEDIUM* pstgmed)
1794 {
1795     InstallCallback *This = impl_from_IBindStatusCallback(iface);
1796     ERR("(%p)\n", This);
1797     return E_NOTIMPL;
1798 }
1799
1800 static HRESULT WINAPI InstallCallback_OnObjectAvailable(IBindStatusCallback *iface,
1801         REFIID riid, IUnknown* punk)
1802 {
1803     InstallCallback *This = impl_from_IBindStatusCallback(iface);
1804     ERR("(%p)\n", This);
1805     return E_NOTIMPL;
1806 }
1807
1808 static IBindStatusCallbackVtbl InstallCallbackVtbl = {
1809     InstallCallback_QueryInterface,
1810     InstallCallback_AddRef,
1811     InstallCallback_Release,
1812     InstallCallback_OnStartBinding,
1813     InstallCallback_GetPriority,
1814     InstallCallback_OnLowResource,
1815     InstallCallback_OnProgress,
1816     InstallCallback_OnStopBinding,
1817     InstallCallback_GetBindInfo,
1818     InstallCallback_OnDataAvailable,
1819     InstallCallback_OnObjectAvailable
1820 };
1821
1822 static inline InstallCallback *impl_from_IWindowForBindingUI(IWindowForBindingUI *iface)
1823 {
1824     return CONTAINING_RECORD(iface, InstallCallback, IWindowForBindingUI_iface);
1825 }
1826
1827 static HRESULT WINAPI WindowForBindingUI_QueryInterface(IWindowForBindingUI *iface, REFIID riid, void **ppv)
1828 {
1829     InstallCallback *This = impl_from_IWindowForBindingUI(iface);
1830     return IBindStatusCallback_QueryInterface(&This->IBindStatusCallback_iface, riid, ppv);
1831 }
1832
1833 static ULONG WINAPI WindowForBindingUI_AddRef(IWindowForBindingUI *iface)
1834 {
1835     InstallCallback *This = impl_from_IWindowForBindingUI(iface);
1836     return IBindStatusCallback_AddRef(&This->IBindStatusCallback_iface);
1837 }
1838
1839 static ULONG WINAPI WindowForBindingUI_Release(IWindowForBindingUI *iface)
1840 {
1841     InstallCallback *This = impl_from_IWindowForBindingUI(iface);
1842     return IBindStatusCallback_Release(&This->IBindStatusCallback_iface);
1843 }
1844
1845 static HRESULT WINAPI WindowForBindingUI_GetWindow(IWindowForBindingUI *iface, REFGUID rguidReason, HWND *phwnd)
1846 {
1847     InstallCallback *This = impl_from_IWindowForBindingUI(iface);
1848     FIXME("(%p)->(%s %p)\n", This, debugstr_guid(rguidReason), phwnd);
1849     *phwnd = NULL;
1850     return S_OK;
1851 }
1852
1853 static const IWindowForBindingUIVtbl WindowForBindingUIVtbl = {
1854     WindowForBindingUI_QueryInterface,
1855     WindowForBindingUI_AddRef,
1856     WindowForBindingUI_Release,
1857     WindowForBindingUI_GetWindow
1858 };
1859
1860 typedef struct {
1861     struct list entry;
1862     IUri *uri;
1863 } install_entry_t;
1864
1865 static struct list install_list = LIST_INIT(install_list);
1866
1867 static CRITICAL_SECTION cs_install_list;
1868 static CRITICAL_SECTION_DEBUG cs_install_list_dbg =
1869 {
1870     0, 0, &cs_install_list,
1871     { &cs_install_list_dbg.ProcessLocksList, &cs_install_list_dbg.ProcessLocksList },
1872       0, 0, { (DWORD_PTR)(__FILE__ ": install_list") }
1873 };
1874 static CRITICAL_SECTION cs_install_list = { &cs_install_list_dbg, -1, 0, 0, 0, 0 };
1875
1876 static void install_codebase(const WCHAR *url)
1877 {
1878     InstallCallback *callback;
1879     IBindCtx *bctx;
1880     HRESULT hres;
1881
1882     callback = heap_alloc(sizeof(*callback));
1883     if(!callback)
1884         return;
1885
1886     callback->IBindStatusCallback_iface.lpVtbl = &InstallCallbackVtbl;
1887     callback->IWindowForBindingUI_iface.lpVtbl = &WindowForBindingUIVtbl;
1888     callback->ref = 1;
1889
1890     hres = CreateAsyncBindCtx(0, &callback->IBindStatusCallback_iface, NULL, &bctx);
