dlls/mshtml/pluginhost.c

   1 /*
   2  * Copyright 2010 Jacek Caban for CodeWeavers
   3  *
   4  * This library is free software; you can redistribute it and/or
   5  * modify it under the terms of the GNU Lesser General Public
   6  * License as published by the Free Software Foundation; either
   7  * version 2.1 of the License, or (at your option) any later version.
   8  *
   9  * This library is distributed in the hope that it will be useful,
  10  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  11  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  12  * Lesser General Public License for more details.
  13  *
  14  * You should have received a copy of the GNU Lesser General Public
  15  * License along with this library; if not, write to the Free Software
  16  * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
  17  */
  18
  19 #include "config.h"
  20
  21 #include <stdarg.h>
  22 #include <assert.h>
  23
  24 #define COBJMACROS
  25
  26 #include "windef.h"
  27 #include "winbase.h"
  28 #include "winuser.h"
  29 #include "ole2.h"
  30 #include "shlobj.h"
  31 #include "mshtmdid.h"
  32
  33 #include "mshtml_private.h"
  34 #include "pluginhost.h"
  35
  36 #include "wine/debug.h"
  37
  38 WINE_DEFAULT_DEBUG_CHANNEL(mshtml);
  39
  40 static BOOL check_load_safety(PluginHost *host)
  41 {
  42     DWORD policy_size, policy;
  43     struct CONFIRMSAFETY cs;
  44     BYTE *ppolicy;
  45     HRESULT hres;
  46
  47     cs.clsid = host->clsid;
  48     cs.pUnk = host->plugin_unk;
  49     cs.dwFlags = CONFIRMSAFETYACTION_LOADOBJECT;
  50
  51     hres = IInternetHostSecurityManager_QueryCustomPolicy(&host->doc->IInternetHostSecurityManager_iface,
  52             &GUID_CUSTOM_CONFIRMOBJECTSAFETY, &ppolicy, &policy_size, (BYTE*)&cs, sizeof(cs), 0);
  53     if(FAILED(hres))
  54         return FALSE;
  55
  56     policy = *(DWORD*)ppolicy;
  57     CoTaskMemFree(ppolicy);
  58     return policy == URLPOLICY_ALLOW;
  59 }
  60
  61 static BOOL check_script_safety(PluginHost *host)
  62 {
  63     DISPPARAMS params = {NULL,NULL,0,0};
  64     DWORD policy_size, policy;
  65     struct CONFIRMSAFETY cs;
  66     BYTE *ppolicy;
  67     ULONG err = 0;
  68     VARIANT v;
  69     HRESULT hres;
  70
  71     cs.clsid = host->clsid;
  72     cs.pUnk = host->plugin_unk;
  73     cs.dwFlags = 0;
  74
  75     hres = IInternetHostSecurityManager_QueryCustomPolicy(&host->doc->IInternetHostSecurityManager_iface,
  76             &GUID_CUSTOM_CONFIRMOBJECTSAFETY, &ppolicy, &policy_size, (BYTE*)&cs, sizeof(cs), 0);
  77     if(FAILED(hres))
  78         return FALSE;
  79
  80     policy = *(DWORD*)ppolicy;
  81     CoTaskMemFree(ppolicy);
  82
  83     if(policy != URLPOLICY_ALLOW)
  84         return FALSE;
  85
  86     V_VT(&v) = VT_EMPTY;
  87     hres = IDispatch_Invoke(host->disp, DISPID_SECURITYCTX, &IID_NULL, 0, DISPATCH_PROPERTYGET, &params, &v, NULL, &err);
  88     if(SUCCEEDED(hres)) {
  89         FIXME("Handle security ctx %s\n", debugstr_variant(&v));
  90         return FALSE;
  91     }
  92
  93     return TRUE;
  94 }
  95
  96 static void update_readystate(PluginHost *host)
  97 {
  98     DISPPARAMS params = {NULL,NULL,0,0};
  99     IDispatchEx *dispex;
 100     IDispatch *disp;
 101     ULONG err = 0;
 102     VARIANT v;
 103     HRESULT hres;
 104
 105     hres = IUnknown_QueryInterface(host->plugin_unk, &IID_IDispatchEx, (void**)&dispex);
 106     if(SUCCEEDED(hres)) {
 107         FIXME("Use IDispatchEx\n");
 108         IDispatchEx_Release(dispex);
 109     }
 110
 111     hres = IUnknown_QueryInterface(host->plugin_unk, &IID_IDispatch, (void**)&disp);
 112     if(FAILED(hres))
 113         return;
 114
 115     hres = IDispatch_Invoke(disp, DISPID_READYSTATE, &IID_NULL, 0, DISPATCH_PROPERTYGET, &params, &v, NULL, &err);
 116     IDispatch_Release(disp);
 117     if(SUCCEEDED(hres)) {
 118         /* FIXME: make plugin readystate affect document readystate */
 119         TRACE("readystate = %s\n", debugstr_variant(&v));
 120         VariantClear(&v);
 121     }
 122 }
 123
 124 /* FIXME: We shouldn't need this function and we should embed plugin directly in the main document */
 125 static void get_pos_rect(PluginHost *host, RECT *ret)
 126 {
 127     SetRect(ret, 0, 0, host->rect.right - host->rect.left, host->rect.bottom - host->rect.top);
 128 }
 129
 130 static void load_prop_bag(PluginHost *host, IPersistPropertyBag *persist_prop_bag)
 131 {
 132     IPropertyBag *prop_bag;
 133     HRESULT hres;
 134
 135     hres = create_param_prop_bag(host->element->element.nselem, &prop_bag);
 136     if(FAILED(hres))
 137         return;
 138
 139     if(prop_bag && !check_load_safety(host)) {
 140         IPropertyBag_Release(prop_bag);
 141         prop_bag = NULL;
 142     }
 143
 144     if(prop_bag) {
 145         hres = IPersistPropertyBag_Load(persist_prop_bag, prop_bag, NULL);
 146         IPropertyBag_Release(prop_bag);
 147         if(FAILED(hres))
 148             WARN("Load failed: %08x\n", hres);
 149     }else {
 150         hres = IPersistPropertyBag_InitNew(persist_prop_bag);
 151         if(FAILED(hres))
 152             WARN("InitNew failed: %08x\n", hres);
 153     }
 154 }
 155
 156 static void load_plugin(PluginHost *host)
 157 {
 158     IPersistPropertyBag2 *persist_prop_bag2;
 159     IPersistPropertyBag *persist_prop_bag;
 160     HRESULT hres;
 161
 162     hres = IUnknown_QueryInterface(host->plugin_unk, &IID_IPersistPropertyBag2, (void**)&persist_prop_bag2);
 163     if(SUCCEEDED(hres)) {
 164         FIXME("Use IPersistPropertyBag2 iface\n");
 165         IPersistPropertyBag2_Release(persist_prop_bag2);
 166         return;
 167     }
 168
 169     hres = IUnknown_QueryInterface(host->plugin_unk, &IID_IPersistPropertyBag, (void**)&persist_prop_bag);
 170     if(SUCCEEDED(hres)) {
 171         load_prop_bag(host, persist_prop_bag);
 172         IPersistPropertyBag_Release(persist_prop_bag);
 173         return;
 174     }
 175
 176     FIXME("No IPersistPropertyBag iface\n");
 177 }
 178
 179 static void initialize_plugin_object(PluginHost *host)
 180 {
 181     IClientSecurity *client_security;
 182     IQuickActivate *quick_activate;
 183     IOleObject *ole_obj = NULL;
 184     IOleCommandTarget *cmdtrg;
 185     IViewObjectEx *view_obj;
 186     IDispatchEx *dispex;
 187     IDispatch *disp;
 188     HRESULT hres;
 189
 190     /* Note native calls QI on plugin for an undocumented IID and CLSID_HTMLDocument */
 191
 192     /* FIXME: call FreezeEvents(TRUE) */
 193
 194     hres = IUnknown_QueryInterface(host->plugin_unk, &IID_IClientSecurity, (void**)&client_security);
 195     if(SUCCEEDED(hres)) {
 196         FIXME("Handle IClientSecurity\n");
 197         IClientSecurity_Release(client_security);
 198         return;
 199     }
 200
 201     hres = IUnknown_QueryInterface(host->plugin_unk, &IID_IQuickActivate, (void**)&quick_activate);
 202     if(SUCCEEDED(hres)) {
 203         QACONTAINER container = {sizeof(container)};
 204         QACONTROL control = {sizeof(control)};
 205
 206         TRACE("Using IQuickActivate\n");
 207
 208         container.pClientSite = &host->IOleClientSite_iface;
 209         container.dwAmbientFlags = QACONTAINER_SUPPORTSMNEMONICS|QACONTAINER_MESSAGEREFLECT|QACONTAINER_USERMODE;
 210         container.pAdviseSink = &host->IAdviseSinkEx_iface;
 211         container.pPropertyNotifySink = &host->IPropertyNotifySink_iface;
 212
 213         hres = IQuickActivate_QuickActivate(quick_activate, &container, &control);
 214         IQuickActivate_Release(quick_activate);
 215         if(FAILED(hres))
 216             FIXME("QuickActivate failed: %08x\n", hres);
 217     }else {
 218         DWORD status = 0;
 219
 220         hres = IUnknown_QueryInterface(host->plugin_unk, &IID_IOleObject, (void**)&ole_obj);
 221         if(SUCCEEDED(hres)) {
 222             hres = IOleObject_GetMiscStatus(ole_obj, DVASPECT_CONTENT, &status);
 223             TRACE("GetMiscStatus returned %08x %x\n", hres, status);
 224
 225             hres = IOleObject_SetClientSite(ole_obj, &host->IOleClientSite_iface);
 226             IOleObject_Release(ole_obj);
 227             if(FAILED(hres)) {
 228                 FIXME("SetClientSite failed: %08x\n", hres);
 229                 return;
 230             }
 231         }else {
 232             TRACE("Plugin does not support IOleObject\n");
 233         }
 234     }
 235
 236     load_plugin(host);
 237
 238     if(ole_obj) {
 239         hres = IUnknown_QueryInterface(host->plugin_unk, &IID_IViewObjectEx, (void**)&view_obj);
 240         if(SUCCEEDED(hres)) {
 241             DWORD view_status = 0;
 242
 243             hres = IViewObjectEx_SetAdvise(view_obj, DVASPECT_CONTENT, 0, (IAdviseSink*)&host->IAdviseSinkEx_iface);
 244             if(FAILED(hres))
 245                 WARN("SetAdvise failed: %08x\n", hres);
 246
 247             hres = IViewObjectEx_GetViewStatus(view_obj, &view_status);
 248             IViewObjectEx_Release(view_obj);
 249             TRACE("GetViewStatus returned %08x %x\n", hres, view_status);
 250         }
 251     }
 252