1891     IBindStatusCallback_Release(&callback->IBindStatusCallback_iface);
1892     if(FAILED(hres))
1893         return;
1894
1895     hres = AsyncInstallDistributionUnit(NULL, NULL, NULL, 0, 0, url, bctx, NULL, 0);
1896     IBindCtx_Release(bctx);
1897     if(FAILED(hres))
1898         WARN("FAILED: %08x\n", hres);
1899 }
1900
1901 static void check_codebase(HTMLInnerWindow *window, nsIDOMHTMLElement *nselem)
1902 {
1903     BOOL is_on_list = FALSE;
1904     install_entry_t *iter;
1905     const PRUnichar *val;
1906     nsAString val_str;
1907     IUri *uri = NULL;
1908     nsresult nsres;
1909     HRESULT hres;
1910
1911     static const PRUnichar codebaseW[] = {'c','o','d','e','b','a','s','e',0};
1912
1913     nsres = get_elem_attr_value(nselem, codebaseW, &val_str, &val);
1914     if(NS_SUCCEEDED(nsres)) {
1915         if(*val) {
1916             hres = CoInternetCombineUrlEx(window->base.outer_window->uri, val, 0, &uri, 0);
1917             if(FAILED(hres))
1918                 uri = NULL;
1919         }
1920         nsAString_Finish(&val_str);
1921     }
1922
1923     if(!uri)
1924         return;
1925
1926     EnterCriticalSection(&cs_install_list);
1927
1928     LIST_FOR_EACH_ENTRY(iter, &install_list, install_entry_t, entry) {
1929         BOOL eq;
1930
1931         hres = IUri_IsEqual(uri, iter->uri, &eq);
1932         if(SUCCEEDED(hres) && eq) {
1933             TRACE("already proceeded\n");
1934             is_on_list = TRUE;
1935             break;
1936         }
1937     }
1938
1939     if(!is_on_list) {
1940         iter = heap_alloc(sizeof(*iter));
1941         if(iter) {
1942             IUri_AddRef(uri);
1943             iter->uri = uri;
1944
1945             list_add_tail(&install_list, &iter->entry);
1946         }
1947     }
1948
1949     LeaveCriticalSection(&cs_install_list);
1950
1951     if(!is_on_list) {
1952         BSTR display_uri;
1953
1954         hres = IUri_GetDisplayUri(uri, &display_uri);
1955         if(SUCCEEDED(hres)) {
1956             install_codebase(display_uri);
1957             SysFreeString(display_uri);
1958         }
1959     }
1960
1961     IUri_Release(uri);
1962 }
1963
1964 static IUnknown *create_activex_object(HTMLDocumentNode *doc, nsIDOMHTMLElement *nselem, CLSID *clsid)
1965 {
1966     IClassFactoryEx *cfex;
1967     IClassFactory *cf;
1968     IUnknown *obj;
1969     DWORD policy;
1970     HRESULT hres;
1971
1972     if(!get_elem_clsid(nselem, clsid)) {
1973         WARN("Could not determine element CLSID\n");
1974         return NULL;
1975     }
1976
1977     TRACE("clsid %s\n", debugstr_guid(clsid));
1978
1979     policy = 0;
1980     hres = IInternetHostSecurityManager_ProcessUrlAction(&doc->IInternetHostSecurityManager_iface,
1981             URLACTION_ACTIVEX_RUN, (BYTE*)&policy, sizeof(policy), (BYTE*)clsid, sizeof(GUID), 0, 0);
1982     if(FAILED(hres) || policy != URLPOLICY_ALLOW) {
1983         WARN("ProcessUrlAction returned %08x %x\n", hres, policy);
1984         return NULL;
1985     }
1986
1987     hres = CoGetClassObject(clsid, CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER, NULL, &IID_IClassFactory, (void**)&cf);
1988     if(hres == REGDB_E_CLASSNOTREG)
1989         check_codebase(doc->window, nselem);
1990     if(FAILED(hres))
1991         return NULL;
1992
1993     hres = IClassFactory_QueryInterface(cf, &IID_IClassFactoryEx, (void**)&cfex);
1994     if(SUCCEEDED(hres)) {
1995         FIXME("Use IClassFactoryEx\n");
1996         IClassFactoryEx_Release(cfex);
1997     }
1998