 253     update_readystate(host);
 254
 255     /* NOTE: Native QIs for IActiveScript, an undocumented IID, IOleControl and IRunnableObject */
 256
 257     hres = IUnknown_QueryInterface(host->plugin_unk, &IID_IDispatchEx, (void**)&dispex);
 258     if(SUCCEEDED(hres)) {
 259         FIXME("Use IDispatchEx\n");
 260         host->disp = (IDispatch*)dispex;
 261     }else {
 262         hres = IUnknown_QueryInterface(host->plugin_unk, &IID_IDispatch, (void**)&disp);
 263         if(SUCCEEDED(hres))
 264             host->disp = disp;
 265         else
 266             TRACE("no IDispatch iface\n");
 267     }
 268
 269     hres = IUnknown_QueryInterface(host->plugin_unk, &IID_IOleCommandTarget, (void**)&cmdtrg);
 270     if(SUCCEEDED(hres)) {
 271         FIXME("Use IOleCommandTarget\n");
 272         IOleCommandTarget_Release(cmdtrg);
 273     }
 274 }
 275
 276 static void embed_plugin_object(PluginHost *host)
 277 {
 278     IOleObject *ole_obj;
 279     RECT rect;
 280     HRESULT hres;
 281
 282     hres = IUnknown_QueryInterface(host->plugin_unk, &IID_IOleObject, (void**)&ole_obj);
 283     if(FAILED(hres)) {
 284         FIXME("Plugin does not support IOleObject\n");
 285         return;
 286     }
 287
 288     get_pos_rect(host, &rect);
 289     hres = IOleObject_DoVerb(ole_obj, OLEIVERB_INPLACEACTIVATE, NULL, &host->IOleClientSite_iface, 0, host->hwnd, &rect);
 290     IOleObject_Release(ole_obj);
 291     if(FAILED(hres))
 292         WARN("DoVerb failed: %08x\n", hres);
 293
 294     if(host->ip_object) {
 295         HWND hwnd;
 296
 297         hres = IOleInPlaceObject_GetWindow(host->ip_object, &hwnd);
 298         if(SUCCEEDED(hres))
 299             TRACE("hwnd %p\n", hwnd);
 300     }
 301 }
 302
 303 void update_plugin_window(PluginHost *host, HWND hwnd, const RECT *rect)
 304 {
 305     BOOL rect_changed = FALSE;
 306
 307     if(!hwnd || (host->hwnd && host->hwnd != hwnd)) {
 308         FIXME("unhandled hwnd\n");
 309         return;
 310     }
 311
 312     TRACE("%p %s\n", hwnd, wine_dbgstr_rect(rect));
 313
 314     if(memcmp(rect, &host->rect, sizeof(RECT))) {
 315         host->rect = *rect;
 316         rect_changed = TRUE;
 317     }
 318
 319     if(!host->hwnd) {
 320         host->hwnd = hwnd;
 321         embed_plugin_object(host);
 322     }
 323
 324     if(rect_changed && host->ip_object)
 325         IOleInPlaceObject_SetObjectRects(host->ip_object, &host->rect, &host->rect);
 326 }
 327
 328 static void notif_enabled(PluginHost *plugin_host)
 329 {
 330     DISPPARAMS args = {NULL, NULL, 0, 0};
 331     IDispatch *disp;
 332     ULONG err = 0;
 333     VARIANT res;
 334     HRESULT hres;
 335
 336     hres = IUnknown_QueryInterface(plugin_host->plugin_unk, &IID_IDispatch, (void**)&disp);
 337     if(FAILED(hres)) {
 338         FIXME("Could not get IDispatch iface: %08x\n", hres);
 339         return;
 340     }
 341
 342     V_VT(&res) = VT_EMPTY;
 343     hres = IDispatch_Invoke(disp, DISPID_ENABLED, &IID_NULL, 0/*FIXME*/, DISPATCH_PROPERTYGET, &args, &res, NULL, &err);
 344     IDispatch_Release(disp);
 345     if(SUCCEEDED(hres)) {
 346         FIXME("Got enabled %s\n", debugstr_variant(&res));
 347         VariantClear(&res);
 348     }
 349 }
 350
 351 void notif_container_change(HTMLPluginContainer *plugin_container, DISPID dispid)
 352 {
 353     IOleControl *ole_control;
 354     HRESULT hres;
 355
 356     if(!plugin_container->plugin_host || !plugin_container->plugin_host->plugin_unk)
 357         return;
 358
 359     notif_enabled(plugin_container->plugin_host);
 360
 361     hres = IUnknown_QueryInterface(plugin_container->plugin_host->plugin_unk, &IID_IOleControl, (void**)&ole_control);
 362     if(SUCCEEDED(hres)) {
 363         IOleControl_OnAmbientPropertyChange(ole_control, dispid);
 364         IOleControl_Release(ole_control);
 365     }
 366 }
 367
 368 HRESULT get_plugin_disp(HTMLPluginContainer *plugin_container, IDispatch **ret)
 369 {
 370     PluginHost *host;
 371
 372     host = plugin_container->plugin_host;
 373     if(!host) {
 374         ERR("No plugin host\n");
 375         return E_UNEXPECTED;
 376     }
 377
 378     if(!host->disp) {
 379         *ret = NULL;
 380         return S_OK;
 381     }
 382
 383     if(!check_script_safety(host)) {
 384         FIXME("Insecure object\n");
 385         return E_FAIL;
 386     }
 387
 388     IDispatch_AddRef(host->disp);
 389     *ret = host->disp;
 390     return S_OK;
 391 }
 392
 393 HRESULT get_plugin_dispid(HTMLPluginContainer *plugin_container, WCHAR *name, DISPID *ret)
 394 {
 395     IDispatch *disp;
 396     DISPID id;
 397     DWORD i;
 398     HRESULT hres;
 399
 400     if(!plugin_container->plugin_host) {
 401         WARN("no plugin host\n");
 402         return DISP_E_UNKNOWNNAME;
 403     }
 404
 405     disp = plugin_container->plugin_host->disp;
 406     if(!disp)
 407         return DISP_E_UNKNOWNNAME;
 408
 409     hres = IDispatch_GetIDsOfNames(disp, &IID_NULL, &name, 1, 0, &id);
 410     if(FAILED(hres)) {
 411         TRACE("no prop %s\n", debugstr_w(name));
 412         return DISP_E_UNKNOWNNAME;
 413     }
 414
 415     for(i=0; i < plugin_container->props_len; i++) {
 416         if(id == plugin_container->props[i]) {
 417             *ret = MSHTML_DISPID_CUSTOM_MIN+i;
 418             return S_OK;
 419         }
 420     }
 421
 422     if(!plugin_container->props) {
 423         plugin_container->props = heap_alloc(8*sizeof(DISPID));
 424         if(!plugin_container->props)
 425             return E_OUTOFMEMORY;
 426         plugin_container->props_size = 8;
 427     }else if(plugin_container->props_len == plugin_container->props_size) {
 428         DISPID *new_props;
 429
 430         new_props = heap_realloc(plugin_container->props, plugin_container->props_size*2*sizeof(DISPID));
 431         if(!new_props)
 432             return E_OUTOFMEMORY;
 433
 434         plugin_container->props = new_props;
 435         plugin_container->props_size *= 2;
 436     }
 437
 438     plugin_container->props[plugin_container->props_len] = id;
 439     *ret = MSHTML_DISPID_CUSTOM_MIN+plugin_container->props_len;
 440     plugin_container->props_len++;
 441     return S_OK;
 442 }
 443
 444 HRESULT invoke_plugin_prop(HTMLPluginContainer *plugin_container, DISPID id, LCID lcid, WORD flags, DISPPARAMS *params,
 445         VARIANT *res, EXCEPINFO *ei)
 446 {
 447     PluginHost *host;
 448
 449     host = plugin_container->plugin_host;
 450     if(!host || !host->disp) {
 451         FIXME("Called with no disp\n");
 452         return E_UNEXPECTED;
 453     }
 454
 455     if(!check_script_safety(host)) {
 456         FIXME("Insecure object\n");
 457         return E_FAIL;
 458     }
 459
 460     if(id < MSHTML_DISPID_CUSTOM_MIN || id > MSHTML_DISPID_CUSTOM_MIN + plugin_container->props_len) {
 461         ERR("Invalid id\n");
 462         return E_FAIL;
 463     }
 464
 465     return IDispatch_Invoke(host->disp, plugin_container->props[id-MSHTML_DISPID_CUSTOM_MIN], &IID_NULL,
 466             lcid, flags, params, res, ei, NULL);
 467 }
 468
 469 typedef struct {
 470     DISPID id;
 471     IDispatch *disp;
 472 } sink_entry_t;
 473
 474 struct PHEventSink {
 475     IDispatch IDispatch_iface;
 476
 477     LONG ref;
 478
 479     PluginHost *host;
 480     ITypeInfo *typeinfo;
 481     GUID iid;
 482     DWORD cookie;
 483     BOOL is_dispiface;
 484
 485     sink_entry_t *handlers;
 486     DWORD handlers_cnt;
 487     DWORD handlers_size;
 488 };
 489
 490 static sink_entry_t *find_sink_entry(PHEventSink *sink, DISPID id)
 491 {
 492     sink_entry_t *iter;
 493
 494     for(iter = sink->handlers; iter < sink->handlers+sink->handlers_cnt; iter++) {
 495         if(iter->id == id)
 496             return iter;
 497     }
 498
 499     return NULL;
 500 }
 501
 502 static void add_sink_handler(PHEventSink *sink, DISPID id, IDispatch *disp)
 503 {
 504     sink_entry_t *entry = find_sink_entry(sink, id);
 505
 506     if(entry) {
 507         if(entry->disp)
 508             IDispatch_Release(entry->disp);
 509     }else {
 510         if(!sink->handlers_size) {
 511             sink->handlers = heap_alloc(4*sizeof(*sink->handlers));
 512             if(!sink->handlers)
 513                 return;
 514             sink->handlers_size = 4;
 515         }else if(sink->handlers_cnt == sink->handlers_size) {
 516             sink_entry_t *new_handlers;
 517
 518             new_handlers = heap_realloc(sink->handlers, 2*sink->handlers_size*sizeof(*sink->handlers));
 519             if(!new_handlers)
 520                 return;
 521             sink->handlers = new_handlers;
 522             sink->handlers_size *= 2;
 523         }
 524         entry = sink->handlers + sink->handlers_cnt++;
 525         entry->id = id;
 526     }
 527
 528     IDispatch_AddRef(disp);
 529     entry->disp = disp;
 530 }
 531
 532 static inline PHEventSink *PHEventSink_from_IDispatch(IDispatch *iface)
 533 {
 534     return CONTAINING_RECORD(iface, PHEventSink, IDispatch_iface);
 535 }
 536
 537 static HRESULT WINAPI PHEventSink_QueryInterface(IDispatch *iface, REFIID riid, void **ppv)
 538 {
 539     PHEventSink *This = PHEventSink_from_IDispatch(iface);
 540
 541     if(IsEqualGUID(riid, &IID_IUnknown)) {
 542         TRACE("(%p)->(IID_IUnknown %p)\n", This, ppv);
 543         *ppv = &This->IDispatch_iface;
 544     }else if(IsEqualGUID(riid, &IID_IDispatch)) {
 545         TRACE("(%p)->(IID_IDispatch %p)\n", This, ppv);
 546         *ppv = &This->IDispatch_iface;
 547     }else if(This->is_dispiface && IsEqualGUID(riid, &This->iid)) {
 548         TRACE("(%p)->(%s %p)\n", This, debugstr_guid(riid), ppv);
 549         *ppv = &This->IDispatch_iface;
 550     }else {
 551         WARN("(%p)->(%s %p)\n", This, debugstr_guid(riid), ppv);
 552         *ppv = NULL;
 553         return E_NOINTERFACE;
 554     }
 555
 556     IUnknown_AddRef((IUnknown*)*ppv);
 557     return S_OK;
 558 }
 559
 560 static ULONG WINAPI PHEventSink_AddRef(IDispatch *iface)
 561 {
 562     PHEventSink *This = PHEventSink_from_IDispatch(iface);
 563     LONG ref = InterlockedIncrement(&This->ref);
 564
 565     TRACE("(%p)\n", This);
 566
 567     return ref;
 568 }
 569
 570 static ULONG WINAPI PHEventSink_Release(IDispatch *iface)
 571 {
 572     PHEventSink *This = PHEventSink_from_IDispatch(iface);
 573     LONG ref = InterlockedDecrement(&This->ref);
 574
 575     TRACE("(%p)\n", This);
 576
 577     if(!ref) {
 578         unsigned i;
 579
 580         assert(!This->host);
 581
 582         for(i=0; i < This->handlers_cnt; i++) {
 583             if(This->handlers[i].disp)
 584                 IDispatch_Release(This->handlers[i].disp);
 585         }
 586         heap_free(This->handlers);
 587         heap_free(This);
 588     }
 589
 590     return ref;
 591 }
 592
 593 static HRESULT WINAPI PHEventSink_GetTypeInfoCount(IDispatch *iface, UINT *pctinfo)
 594 {
 595     PHEventSink *This = PHEventSink_from_IDispatch(iface);
 596     FIXME("(%p)->(%p)\n", This, pctinfo);
 597     return E_NOTIMPL;
 598 }
 599
 600 static HRESULT WINAPI PHEventSink_GetTypeInfo(IDispatch *iface, UINT iTInfo,
 601         LCID lcid, ITypeInfo **ppTInfo)
 602 {
 603     PHEventSink *This = PHEventSink_from_IDispatch(iface);
 604     FIXME("(%p)->(%d %d %p)\n", This, iTInfo, lcid, ppTInfo);
 605     return E_NOTIMPL;
 606 }
 607
 608 static HRESULT WINAPI PHEventSink_GetIDsOfNames(IDispatch *iface, REFIID riid, LPOLESTR *rgszNames,
 609         UINT cNames, LCID lcid, DISPID *rgDispId)
 610 {
 611     PHEventSink *This = PHEventSink_from_IDispatch(iface);
 612     FIXME("(%p)->(%s %p %u %d %p)\n", This, debugstr_guid(riid), rgszNames, cNames, lcid, rgDispId);
 613     return E_NOTIMPL;
 614 }
 615
 616 static HRESULT WINAPI PHEventSink_Invoke(IDispatch *iface, DISPID dispIdMember, REFIID riid, LCID lcid,
 617         WORD wFlags, DISPPARAMS *pDispParams, VARIANT *pVarResult, EXCEPINFO *pExcepInfo, UINT *puArgErr)
 618 {
 619     PHEventSink *This = PHEventSink_from_IDispatch(iface);
 620     IDispatchEx *dispex;
 621     sink_entry_t *entry;
 622     HRESULT hres;
 623
 624     TRACE("(%p)->(%d %s %d %x %p %p %p %p)\n", This, dispIdMember, debugstr_guid(riid), lcid, wFlags,
 625           pDispParams, pVarResult, pExcepInfo, puArgErr);
 626
 627     if(!This->host) {
 628         WARN("No host\n");
 629         return E_UNEXPECTED;
 630     }
 631
 632     entry = find_sink_entry(This, dispIdMember);
 633     if(!entry || !entry->disp) {
 634         WARN("No handler %d\n", dispIdMember);
 635         if(pVarResult)
 636             V_VT(pVarResult) = VT_EMPTY;
 637         return S_OK;
 638     }
 639
 640     hres = IDispatch_QueryInterface(entry->disp, &IID_IDispatchEx, (void**)&dispex);
 641
 642     TRACE("(%p) %d >>>\n", This, entry->id);
 643     if(SUCCEEDED(hres)) {
 644         hres = IDispatchEx_InvokeEx(dispex, DISPID_VALUE, lcid, wFlags, pDispParams, pVarResult, pExcepInfo, NULL);
 645         IDispatchEx_Release(dispex);
 646     }else {
 647         hres = IDispatch_Invoke(entry->disp, DISPID_VALUE, riid, lcid, wFlags, pDispParams, pVarResult, pExcepInfo, puArgErr);
 648     }
 649     if(SUCCEEDED(hres))
 650         TRACE("(%p) %d <<<\n", This, entry->id);
 651     else
 652         WARN("(%p) %d <<< %08x\n", This, entry->id, hres);
 653     return hres;
 654 }
 655
 656 static const IDispatchVtbl PHCPDispatchVtbl = {
 657     PHEventSink_QueryInterface,
 658     PHEventSink_AddRef,
 659     PHEventSink_Release,
 660     PHEventSink_GetTypeInfoCount,
 661     PHEventSink_GetTypeInfo,
 662     PHEventSink_GetIDsOfNames,
 663     PHEventSink_Invoke
 664 };
 665
 666 static PHEventSink *create_event_sink(PluginHost *plugin_host, ITypeInfo *typeinfo)
 667 {
 668     IConnectionPointContainer *cp_container;
 669     PHEventSink *ret;
 670     IConnectionPoint *cp;
 671     TYPEATTR *typeattr;
 672     TYPEKIND typekind;
 673     GUID guid;
 674     HRESULT hres;
 675
 676     hres = ITypeInfo_GetTypeAttr(typeinfo, &typeattr);
 677     if(FAILED(hres))
 678         return NULL;
 679
 680     typekind = typeattr->typekind;
 681     guid = typeattr->guid;
 682     ITypeInfo_ReleaseTypeAttr(typeinfo, typeattr);
 683
 684     TRACE("guid %s typekind %d\n", debugstr_guid(&guid), typekind);
 685
 686     if(typekind != TKIND_INTERFACE && typekind != TKIND_DISPATCH) {
 687         WARN("invalid typekind %d\n", typekind);
 688         return NULL;
 689     }
 690
 691     hres = IUnknown_QueryInterface(plugin_host->plugin_unk, &IID_IConnectionPointContainer, (void**)&cp_container);
 692     if(FAILED(hres)) {
 693         WARN("Could not get IConnectionPointContainer iface: %08x\n", hres);
 694         return NULL;
 695     }
 696
 697     hres = IConnectionPointContainer_FindConnectionPoint(cp_container, &guid, &cp);
 698     IConnectionPointContainer_Release(cp_container);
 699     if(FAILED(hres)) {
 700         WARN("Could not find %s connection point\n", debugstr_guid(&guid));
 701         return NULL;
 702     }
 703
 704     ret = heap_alloc_zero(sizeof(*ret));
 705     if(ret) {
 706         ret->IDispatch_iface.lpVtbl = &PHCPDispatchVtbl;
 707         ret->ref = 1;
 708         ret->host = plugin_host;
 709         ret->iid = guid;
 710         ret->is_dispiface = typekind == TKIND_DISPATCH;
 711
 712         ITypeInfo_AddRef(typeinfo);
 713         ret->typeinfo = typeinfo;
 714
 715         hres = IConnectionPoint_Advise(cp, (IUnknown*)&ret->IDispatch_iface, &ret->cookie);
 716     }else {
 717         hres = E_OUTOFMEMORY;
 718     }
 719
 720     IConnectionPoint_Release(cp);
 721     if(FAILED(hres)) {
 722         WARN("Advise failed: %08x\n", hres);
 723         return NULL;
 724     }
 725
 726     return ret;
 727 }
 728
 729 static ITypeInfo *get_eventiface_info(HTMLPluginContainer *plugin_container, ITypeInfo *class_info)
 730 {
 731     int impl_types, i, impl_flags;
 732     ITypeInfo *ret = NULL;
 733     TYPEATTR *typeattr;
 734     HREFTYPE ref;
 735     HRESULT hres;
 736
 737     hres = ITypeInfo_GetTypeAttr(class_info, &typeattr);
 738     if(FAILED(hres))
 739         return NULL;
 740
 741     if(typeattr->typekind != TKIND_COCLASS) {
 742         WARN("not coclass\n");
 743         ITypeInfo_ReleaseTypeAttr(class_info, typeattr);
 744         return NULL;
 745     }
 746
 747     impl_types = typeattr->cImplTypes;
 748     ITypeInfo_ReleaseTypeAttr(class_info, typeattr);
 749
 750     for(i=0; i<impl_types; i++) {
 751         hres = ITypeInfo_GetImplTypeFlags(class_info, i, &impl_flags);
 752         if(FAILED(hres))
 753             continue;
 754
 755         if((impl_flags & IMPLTYPEFLAG_FSOURCE)) {
 756             if(!(impl_flags & IMPLTYPEFLAG_FDEFAULT)) {
 757                 FIXME("Handle non-default source iface\n");
 758                 continue;
 759             }
 760
 761             hres = ITypeInfo_GetRefTypeOfImplType(class_info, i, &ref);
 762             if(FAILED(hres))
 763                 continue;
 764
 765             hres = ITypeInfo_GetRefTypeInfo(class_info, ref, &ret);
 766             if(FAILED(hres))
 767                 ret = NULL;
 768         }
 769     }
 770
 771     return ret;
 772 }
 773
 774 void bind_activex_event(HTMLDocumentNode *doc, HTMLPluginContainer *plugin_container, WCHAR *event, IDispatch *disp)
 775 {
 776     PluginHost *plugin_host = plugin_container->plugin_host;
 777     ITypeInfo *class_info, *source_info;
 778     DISPID id;
 779     HRESULT hres;
 780
 781     TRACE("(%p %p %s %p)\n", doc, plugin_host, debugstr_w(event), disp);
 782
 783     if(!plugin_host || !plugin_host->plugin_unk) {
 784         WARN("detached element %p\n", plugin_host);
 785         return;
 786     }
 787
 788     if(plugin_host->sink) {
 789         source_info = plugin_host->sink->typeinfo;
 790         ITypeInfo_AddRef(source_info);
 791     }else {
 792         IProvideClassInfo *provide_ci;
 793
 794         hres = IUnknown_QueryInterface(plugin_host->plugin_unk, &IID_IProvideClassInfo, (void**)&provide_ci);
 795         if(FAILED(hres)) {
 796             FIXME("No IProvideClassInfo, try GetTypeInfo?\n");
 797             return;
 798         }
 799
 800         hres = IProvideClassInfo_GetClassInfo(provide_ci, &class_info);
 801         IProvideClassInfo_Release(provide_ci);