1999     hres = IClassFactory_CreateInstance(cf, NULL, &IID_IUnknown, (void**)&obj);
2000     IClassFactory_Release(cf);
2001     if(FAILED(hres))
2002         return NULL;
2003
2004     return obj;
2005 }
2006
2007 void detach_plugin_host(PluginHost *host)
2008 {
2009     HRESULT hres;
2010
2011     TRACE("%p\n", host);
2012
2013     if(!host->doc)
2014         return;
2015
2016     if(host->ip_object) {
2017         if(host->ui_active)
2018             IOleInPlaceObject_UIDeactivate(host->ip_object);
2019         IOleInPlaceObject_InPlaceDeactivate(host->ip_object);
2020     }
2021
2022     if(host->plugin_unk) {
2023         IOleObject *ole_obj;
2024
2025         hres = IUnknown_QueryInterface(host->plugin_unk, &IID_IOleObject, (void**)&ole_obj);
2026         if(SUCCEEDED(hres)) {
2027             if(!host->ip_object)
2028                 IOleObject_Close(ole_obj, OLECLOSE_NOSAVE);
2029             IOleObject_SetClientSite(ole_obj, NULL);
2030             IOleObject_Release(ole_obj);
2031         }
2032     }
2033
2034     if(host->sink) {
2035         IConnectionPointContainer *cp_container;
2036         IConnectionPoint *cp;
2037
2038         assert(host->plugin_unk != NULL);
2039
2040         hres = IUnknown_QueryInterface(host->plugin_unk, &IID_IConnectionPointContainer, (void**)&cp_container);
2041         if(SUCCEEDED(hres)) {
2042             hres = IConnectionPointContainer_FindConnectionPoint(cp_container, &host->sink->iid, &cp);
2043             IConnectionPointContainer_Release(cp_container);
2044             if(SUCCEEDED(hres)) {
2045                 IConnectionPoint_Unadvise(cp, host->sink->cookie);
2046                 IConnectionPoint_Release(cp);
2047             }
2048         }
2049
2050         host->sink->host = NULL;
2051         IDispatch_Release(&host->sink->IDispatch_iface);
2052         host->sink = NULL;
2053     }
2054
2055     release_plugin_ifaces(host);
2056
2057     if(host->element) {
2058         host->element->plugin_host = NULL;
2059         host->element = NULL;
2060     }
2061
2062     list_remove(&host->entry);
2063     list_init(&host->entry);
2064     host->doc = NULL;
2065 }
2066
2067 HRESULT create_plugin_host(HTMLDocumentNode *doc, HTMLPluginContainer *container)
2068 {
2069     PluginHost *host;
2070     IUnknown *unk;
2071     CLSID clsid;
2072
2073     assert(!container->plugin_host);
2074
2075     unk = create_activex_object(doc, container->element.nselem, &clsid);
2076     if(!unk)
2077         return E_FAIL;
2078
2079     host = heap_alloc_zero(sizeof(*host));
2080     if(!host) {
2081         IUnknown_Release(unk);
2082         return E_OUTOFMEMORY;
2083     }
2084
2085     host->IOleClientSite_iface.lpVtbl      = &OleClientSiteVtbl;
2086     host->IAdviseSinkEx_iface.lpVtbl       = &AdviseSinkExVtbl;
2087     host->IPropertyNotifySink_iface.lpVtbl = &PropertyNotifySinkVtbl;
2088     host->IDispatch_iface.lpVtbl           = &DispatchVtbl;
2089     host->IOleInPlaceSiteEx_iface.lpVtbl   = &OleInPlaceSiteExVtbl;
2090     host->IOleControlSite_iface.lpVtbl     = &OleControlSiteVtbl;
2091     host->IBindHost_iface.lpVtbl           = &BindHostVtbl;
2092     host->IServiceProvider_iface.lpVtbl    = &ServiceProviderVtbl;
2093
2094     host->ref = 1;
2095
2096     host->plugin_unk = unk;
2097     host->clsid = clsid;
2098
2099     host->doc = doc;
2100     list_add_tail(&doc->plugin_hosts, &host->entry);
2101
2102     container->plugin_host = host;
2103     host->element = container;
2104
2105     initialize_plugin_object(host);
2106
2107     return S_OK;
2108 }