 802         if(FAILED(hres) || !class_info) {
 803             WARN("GetClassInfo failed: %08x\n", hres);
 804             return;
 805         }
 806
 807         source_info = get_eventiface_info(plugin_container, class_info);
 808         ITypeInfo_Release(class_info);
 809         if(!source_info)
 810             return;
 811     }
 812
 813     hres = ITypeInfo_GetIDsOfNames(source_info, &event, 1, &id);
 814     if(FAILED(hres))
 815         WARN("Could not get disp id: %08x\n", hres);
 816     else if(!plugin_host->sink)
 817         plugin_host->sink = create_event_sink(plugin_host, source_info);
 818
 819     ITypeInfo_Release(source_info);
 820     if(FAILED(hres) || !plugin_host->sink)
 821         return;
 822
 823     add_sink_handler(plugin_host->sink, id, disp);
 824 }
 825
 826 static inline PluginHost *impl_from_IOleClientSite(IOleClientSite *iface)
 827 {
 828     return CONTAINING_RECORD(iface, PluginHost, IOleClientSite_iface);
 829 }
 830
 831 static HRESULT WINAPI PHClientSite_QueryInterface(IOleClientSite *iface, REFIID riid, void **ppv)
 832 {
 833     PluginHost *This = impl_from_IOleClientSite(iface);
 834
 835     if(IsEqualGUID(&IID_IUnknown, riid)) {
 836         TRACE("(%p)->(IID_IUnknown %p)\n", This, ppv);
 837         *ppv = &This->IOleClientSite_iface;
 838     }else if(IsEqualGUID(&IID_IOleClientSite, riid)) {
 839         TRACE("(%p)->(IID_IOleClientSite %p)\n", This, ppv);
 840         *ppv = &This->IOleClientSite_iface;
 841     }else if(IsEqualGUID(&IID_IAdviseSink, riid)) {
 842         TRACE("(%p)->(IID_IAdviseSink %p)\n", This, ppv);
 843         *ppv = &This->IAdviseSinkEx_iface;
 844     }else if(IsEqualGUID(&IID_IAdviseSinkEx, riid)) {
 845         TRACE("(%p)->(IID_IAdviseSinkEx %p)\n", This, ppv);
 846         *ppv = &This->IAdviseSinkEx_iface;
 847     }else if(IsEqualGUID(&IID_IPropertyNotifySink, riid)) {
 848         TRACE("(%p)->(IID_IPropertyNotifySink %p)\n", This, ppv);
 849         *ppv = &This->IPropertyNotifySink_iface;
 850     }else if(IsEqualGUID(&IID_IDispatch, riid)) {
 851         TRACE("(%p)->(IID_IDispatch %p)\n", This, ppv);
 852         *ppv = &This->IDispatch_iface;
 853     }else if(IsEqualGUID(&IID_IOleWindow, riid)) {
 854         TRACE("(%p)->(IID_IOleWindow %p)\n", This, ppv);
 855         *ppv = &This->IOleInPlaceSiteEx_iface;
 856     }else if(IsEqualGUID(&IID_IOleInPlaceSite, riid)) {
 857         TRACE("(%p)->(IID_IOleInPlaceSite %p)\n", This, ppv);
 858         *ppv = &This->IOleInPlaceSiteEx_iface;
 859     }else if(IsEqualGUID(&IID_IOleInPlaceSiteEx, riid)) {
 860         TRACE("(%p)->(IID_IOleInPlaceSiteEx %p)\n", This, ppv);
 861         *ppv = &This->IOleInPlaceSiteEx_iface;
 862     }else if(IsEqualGUID(&IID_IOleControlSite, riid)) {
 863         TRACE("(%p)->(IID_IOleControlSite %p)\n", This, ppv);
 864         *ppv = &This->IOleControlSite_iface;
 865     }else if(IsEqualGUID(&IID_IBindHost, riid)) {
 866         TRACE("(%p)->(IID_IBindHost %p)\n", This, ppv);
 867         *ppv = &This->IBindHost_iface;
 868     }else if(IsEqualGUID(&IID_IServiceProvider, riid)) {
 869         TRACE("(%p)->(IID_IServiceProvider %p)\n", This, ppv);
 870         *ppv = &This->IServiceProvider_iface;
 871     }else {
 872         WARN("Unsupported interface %s\n", debugstr_guid(riid));
 873         *ppv = NULL;
 874         return E_NOINTERFACE;
 875     }
 876
 877     IUnknown_AddRef((IUnknown*)*ppv);
 878     return S_OK;
 879 }
 880
 881 static ULONG WINAPI PHClientSite_AddRef(IOleClientSite *iface)
 882 {
 883     PluginHost *This = impl_from_IOleClientSite(iface);
 884     LONG ref = InterlockedIncrement(&This->ref);
 885
 886     TRACE("(%p) ref=%d\n", This, ref);
 887
 888     return ref;
 889 }
 890
 891 static void release_plugin_ifaces(PluginHost *This)
 892 {
 893     if(This->disp) {
 894         IDispatch_Release(This->disp);
 895         This->disp = NULL;
 896     }
 897
 898     if(This->ip_object) {
 899         IOleInPlaceObject_Release(This->ip_object);
 900         This->ip_object = NULL;
 901     }
 902
 903     if(This->plugin_unk) {
 904         IUnknown *unk = This->plugin_unk;
 905         LONG ref;
 906
 907         This->plugin_unk = NULL;
 908         ref = IUnknown_Release(unk);
 909
 910         TRACE("plugin ref = %d\n", ref);
 911     }
 912 }
 913
 914 static ULONG WINAPI PHClientSite_Release(IOleClientSite *iface)
 915 {
 916     PluginHost *This = impl_from_IOleClientSite(iface);
 917     LONG ref = InterlockedDecrement(&This->ref);
 918
 919     TRACE("(%p) ref=%d\n", This, ref);
 920
 921     if(!ref) {
 922         release_plugin_ifaces(This);
 923         if(This->sink) {
 924             This->sink->host = NULL;
 925             IDispatch_Release(&This->sink->IDispatch_iface);
 926             This->sink = NULL;
 927         }
 928         list_remove(&This->entry);
 929         if(This->element)
 930             This->element->plugin_host = NULL;
 931         heap_free(This);
 932     }
 933
 934     return ref;
 935 }
 936
 937 static HRESULT WINAPI PHClientSite_SaveObject(IOleClientSite *iface)
 938 {
 939     PluginHost *This = impl_from_IOleClientSite(iface);
 940     FIXME("(%p)\n", This);
 941     return E_NOTIMPL;
 942 }
 943
 944 static HRESULT WINAPI PHClientSite_GetMoniker(IOleClientSite *iface, DWORD dwAssign,
 945         DWORD dwWhichMoniker, IMoniker **ppmk)
 946 {
 947     PluginHost *This = impl_from_IOleClientSite(iface);
 948
 949     TRACE("(%p)->(%d %d %p)\n", This, dwAssign, dwWhichMoniker, ppmk);
 950
 951     switch(dwWhichMoniker) {
 952     case OLEWHICHMK_CONTAINER:
 953         if(!This->doc || !This->doc->window || !This->doc->window->mon) {
 954             FIXME("no moniker\n");
 955             return E_UNEXPECTED;
 956         }
 957
 958         *ppmk = This->doc->window->mon;
 959         IMoniker_AddRef(*ppmk);
 960         break;
 961     default:
 962         FIXME("which %d\n", dwWhichMoniker);
 963         return E_NOTIMPL;
 964     }
 965
 966     return S_OK;
 967 }
 968
 969 static HRESULT WINAPI PHClientSite_GetContainer(IOleClientSite *iface, IOleContainer **ppContainer)
 970 {
 971     PluginHost *This = impl_from_IOleClientSite(iface);
 972
 973     TRACE("(%p)->(%p)\n", This, ppContainer);
 974
 975     if(!This->doc) {
 976         ERR("Called on detached object\n");
 977         return E_UNEXPECTED;
 978     }
 979
 980     *ppContainer = &This->doc->basedoc.IOleContainer_iface;
 981     IOleContainer_AddRef(*ppContainer);
 982     return S_OK;
 983 }
 984
 985 static HRESULT WINAPI PHClientSite_ShowObject(IOleClientSite *iface)
 986 {
 987     PluginHost *This = impl_from_IOleClientSite(iface);
 988
 989     TRACE("(%p)\n", This);
 990
 991     return S_OK;
 992 }
 993
 994 static HRESULT WINAPI PHClientSite_OnShowWindow(IOleClientSite *iface, BOOL fShow)
 995 {
 996     PluginHost *This = impl_from_IOleClientSite(iface);
 997     FIXME("(%p)->(%x)\n", This, fShow);
 998     return E_NOTIMPL;
 999 }
1000
1001 static HRESULT WINAPI PHClientSite_RequestNewObjectLayout(IOleClientSite *iface)
1002 {
1003     PluginHost *This = impl_from_IOleClientSite(iface);
1004     FIXME("(%p)\n", This);
1005     return E_NOTIMPL;
1006 }
1007
1008 static const IOleClientSiteVtbl OleClientSiteVtbl = {
1009     PHClientSite_QueryInterface,
1010     PHClientSite_AddRef,
1011     PHClientSite_Release,
1012     PHClientSite_SaveObject,
1013     PHClientSite_GetMoniker,
1014     PHClientSite_GetContainer,
1015     PHClientSite_ShowObject,
1016     PHClientSite_OnShowWindow,
1017     PHClientSite_RequestNewObjectLayout
1018 };
1019
1020 static inline PluginHost *impl_from_IAdviseSinkEx(IAdviseSinkEx *iface)
1021 {
1022     return CONTAINING_RECORD(iface, PluginHost, IAdviseSinkEx_iface);
1023 }
1024
1025 static HRESULT WINAPI PHAdviseSinkEx_QueryInterface(IAdviseSinkEx *iface, REFIID riid, void **ppv)
1026 {
1027     PluginHost *This = impl_from_IAdviseSinkEx(iface);
1028     return IOleClientSite_QueryInterface(&This->IOleClientSite_iface, riid, ppv);
1029 }
1030
1031 static ULONG WINAPI PHAdviseSinkEx_AddRef(IAdviseSinkEx *iface)
1032 {
1033     PluginHost *This = impl_from_IAdviseSinkEx(iface);
1034     return IOleClientSite_AddRef(&This->IOleClientSite_iface);
1035 }
1036
1037 static ULONG WINAPI PHAdviseSinkEx_Release(IAdviseSinkEx *iface)
1038 {
1039     PluginHost *This = impl_from_IAdviseSinkEx(iface);
1040     return IOleClientSite_Release(&This->IOleClientSite_iface);
1041 }
1042
1043 static void WINAPI PHAdviseSinkEx_OnDataChange(IAdviseSinkEx *iface, FORMATETC *pFormatetc, STGMEDIUM *pStgMedium)
1044 {
1045     PluginHost *This = impl_from_IAdviseSinkEx(iface);
1046     FIXME("(%p)->(%p %p)\n", This, pFormatetc, pStgMedium);
1047 }
1048
1049 static void WINAPI PHAdviseSinkEx_OnViewChange(IAdviseSinkEx *iface, DWORD dwAspect, LONG lindex)
1050 {
1051     PluginHost *This = impl_from_IAdviseSinkEx(iface);
1052     FIXME("(%p)->(%d %d)\n", This, dwAspect, lindex);
1053 }
1054
1055 static void WINAPI PHAdviseSinkEx_OnRename(IAdviseSinkEx *iface, IMoniker *pmk)
1056 {
1057     PluginHost *This = impl_from_IAdviseSinkEx(iface);
1058     FIXME("(%p)->(%p)\n", This, pmk);
1059 }
1060
1061 static void WINAPI PHAdviseSinkEx_OnSave(IAdviseSinkEx *iface)
1062 {
1063     PluginHost *This = impl_from_IAdviseSinkEx(iface);
1064     FIXME("(%p)\n", This);
1065 }
1066
1067 static void WINAPI PHAdviseSinkEx_OnClose(IAdviseSinkEx *iface)
1068 {
1069     PluginHost *This = impl_from_IAdviseSinkEx(iface);
1070     FIXME("(%p)\n", This);
1071 }
1072
1073 static void WINAPI PHAdviseSinkEx_OnViewStatusChange(IAdviseSinkEx *iface, DWORD dwViewStatus)
1074 {
1075     PluginHost *This = impl_from_IAdviseSinkEx(iface);
1076     FIXME("(%p)->(%d)\n", This, dwViewStatus);
1077 }
1078
1079 static const IAdviseSinkExVtbl AdviseSinkExVtbl = {
1080     PHAdviseSinkEx_QueryInterface,
1081     PHAdviseSinkEx_AddRef,
1082     PHAdviseSinkEx_Release,
1083     PHAdviseSinkEx_OnDataChange,
1084     PHAdviseSinkEx_OnViewChange,
1085     PHAdviseSinkEx_OnRename,
1086     PHAdviseSinkEx_OnSave,
1087     PHAdviseSinkEx_OnClose,
1088     PHAdviseSinkEx_OnViewStatusChange
1089 };
1090
1091 static inline PluginHost *impl_from_IPropertyNotifySink(IPropertyNotifySink *iface)
1092 {
1093     return CONTAINING_RECORD(iface, PluginHost, IPropertyNotifySink_iface);
1094 }
1095
1096 static HRESULT WINAPI PHPropertyNotifySink_QueryInterface(IPropertyNotifySink *iface, REFIID riid, void **ppv)
1097 {
1098     PluginHost *This = impl_from_IPropertyNotifySink(iface);
1099     return IOleClientSite_QueryInterface(&This->IOleClientSite_iface, riid, ppv);
1100 }
1101
1102 static ULONG WINAPI PHPropertyNotifySink_AddRef(IPropertyNotifySink *iface)
1103 {
1104     PluginHost *This = impl_from_IPropertyNotifySink(iface);
1105     return IOleClientSite_AddRef(&This->IOleClientSite_iface);
1106 }
1107
1108 static ULONG WINAPI PHPropertyNotifySink_Release(IPropertyNotifySink *iface)
1109 {
1110     PluginHost *This = impl_from_IPropertyNotifySink(iface);
1111     return IOleClientSite_Release(&This->IOleClientSite_iface);
1112 }
1113
1114 static HRESULT WINAPI PHPropertyNotifySink_OnChanged(IPropertyNotifySink *iface, DISPID dispID)
1115 {
1116     PluginHost *This = impl_from_IPropertyNotifySink(iface);
1117
1118     TRACE("(%p)->(%d)\n", This, dispID);
1119
1120     switch(dispID) {
1121     case DISPID_READYSTATE:
1122         update_readystate(This);
1123         break;
1124     default :
1125         FIXME("Unimplemented dispID %d\n", dispID);
1126         return E_NOTIMPL;
1127     }
1128
1129     return S_OK;
1130 }
1131
1132 static HRESULT WINAPI PHPropertyNotifySink_OnRequestEdit(IPropertyNotifySink *iface, DISPID dispID)
1133 {
1134     PluginHost *This = impl_from_IPropertyNotifySink(iface);
1135     FIXME("(%p)->(%d)\n", This, dispID);
1136     return E_NOTIMPL;
1137 }
1138
1139 static const IPropertyNotifySinkVtbl PropertyNotifySinkVtbl = {
1140     PHPropertyNotifySink_QueryInterface,
1141     PHPropertyNotifySink_AddRef,
1142     PHPropertyNotifySink_Release,
1143     PHPropertyNotifySink_OnChanged,
1144     PHPropertyNotifySink_OnRequestEdit
1145 };
1146
1147 static inline PluginHost *impl_from_IDispatch(IDispatch *iface)
1148 {
1149     return CONTAINING_RECORD(iface, PluginHost, IDispatch_iface);
1150 }
1151
1152 static HRESULT WINAPI PHDispatch_QueryInterface(IDispatch *iface, REFIID riid, void **ppv)
1153 {
1154     PluginHost *This = impl_from_IDispatch(iface);
1155     return IOleClientSite_QueryInterface(&This->IOleClientSite_iface, riid, ppv);
1156 }
1157
1158 static ULONG WINAPI PHDispatch_AddRef(IDispatch *iface)
1159 {
1160     PluginHost *This = impl_from_IDispatch(iface);
1161     return IOleClientSite_AddRef(&This->IOleClientSite_iface);
1162 }
1163
1164 static ULONG WINAPI PHDispatch_Release(IDispatch *iface)
1165 {
1166     PluginHost *This = impl_from_IDispatch(iface);
1167     return IOleClientSite_Release(&This->IOleClientSite_iface);
1168 }
1169
1170 static HRESULT WINAPI PHDispatch_GetTypeInfoCount(IDispatch *iface, UINT *pctinfo)
1171 {
1172     PluginHost *This = impl_from_IDispatch(iface);
1173     FIXME("(%p)->(%p)\n", This, pctinfo);
1174     return E_NOTIMPL;
1175 }
1176
1177 static HRESULT WINAPI PHDispatch_GetTypeInfo(IDispatch *iface, UINT iTInfo,
1178         LCID lcid, ITypeInfo **ppTInfo)
1179 {
1180     PluginHost *This = impl_from_IDispatch(iface);
1181     FIXME("(%p)->(%d %d %p)\n", This, iTInfo, lcid, ppTInfo);
1182     return E_NOTIMPL;
1183 }
1184
1185 static HRESULT WINAPI PHDispatch_GetIDsOfNames(IDispatch *iface, REFIID riid,
1186         LPOLESTR *rgszNames, UINT cNames, LCID lcid, DISPID *rgDispId)
1187 {
1188     PluginHost *This = impl_from_IDispatch(iface);
1189     FIXME("(%p)->(%s %p %d %d %p)\n", This, debugstr_guid(riid), rgszNames, cNames, lcid, rgDispId);
1190     return E_NOTIMPL;
1191 }
1192
1193 static HRESULT WINAPI PHDispatch_Invoke(IDispatch *iface, DISPID dispid,  REFIID riid, LCID lcid,
1194         WORD wFlags, DISPPARAMS *pDispParams, VARIANT *pVarResult, EXCEPINFO *pExcepInfo, UINT *puArgErr)
1195 {
1196     PluginHost *This = impl_from_IDispatch(iface);
1197     FIXME("(%p)->(%d %x %p %p)\n", This, dispid, wFlags, pDispParams, pVarResult);
1198     return E_NOTIMPL;
1199 }
1200
1201 static const IDispatchVtbl DispatchVtbl = {
1202     PHDispatch_QueryInterface,
1203     PHDispatch_AddRef,
1204     PHDispatch_Release,
1205     PHDispatch_GetTypeInfoCount,
1206     PHDispatch_GetTypeInfo,
1207     PHDispatch_GetIDsOfNames,
1208     PHDispatch_Invoke
1209 };
1210
1211 static inline PluginHost *impl_from_IOleInPlaceSiteEx(IOleInPlaceSiteEx *iface)
1212 {
1213     return CONTAINING_RECORD(iface, PluginHost, IOleInPlaceSiteEx_iface);
1214 }
1215
1216 static HRESULT WINAPI PHInPlaceSite_QueryInterface(IOleInPlaceSiteEx *iface, REFIID riid, void **ppv)
1217 {
1218     PluginHost *This = impl_from_IOleInPlaceSiteEx(iface);
1219     return IOleClientSite_QueryInterface(&This->IOleClientSite_iface, riid, ppv);
1220 }
1221
1222 static ULONG WINAPI PHInPlaceSite_AddRef(IOleInPlaceSiteEx *iface)
1223 {
1224     PluginHost *This = impl_from_IOleInPlaceSiteEx(iface);
1225     return IOleClientSite_AddRef(&This->IOleClientSite_iface);
1226 }
1227
1228 static ULONG WINAPI PHInPlaceSite_Release(IOleInPlaceSiteEx *iface)
1229 {
1230     PluginHost *This = impl_from_IOleInPlaceSiteEx(iface);
1231     return IOleClientSite_Release(&This->IOleClientSite_iface);
1232 }
1233
1234 static HRESULT WINAPI PHInPlaceSite_GetWindow(IOleInPlaceSiteEx *iface, HWND *phwnd)
1235 {
1236     PluginHost *This = impl_from_IOleInPlaceSiteEx(iface);
1237
1238     TRACE("(%p)->(%p)\n", This, phwnd);
1239
1240     *phwnd = This->hwnd;
1241     return S_OK;
1242 }
1243
1244 static HRESULT WINAPI PHInPlaceSite_ContextSensitiveHelp(IOleInPlaceSiteEx *iface, BOOL fEnterMode)
1245 {
1246     PluginHost *This = impl_from_IOleInPlaceSiteEx(iface);
1247     FIXME("(%p)->(%x)\n", This, fEnterMode);
1248     return E_NOTIMPL;
1249 }
1250
1251 static HRESULT WINAPI PHInPlaceSite_CanInPlaceActivate(IOleInPlaceSiteEx *iface)
1252 {
1253     PluginHost *This = impl_from_IOleInPlaceSiteEx(iface);
1254
1255     TRACE("(%p)\n", This);
1256
1257     return S_OK;
1258 }
1259
1260 static HRESULT WINAPI PHInPlaceSite_OnInPlaceActivate(IOleInPlaceSiteEx *iface)
1261 {
1262     PluginHost *This = impl_from_IOleInPlaceSiteEx(iface);
1263     FIXME("(%p)\n", This);
1264     return E_NOTIMPL;
1265 }
1266
1267 static HRESULT WINAPI PHInPlaceSite_OnUIActivate(IOleInPlaceSiteEx *iface)
1268 {
1269     PluginHost *This = impl_from_IOleInPlaceSiteEx(iface);
1270
1271     TRACE("(%p)\n", This);
1272
1273     if(!This->plugin_unk) {
1274         ERR("No plugin object\n");
1275         return E_UNEXPECTED;
1276     }
1277
1278     This->ui_active = TRUE;
1279
1280     notif_enabled(This);
1281     return S_OK;
1282 }
1283
1284 static HRESULT WINAPI PHInPlaceSite_GetWindowContext(IOleInPlaceSiteEx *iface,
1285         IOleInPlaceFrame **ppFrame, IOleInPlaceUIWindow **ppDoc, RECT *lprcPosRect,
1286         RECT *lprcClipRect, OLEINPLACEFRAMEINFO *frame_info)
1287 {
1288     PluginHost *This = impl_from_IOleInPlaceSiteEx(iface);
1289     IOleInPlaceUIWindow *ip_window;
1290     IOleInPlaceFrame *ip_frame;
1291     RECT pr, cr;
1292     HRESULT hres;
1293
1294     TRACE("(%p)->(%p %p %p %p %p)\n", This, ppFrame, ppDoc, lprcPosRect, lprcClipRect, frame_info);
1295
1296     if(!This->doc || !This->doc->basedoc.doc_obj || !This->doc->basedoc.doc_obj->ipsite) {
1297         FIXME("No ipsite\n");
1298         return E_UNEXPECTED;
1299     }
1300
1301     hres = IOleInPlaceSite_GetWindowContext(This->doc->basedoc.doc_obj->ipsite, &ip_frame, &ip_window, &pr, &cr, frame_info);
1302     if(FAILED(hres)) {
1303         WARN("GetWindowContext failed: %08x\n", hres);
1304         return hres;
1305     }
1306
1307     if(ip_window)
1308         IOleInPlaceUIWindow_Release(ip_window);
1309     if(ip_frame)
1310         IOleInPlaceFrame_Release(ip_frame);
1311
1312     hres = create_ip_frame(&ip_frame);
1313     if(FAILED(hres))
1314         return hres;
1315
1316     hres = create_ip_window(ppDoc);
1317     if(FAILED(hres)) {
1318         IOleInPlaceFrame_Release(ip_frame);
1319         return hres;
1320     }
1321
1322     *ppFrame = ip_frame;
1323     *lprcPosRect = This->rect;
1324     *lprcClipRect = This->rect;
1325     return S_OK;
1326 }
1327
1328 static HRESULT WINAPI PHInPlaceSite_Scroll(IOleInPlaceSiteEx *iface, SIZE scrollExtent)
1329 {
1330     PluginHost *This = impl_from_IOleInPlaceSiteEx(iface);
1331     FIXME("(%p)->({%d %d})\n", This, scrollExtent.cx, scrollExtent.cy);
1332     return E_NOTIMPL;
1333 }
1334
1335 static HRESULT WINAPI PHInPlaceSite_OnUIDeactivate(IOleInPlaceSiteEx *iface, BOOL fUndoable)
1336 {
1337     PluginHost *This = impl_from_IOleInPlaceSiteEx(iface);
1338     FIXME("(%p)->(%x)\n", This, fUndoable);
1339     return E_NOTIMPL;
1340 }
1341
1342 static HRESULT WINAPI PHInPlaceSite_OnInPlaceDeactivate(IOleInPlaceSiteEx *iface)
1343 {
1344     PluginHost *This = impl_from_IOleInPlaceSiteEx(iface);
1345
1346     TRACE("(%p)\n", This);
1347
1348     if(This->ip_object) {
1349         IOleInPlaceObject_Release(This->ip_object);
1350         This->ip_object = NULL;
1351     }
1352
1353     return S_OK;
1354 }
1355
1356 static HRESULT WINAPI PHInPlaceSite_DiscardUndoState(IOleInPlaceSiteEx *iface)
1357 {
1358     PluginHost *This = impl_from_IOleInPlaceSiteEx(iface);
1359     FIXME("(%p)\n", This);
1360     return E_NOTIMPL;
1361 }
1362
1363 static HRESULT WINAPI PHInPlaceSite_DeactivateAndUndo(IOleInPlaceSiteEx *iface)
1364 {
1365     PluginHost *This = impl_from_IOleInPlaceSiteEx(iface);
1366     FIXME("(%p)\n", This);
1367     return E_NOTIMPL;
1368 }
1369
1370 static HRESULT WINAPI PHInPlaceSite_OnPosRectChange(IOleInPlaceSiteEx *iface, LPCRECT lprcPosRect)
1371 {
1372     PluginHost *This = impl_from_IOleInPlaceSiteEx(iface);
1373     FIXME("(%p)->(%p)\n", This, lprcPosRect);
1374     return E_NOTIMPL;
1375 }
1376
1377 static HRESULT WINAPI PHInPlaceSiteEx_OnInPlaceActivateEx(IOleInPlaceSiteEx *iface, BOOL *pfNoRedraw, DWORD dwFlags)
1378 {
1379     PluginHost *This = impl_from_IOleInPlaceSiteEx(iface);
1380     HWND hwnd;
1381     HRESULT hres;
1382
1383     TRACE("(%p)->(%p %x)\n", This, pfNoRedraw, dwFlags);
1384
1385     if(This->ip_object)
1386         return S_OK;
1387
1388     hres = IUnknown_QueryInterface(This->plugin_unk, &IID_IOleInPlaceObject, (void**)&This->ip_object);
1389     if(FAILED(hres))
1390         return hres;
1391
1392     hres = IOleInPlaceObject_GetWindow(This->ip_object, &hwnd);
1393     if(SUCCEEDED(hres))
1394         FIXME("Use hwnd %p\n", hwnd);
1395
1396     *pfNoRedraw = FALSE;
1397     return S_OK;
1398 }
1399
1400 static HRESULT WINAPI PHInPlaceSiteEx_OnInPlaceDeactivateEx(IOleInPlaceSiteEx *iface, BOOL fNoRedraw)
1401 {
1402     PluginHost *This = impl_from_IOleInPlaceSiteEx(iface);
1403     FIXME("(%p)->(%x)\n", This, fNoRedraw);
1404     return E_NOTIMPL;
1405 }
1406
1407 static HRESULT WINAPI PHInPlaceSiteEx_RequestUIActivate(IOleInPlaceSiteEx *iface)
1408 {
1409     PluginHost *This = impl_from_IOleInPlaceSiteEx(iface);
1410     FIXME("(%p)\n", This);
1411     return E_NOTIMPL;
1412 }
1413
1414 static const IOleInPlaceSiteExVtbl OleInPlaceSiteExVtbl = {
1415     PHInPlaceSite_QueryInterface,
1416     PHInPlaceSite_AddRef,
1417     PHInPlaceSite_Release,
1418     PHInPlaceSite_GetWindow,
1419     PHInPlaceSite_ContextSensitiveHelp,
1420     PHInPlaceSite_CanInPlaceActivate,
1421     PHInPlaceSite_OnInPlaceActivate,
1422     PHInPlaceSite_OnUIActivate,
1423     PHInPlaceSite_GetWindowContext,
1424     PHInPlaceSite_Scroll,
1425     PHInPlaceSite_OnUIDeactivate,
1426     PHInPlaceSite_OnInPlaceDeactivate,
1427     PHInPlaceSite_DiscardUndoState,
1428     PHInPlaceSite_DeactivateAndUndo,
1429     PHInPlaceSite_OnPosRectChange,
1430     PHInPlaceSiteEx_OnInPlaceActivateEx,
1431     PHInPlaceSiteEx_OnInPlaceDeactivateEx,
1432     PHInPlaceSiteEx_RequestUIActivate
1433 };
1434
1435 static inline PluginHost *impl_from_IOleControlSite(IOleControlSite *iface)
1436 {
1437     return CONTAINING_RECORD(iface, PluginHost, IOleControlSite_iface);
1438 }
1439
1440 static HRESULT WINAPI PHControlSite_QueryInterface(IOleControlSite *iface, REFIID riid, void **ppv)
1441 {
1442     PluginHost *This = impl_from_IOleControlSite(iface);
1443     return IOleClientSite_QueryInterface(&This->IOleClientSite_iface, riid, ppv);
1444 }
1445
1446 static ULONG WINAPI PHControlSite_AddRef(IOleControlSite *iface)
1447 {
1448     PluginHost *This = impl_from_IOleControlSite(iface);
1449     return IOleClientSite_AddRef(&This->IOleClientSite_iface);
1450 }
1451
1452 static ULONG WINAPI PHControlSite_Release(IOleControlSite *iface)
1453 {
1454     PluginHost *This = impl_from_IOleControlSite(iface);
1455     return IOleClientSite_Release(&This->IOleClientSite_iface);
1456 }
1457
1458 static HRESULT WINAPI PHControlSite_OnControlInfoChanged(IOleControlSite *iface)
1459 {
1460     PluginHost *This = impl_from_IOleControlSite(iface);
1461     FIXME("(%p)\n", This);
1462     return E_NOTIMPL;
1463 }
1464
1465 static HRESULT WINAPI PHControlSite_LockInPlaceActive(IOleControlSite *iface, BOOL fLock)
1466 {
1467     PluginHost *This = impl_from_IOleControlSite(iface);
1468     FIXME("(%p)->(%x)\n", This, fLock);
1469     return E_NOTIMPL;
1470 }
1471
1472 static HRESULT WINAPI PHControlSite_GetExtendedControl(IOleControlSite *iface, IDispatch **ppDisp)
1473 {
1474     PluginHost *This = impl_from_IOleControlSite(iface);
1475     FIXME("(%p)->(%p)\n", This, ppDisp);
1476     return E_NOTIMPL;
1477 }
1478
1479 static HRESULT WINAPI PHControlSite_TransformCoords(IOleControlSite *iface, POINTL *pPtlHimetric, POINTF *pPtfContainer, DWORD dwFlags)
1480 {
1481     PluginHost *This = impl_from_IOleControlSite(iface);
1482     FIXME("(%p)->(%p %p %x)\n", This, pPtlHimetric, pPtfContainer, dwFlags);
1483     return E_NOTIMPL;
1484 }
1485
1486 static HRESULT WINAPI PHControlSite_TranslateAccelerator(IOleControlSite *iface, MSG *pMsg, DWORD grfModifiers)
1487 {
1488     PluginHost *This = impl_from_IOleControlSite(iface);
1489     FIXME("(%p)->(%x)\n", This, grfModifiers);
1490     return E_NOTIMPL;
1491 }
1492
1493 static HRESULT WINAPI PHControlSite_OnFocus(IOleControlSite *iface, BOOL fGotFocus)
1494 {
1495     PluginHost *This = impl_from_IOleControlSite(iface);
1496     FIXME("(%p)->(%x)\n", This, fGotFocus);
1497     return E_NOTIMPL;
1498 }
1499
1500 static HRESULT WINAPI PHControlSite_ShowPropertyFrame(IOleControlSite *iface)
1501 {
1502     PluginHost *This = impl_from_IOleControlSite(iface);
1503     FIXME("(%p)\n", This);
1504     return E_NOTIMPL;
1505 }
1506
1507 static const IOleControlSiteVtbl OleControlSiteVtbl = {
1508     PHControlSite_QueryInterface,
1509     PHControlSite_AddRef,
1510     PHControlSite_Release,
1511     PHControlSite_OnControlInfoChanged,
1512     PHControlSite_LockInPlaceActive,
1513     PHControlSite_GetExtendedControl,
1514     PHControlSite_TransformCoords,
1515     PHControlSite_TranslateAccelerator,
1516     PHControlSite_OnFocus,
1517     PHControlSite_ShowPropertyFrame
1518 };
1519
1520 static inline PluginHost *impl_from_IBindHost(IBindHost *iface)
1521 {
1522     return CONTAINING_RECORD(iface, PluginHost, IBindHost_iface);
1523 }
1524
1525 static HRESULT WINAPI PHBindHost_QueryInterface(IBindHost *iface, REFIID riid, void **ppv)
1526 {
1527     PluginHost *This = impl_from_IBindHost(iface);
1528     return IOleClientSite_QueryInterface(&This->IOleClientSite_iface, riid, ppv);
1529 }
1530
1531 static ULONG WINAPI PHBindHost_AddRef(IBindHost *iface)
1532 {
1533     PluginHost *This = impl_from_IBindHost(iface);
1534     return IOleClientSite_AddRef(&This->IOleClientSite_iface);
1535 }
1536
1537 static ULONG WINAPI PHBindHost_Release(IBindHost *iface)
1538 {
1539     PluginHost *This = impl_from_IBindHost(iface);
1540     return IOleClientSite_Release(&This->IOleClientSite_iface);
1541 }
1542
1543 static HRESULT WINAPI PHBindHost_CreateMoniker(IBindHost *iface, LPOLESTR szName, IBindCtx *pBC, IMoniker **ppmk, DWORD dwReserved)
1544 {
1545     PluginHost *This = impl_from_IBindHost(iface);
1546
1547     TRACE("(%p)->(%s %p %p %x)\n", This, debugstr_w(szName), pBC, ppmk, dwReserved);
1548
1549     if(!This->doc || !This->doc->window || !This->doc->window->mon) {
1550         FIXME("no moniker\n");
1551         return E_UNEXPECTED;
1552     }
1553
1554     return CreateURLMoniker(This->doc->window->mon, szName, ppmk);
1555 }
1556
1557 static HRESULT WINAPI PHBindHost_MonikerBindToStorage(IBindHost *iface, IMoniker *pMk, IBindCtx *pBC,
1558         IBindStatusCallback *pBSC, REFIID riid, void **ppvObj)
1559 {
1560     PluginHost *This = impl_from_IBindHost(iface);
1561     FIXME("(%p)->(%p %p %p %s %p)\n", This, pMk, pBC, pBSC, debugstr_guid(riid), ppvObj);
1562     return E_NOTIMPL;
1563 }
1564
1565 static HRESULT WINAPI PHBindHost_MonikerBindToObject(IBindHost *iface, IMoniker *pMk, IBindCtx *pBC,
1566         IBindStatusCallback *pBSC, REFIID riid, void **ppvObj)
1567 {
1568     PluginHost *This = impl_from_IBindHost(iface);
1569     FIXME("(%p)->(%p %p %p %s %p)\n", This, pMk, pBC, pBSC, debugstr_guid(riid), ppvObj);
1570     return E_NOTIMPL;
1571 }
1572
1573 static const IBindHostVtbl BindHostVtbl = {
1574     PHBindHost_QueryInterface,
1575     PHBindHost_AddRef,
1576     PHBindHost_Release,
1577     PHBindHost_CreateMoniker,
1578     PHBindHost_MonikerBindToStorage,
1579     PHBindHost_MonikerBindToObject
1580 };
1581
1582 static inline PluginHost *impl_from_IServiceProvider(IServiceProvider *iface)
1583 {
1584     return CONTAINING_RECORD(iface, PluginHost, IServiceProvider_iface);
1585 }
1586
1587 static HRESULT WINAPI PHServiceProvider_QueryInterface(IServiceProvider *iface, REFIID riid, void **ppv)
1588 {
1589     PluginHost *This = impl_from_IServiceProvider(iface);
1590     return IOleClientSite_QueryInterface(&This->IOleClientSite_iface, riid, ppv);
1591 }
1592
1593 static ULONG WINAPI PHServiceProvider_AddRef(IServiceProvider *iface)
1594 {
1595     PluginHost *This = impl_from_IServiceProvider(iface);
1596     return IOleClientSite_AddRef(&This->IOleClientSite_iface);
1597 }
1598
1599 static ULONG WINAPI PHServiceProvider_Release(IServiceProvider *iface)
1600 {
1601     PluginHost *This = impl_from_IServiceProvider(iface);
1602     return IOleClientSite_Release(&This->IOleClientSite_iface);
1603 }
1604
1605 static HRESULT WINAPI PHServiceProvider_QueryService(IServiceProvider *iface, REFGUID guidService, REFIID riid, void **ppv)
1606 {
1607     PluginHost *This = impl_from_IServiceProvider(iface);
1608
1609     if(IsEqualGUID(guidService, &SID_SBindHost)) {
1610         TRACE("SID_SBindHost service\n");
1611         return IOleClientSite_QueryInterface(&This->IOleClientSite_iface, riid, ppv);
1612     }
1613
1614     TRACE("(%p)->(%s %s %p)\n", This, debugstr_guid(guidService), debugstr_guid(riid), ppv);
1615
1616     if(!This->doc || !This->doc->basedoc.window) {
1617         *ppv = NULL;
1618         return E_NOINTERFACE;
1619     }
1620
1621     return IServiceProvider_QueryService(&This->doc->basedoc.window->base.IServiceProvider_iface,
1622             guidService, riid, ppv);
1623 }
1624
1625 static const IServiceProviderVtbl ServiceProviderVtbl = {
1626     PHServiceProvider_QueryInterface,
1627     PHServiceProvider_AddRef,
1628     PHServiceProvider_Release,
1629     PHServiceProvider_QueryService
1630 };
1631
1632 static BOOL parse_classid(const PRUnichar *classid, CLSID *clsid)
1633 {
1634     const WCHAR *ptr;
1635     unsigned len;
1636     HRESULT hres;
1637
1638     static const PRUnichar clsidW[] = {'c','l','s','i','d',':'};
1639
1640     if(strncmpiW(classid, clsidW, sizeof(clsidW)/sizeof(WCHAR)))
1641         return FALSE;
1642
1643     ptr = classid + sizeof(clsidW)/sizeof(WCHAR);
1644     len = strlenW(ptr);
1645
1646     if(len == 38) {
1647         hres = CLSIDFromString(ptr, clsid);
1648     }else if(len == 36) {
1649         WCHAR buf[39];
1650
1651         buf[0] = '{';
1652         memcpy(buf+1, ptr, len*sizeof(WCHAR));
1653         buf[37] = '}';
1654         buf[38] = 0;
1655         hres = CLSIDFromString(buf, clsid);
1656     }else {
1657         return FALSE;
1658     }
1659
1660     return SUCCEEDED(hres);
1661 }
1662
1663 static BOOL get_elem_clsid(nsIDOMHTMLElement *elem, CLSID *clsid)
1664 {
1665     const PRUnichar *val;
1666     nsAString val_str;
1667     nsresult nsres;
1668     BOOL ret = FALSE;
1669
1670     static const PRUnichar classidW[] = {'c','l','a','s','s','i','d',0};
1671
1672     nsres = get_elem_attr_value(elem, classidW, &val_str, &val);
1673     if(NS_SUCCEEDED(nsres)) {
1674         if(*val)
1675             ret = parse_classid(val, clsid);
1676         nsAString_Finish(&val_str);
1677     }
1678
1679     return ret;
1680 }
1681
1682 typedef struct {
1683     IBindStatusCallback IBindStatusCallback_iface;
1684     IWindowForBindingUI IWindowForBindingUI_iface;
1685     LONG ref;
1686 } InstallCallback;
1687
1688 static inline InstallCallback *impl_from_IBindStatusCallback(IBindStatusCallback *iface)
1689 {
1690     return CONTAINING_RECORD(iface, InstallCallback, IBindStatusCallback_iface);
1691 }
1692
1693 static HRESULT WINAPI InstallCallback_QueryInterface(IBindStatusCallback *iface,
1694         REFIID riid, void **ppv)
1695 {
1696     InstallCallback *This = impl_from_IBindStatusCallback(iface);
1697
1698     if(IsEqualGUID(&IID_IUnknown, riid)) {
1699         TRACE("(%p)->(IID_IUnknown %p)\n", This, ppv);
1700         *ppv = &This->IBindStatusCallback_iface;
1701     }else if(IsEqualGUID(&IID_IBindStatusCallback, riid)) {
1702         TRACE("(%p)->(IID_IBindStatusCallback %p)\n", This, ppv);
1703         *ppv = &This->IBindStatusCallback_iface;
1704     }else if(IsEqualGUID(&IID_IWindowForBindingUI, riid)) {
1705         TRACE("(%p)->(IID_IWindowForBindingUI %p)\n", This, ppv);
1706         *ppv = &This->IWindowForBindingUI_iface;
1707     }else {
1708         TRACE("(%p)->(%s %p)\n", This, debugstr_guid(riid), ppv);
1709         *ppv = NULL;
1710         return E_NOINTERFACE;
1711     }
1712
1713     IUnknown_AddRef((IUnknown*)*ppv);
1714     return S_OK;
1715 }
1716
1717 static ULONG WINAPI InstallCallback_AddRef(IBindStatusCallback *iface)
1718 {
1719     InstallCallback *This = impl_from_IBindStatusCallback(iface);
1720     LONG ref = InterlockedIncrement(&This->ref);
1721
1722     TRACE("(%p) ref=%d\n", This, ref);
1723
1724     return ref;
1725 }
1726
1727 static ULONG WINAPI InstallCallback_Release(IBindStatusCallback *iface)
1728 {
1729     InstallCallback *This = impl_from_IBindStatusCallback(iface);
1730     LONG ref = InterlockedIncrement(&This->ref);
1731
1732     TRACE("(%p) ref=%d\n", This, ref);
1733
1734     if(!ref)
1735         heap_free(This);
1736
1737     return ref;
1738 }
1739
1740 static HRESULT WINAPI InstallCallback_OnStartBinding(IBindStatusCallback *iface,
1741         DWORD dwReserved, IBinding *pib)
1742 {
1743     InstallCallback *This = impl_from_IBindStatusCallback(iface);
1744     TRACE("(%p)->(%x %p)\n", This, dwReserved, pib);
1745     return S_OK;
1746 }
1747
1748 static HRESULT WINAPI InstallCallback_GetPriority(IBindStatusCallback *iface, LONG *pnPriority)
1749 {
1750     InstallCallback *This = impl_from_IBindStatusCallback(iface);
1751     TRACE("(%p)->(%p)\n", This, pnPriority);
1752     return E_NOTIMPL;
1753 }
1754
1755 static HRESULT WINAPI InstallCallback_OnLowResource(IBindStatusCallback *iface, DWORD dwReserved)
1756 {
1757     InstallCallback *This = impl_from_IBindStatusCallback(iface);
1758     TRACE("(%p)->(%x)\n", This, dwReserved);
1759     return S_OK;
1760 }
1761
1762 static HRESULT WINAPI InstallCallback_OnProgress(IBindStatusCallback *iface, ULONG ulProgress,
1763         ULONG ulProgressMax, ULONG ulStatusCode, LPCWSTR szStatusText)
1764 {
1765     InstallCallback *This = impl_from_IBindStatusCallback(iface);
1766     TRACE("(%p)->(%u %u %u %s)\n", This, ulProgress, ulProgressMax, ulStatusCode, debugstr_w(szStatusText));
1767     return S_OK;
1768 }
1769
1770 static HRESULT WINAPI InstallCallback_OnStopBinding(IBindStatusCallback *iface,
1771         HRESULT hresult, LPCWSTR szError)
1772 {
1773     InstallCallback *This = impl_from_IBindStatusCallback(iface);
1774     TRACE("(%p)->(%08x %s)\n", This, hresult, debugstr_w(szError));
1775     return S_OK;
1776 }
1777
1778 static HRESULT WINAPI InstallCallback_GetBindInfo(IBindStatusCallback *iface,
1779         DWORD* grfBINDF, BINDINFO* pbindinfo)
1780 {
1781     InstallCallback *This = impl_from_IBindStatusCallback(iface);
1782
1783     TRACE("(%p)->(%p %p)\n", This, grfBINDF, pbindinfo);
1784
1785     *grfBINDF = BINDF_ASYNCHRONOUS;
1786     return S_OK;
1787 }
1788
1789 static HRESULT WINAPI InstallCallback_OnDataAvailable(IBindStatusCallback *iface, DWORD grfBSCF,
1790         DWORD dwSize, FORMATETC* pformatetc, STGMEDIUM* pstgmed)
1791 {
1792     InstallCallback *This = impl_from_IBindStatusCallback(iface);
1793     ERR("(%p)\n", This);
1794     return E_NOTIMPL;
1795 }
1796
1797 static HRESULT WINAPI InstallCallback_OnObjectAvailable(IBindStatusCallback *iface,
1798         REFIID riid, IUnknown* punk)
1799 {
1800     InstallCallback *This = impl_from_IBindStatusCallback(iface);
1801     ERR("(%p)\n", This);
1802     return E_NOTIMPL;
1803 }
1804
1805 static IBindStatusCallbackVtbl InstallCallbackVtbl = {
1806     InstallCallback_QueryInterface,
1807     InstallCallback_AddRef,
1808     InstallCallback_Release,
1809     InstallCallback_OnStartBinding,
1810     InstallCallback_GetPriority,
1811     InstallCallback_OnLowResource,
1812     InstallCallback_OnProgress,
1813     InstallCallback_OnStopBinding,
1814     InstallCallback_GetBindInfo,
1815     InstallCallback_OnDataAvailable,
1816     InstallCallback_OnObjectAvailable
1817 };
1818
1819 static inline InstallCallback *impl_from_IWindowForBindingUI(IWindowForBindingUI *iface)
1820 {
1821     return CONTAINING_RECORD(iface, InstallCallback, IWindowForBindingUI_iface);
1822 }
1823
1824 static HRESULT WINAPI WindowForBindingUI_QueryInterface(IWindowForBindingUI *iface, REFIID riid, void **ppv)
1825 {
1826     InstallCallback *This = impl_from_IWindowForBindingUI(iface);
1827     return IBindStatusCallback_QueryInterface(&This->IBindStatusCallback_iface, riid, ppv);
1828 }
1829
1830 static ULONG WINAPI WindowForBindingUI_AddRef(IWindowForBindingUI *iface)
1831 {
1832     InstallCallback *This = impl_from_IWindowForBindingUI(iface);
1833     return IBindStatusCallback_AddRef(&This->IBindStatusCallback_iface);
1834 }
1835
1836 static ULONG WINAPI WindowForBindingUI_Release(IWindowForBindingUI *iface)
1837 {
1838     InstallCallback *This = impl_from_IWindowForBindingUI(iface);
1839     return IBindStatusCallback_Release(&This->IBindStatusCallback_iface);
1840 }
1841
1842 static HRESULT WINAPI WindowForBindingUI_GetWindow(IWindowForBindingUI *iface, REFGUID rguidReason, HWND *phwnd)
1843 {
1844     InstallCallback *This = impl_from_IWindowForBindingUI(iface);
1845     FIXME("(%p)->(%s %p)\n", This, debugstr_guid(rguidReason), phwnd);
1846     *phwnd = NULL;
1847     return S_OK;
1848 }
1849
1850 static const IWindowForBindingUIVtbl WindowForBindingUIVtbl = {
1851     WindowForBindingUI_QueryInterface,
1852     WindowForBindingUI_AddRef,
1853     WindowForBindingUI_Release,
1854     WindowForBindingUI_GetWindow
1855 };
1856
1857 typedef struct {
1858     struct list entry;
1859     IUri *uri;
1860 } install_entry_t;
1861
1862 static struct list install_list = LIST_INIT(install_list);
1863
1864 static CRITICAL_SECTION cs_install_list;
1865 static CRITICAL_SECTION_DEBUG cs_install_list_dbg =
1866 {
1867     0, 0, &cs_install_list,
1868     { &cs_install_list_dbg.ProcessLocksList, &cs_install_list_dbg.ProcessLocksList },
1869       0, 0, { (DWORD_PTR)(__FILE__ ": install_list") }
1870 };
1871 static CRITICAL_SECTION cs_install_list = { &cs_install_list_dbg, -1, 0, 0, 0, 0 };
1872
1873 static void install_codebase(const WCHAR *url)
1874 {
1875     InstallCallback *callback;
1876     IBindCtx *bctx;
1877     HRESULT hres;
1878
1879     callback = heap_alloc(sizeof(*callback));
1880     if(!callback)
1881         return;
1882
1883     callback->IBindStatusCallback_iface.lpVtbl = &InstallCallbackVtbl;
1884     callback->IWindowForBindingUI_iface.lpVtbl = &WindowForBindingUIVtbl;
1885     callback->ref = 1;
1886
1887     hres = CreateAsyncBindCtx(0, &callback->IBindStatusCallback_iface, NULL, &bctx);
1888     IBindStatusCallback_Release(&callback->IBindStatusCallback_iface);
1889     if(FAILED(hres))
1890         return;
1891
1892     hres = AsyncInstallDistributionUnit(NULL, NULL, NULL, 0, 0, url, bctx, NULL, 0);
1893     IBindCtx_Release(bctx);
1894     if(FAILED(hres))
1895         WARN("FAILED: %08x\n", hres);
1896 }
1897
1898 static void check_codebase(HTMLInnerWindow *window, nsIDOMHTMLElement *nselem)
1899 {
1900     BOOL is_on_list = FALSE;
1901     install_entry_t *iter;
1902     const PRUnichar *val;
1903     nsAString val_str;
1904     IUri *uri = NULL;
1905     nsresult nsres;
1906     HRESULT hres;
1907
1908     static const PRUnichar codebaseW[] = {'c','o','d','e','b','a','s','e',0};
1909
1910     nsres = get_elem_attr_value(nselem, codebaseW, &val_str, &val);
1911     if(NS_SUCCEEDED(nsres)) {
1912         if(*val) {
1913             hres = CoInternetCombineUrlEx(window->base.outer_window->uri, val, 0, &uri, 0);
1914             if(FAILED(hres))
1915                 uri = NULL;
1916         }
1917         nsAString_Finish(&val_str);
1918     }
1919
1920     if(!uri)
1921         return;
1922
1923     EnterCriticalSection(&cs_install_list);
1924
1925     LIST_FOR_EACH_ENTRY(iter, &install_list, install_entry_t, entry) {
1926         BOOL eq;
1927
1928         hres = IUri_IsEqual(uri, iter->uri, &eq);
1929         if(SUCCEEDED(hres) && eq) {
1930             TRACE("already proceeded\n");
1931             is_on_list = TRUE;
1932             break;
1933         }
1934     }
1935
1936     if(!is_on_list) {
1937         iter = heap_alloc(sizeof(*iter));
1938         if(iter) {
1939             IUri_AddRef(uri);
1940             iter->uri = uri;
1941
1942             list_add_tail(&install_list, &iter->entry);
1943         }
1944     }
1945
1946     LeaveCriticalSection(&cs_install_list);
1947
1948     if(!is_on_list) {
1949         BSTR display_uri;
1950
1951         hres = IUri_GetDisplayUri(uri, &display_uri);
1952         if(SUCCEEDED(hres)) {
1953             install_codebase(display_uri);
1954             SysFreeString(display_uri);
1955         }
1956     }
1957
1958     IUri_Release(uri);
1959 }
1960
1961 static IUnknown *create_activex_object(HTMLDocumentNode *doc, nsIDOMHTMLElement *nselem, CLSID *clsid)
1962 {
1963     IClassFactoryEx *cfex;
1964     IClassFactory *cf;
1965     IUnknown *obj;
1966     DWORD policy;
1967     HRESULT hres;
1968
1969     if(!get_elem_clsid(nselem, clsid)) {
1970         WARN("Could not determine element CLSID\n");
1971         return NULL;
1972     }
1973
1974     TRACE("clsid %s\n", debugstr_guid(clsid));
1975
1976     policy = 0;
1977     hres = IInternetHostSecurityManager_ProcessUrlAction(&doc->IInternetHostSecurityManager_iface,
1978             URLACTION_ACTIVEX_RUN, (BYTE*)&policy, sizeof(policy), (BYTE*)clsid, sizeof(GUID), 0, 0);
1979     if(FAILED(hres) || policy != URLPOLICY_ALLOW) {
1980         WARN("ProcessUrlAction returned %08x %x\n", hres, policy);
1981         return NULL;
1982     }
1983
1984     hres = CoGetClassObject(clsid, CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER, NULL, &IID_IClassFactory, (void**)&cf);
1985     if(hres == REGDB_E_CLASSNOTREG)
1986         check_codebase(doc->window, nselem);
1987     if(FAILED(hres))
1988         return NULL;
1989
1990     hres = IClassFactory_QueryInterface(cf, &IID_IClassFactoryEx, (void**)&cfex);
1991     if(SUCCEEDED(hres)) {
1992         FIXME("Use IClassFactoryEx\n");
1993         IClassFactoryEx_Release(cfex);
1994     }
1995
1996     hres = IClassFactory_CreateInstance(cf, NULL, &IID_IUnknown, (void**)&obj);
1997     IClassFactory_Release(cf);
1998     if(FAILED(hres))
1999         return NULL;
2000
2001     return obj;
2002 }
2003
2004 void detach_plugin_host(PluginHost *host)
2005 {
2006     HRESULT hres;
2007
2008     TRACE("%p\n", host);
2009
2010     if(!host->doc)
2011         return;
2012
2013     if(host->ip_object) {
2014         if(host->ui_active)
2015             IOleInPlaceObject_UIDeactivate(host->ip_object);
2016         IOleInPlaceObject_InPlaceDeactivate(host->ip_object);
2017     }
2018
2019     if(host->plugin_unk) {
2020         IOleObject *ole_obj;
2021
2022         hres = IUnknown_QueryInterface(host->plugin_unk, &IID_IOleObject, (void**)&ole_obj);
2023         if(SUCCEEDED(hres)) {
2024             if(!host->ip_object)
2025                 IOleObject_Close(ole_obj, OLECLOSE_NOSAVE);
2026             IOleObject_SetClientSite(ole_obj, NULL);
2027             IOleObject_Release(ole_obj);
2028         }
2029     }
2030
2031     if(host->sink) {
2032         IConnectionPointContainer *cp_container;
2033         IConnectionPoint *cp;
2034
2035         assert(host->plugin_unk != NULL);
2036
2037         hres = IUnknown_QueryInterface(host->plugin_unk, &IID_IConnectionPointContainer, (void**)&cp_container);
2038         if(SUCCEEDED(hres)) {
2039             hres = IConnectionPointContainer_FindConnectionPoint(cp_container, &host->sink->iid, &cp);
2040             IConnectionPointContainer_Release(cp_container);
2041             if(SUCCEEDED(hres)) {
2042                 IConnectionPoint_Unadvise(cp, host->sink->cookie);
2043                 IConnectionPoint_Release(cp);
2044             }
2045         }
2046
2047         host->sink->host = NULL;
2048         IDispatch_Release(&host->sink->IDispatch_iface);
2049         host->sink = NULL;
2050     }
2051
2052     release_plugin_ifaces(host);
2053
2054     if(host->element) {
2055         host->element->plugin_host = NULL;
2056         host->element = NULL;
2057     }
2058
2059     list_remove(&host->entry);
2060     list_init(&host->entry);
2061     host->doc = NULL;
2062 }
2063
2064 HRESULT create_plugin_host(HTMLDocumentNode *doc, HTMLPluginContainer *container)
2065 {
2066     PluginHost *host;
2067     IUnknown *unk;
2068     CLSID clsid;
2069
2070     assert(!container->plugin_host);
2071
2072     unk = create_activex_object(doc, container->element.nselem, &clsid);
2073     if(!unk)
2074         return E_FAIL;
2075
2076     host = heap_alloc_zero(sizeof(*host));
2077     if(!host) {
2078         IUnknown_Release(unk);
2079         return E_OUTOFMEMORY;
2080     }
2081
2082     host->IOleClientSite_iface.lpVtbl      = &OleClientSiteVtbl;
2083     host->IAdviseSinkEx_iface.lpVtbl       = &AdviseSinkExVtbl;
2084     host->IPropertyNotifySink_iface.lpVtbl = &PropertyNotifySinkVtbl;
2085     host->IDispatch_iface.lpVtbl           = &DispatchVtbl;
2086     host->IOleInPlaceSiteEx_iface.lpVtbl   = &OleInPlaceSiteExVtbl;
2087     host->IOleControlSite_iface.lpVtbl     = &OleControlSiteVtbl;
2088     host->IBindHost_iface.lpVtbl           = &BindHostVtbl;
2089     host->IServiceProvider_iface.lpVtbl    = &ServiceProviderVtbl;
2090
2091     host->ref = 1;
2092
2093     host->plugin_unk = unk;
2094     host->clsid = clsid;
2095
2096     host->doc = doc;
2097     list_add_tail(&doc->plugin_hosts, &host->entry);
2098
2099     container->plugin_host = host;
2100     host->element = container;
2101
2102     initialize_plugin_object(host);
2103
2104     return S_OK;
2105 }