From 755c12d42b973da1887b7520908e2c91c4fb3db8 Mon Sep 17 00:00:00 2001 From: treib Date: Mon, 30 Mar 2015 01:46:25 -0700 Subject: [PATCH] SupervisedUserService: Implement UserMayModifySettings again. Turns out this does NOT prevent disabling an extension on permission increase. It does however prevent supervised users from re-enabling extensions. Before, they could e.g. by fiddling with the inspector on about:extensions. BUG=397951 Review URL: https://codereview.chromium.org/1039183002 Cr-Commit-Position: refs/heads/master@{#322754} --- chrome/browser/resources/extensions/extension_list.js | 9 ++++++++- chrome/browser/supervised_user/supervised_user_service.cc | 11 +++++++++++ chrome/browser/supervised_user/supervised_user_service.h | 2 ++ 3 files changed, 21 insertions(+), 1 deletion(-) diff --git a/chrome/browser/resources/extensions/extension_list.js b/chrome/browser/resources/extensions/extension_list.js index 70fbb2f08a46..15832f38b4e0 100644 --- a/chrome/browser/resources/extensions/extension_list.js +++ b/chrome/browser/resources/extensions/extension_list.js @@ -678,7 +678,14 @@ cr.define('extensions', function() { var controlNode = row.querySelector('.enable-controls'); var indicator = controlNode.querySelector('.controlled-extension-indicator'); - var needsIndicator = isOK && !extension.userMayModify; + var needsIndicator = isOK && + !extension.userMayModify && + extension.policyText; + // TODO(treib): If userMayModify is false, but policyText is empty, that + // indicates this extension is controlled by something else than + // enterprise policy (such as the profile being supervised). For now, just + // don't show the indicator in this case. We should really handle this + // better though (ie use a different text and icon). if (needsIndicator && !indicator) { indicator = new cr.ui.ControlledIndicator(); diff --git a/chrome/browser/supervised_user/supervised_user_service.cc b/chrome/browser/supervised_user/supervised_user_service.cc index d99f1daa5e8d..440fa1cc8fd6 100644 --- a/chrome/browser/supervised_user/supervised_user_service.cc +++ b/chrome/browser/supervised_user/supervised_user_service.cc @@ -504,6 +504,17 @@ bool SupervisedUserService::UserMayLoad(const extensions::Extension* extension, return may_load; } +bool SupervisedUserService::UserMayModifySettings( + const extensions::Extension* extension, + base::string16* error) const { + DCHECK(ProfileIsSupervised()); + ExtensionState result = GetExtensionState(extension); + bool may_modify = (result == EXTENSION_ALLOWED); + if (!may_modify && error) + *error = l10n_util::GetStringUTF16(IDS_EXTENSIONS_LOCKED_SUPERVISED_USER); + return may_modify; +} + // Note: Having MustRemainInstalled always say "true" for custodian-installed // extensions does NOT prevent remote uninstalls (which is a bit unexpected, but // exactly what we want). diff --git a/chrome/browser/supervised_user/supervised_user_service.h b/chrome/browser/supervised_user/supervised_user_service.h index 08ada0662e2b..fb8a54e39cba 100644 --- a/chrome/browser/supervised_user/supervised_user_service.h +++ b/chrome/browser/supervised_user/supervised_user_service.h @@ -264,6 +264,8 @@ class SupervisedUserService : public KeyedService, std::string GetDebugPolicyProviderName() const override; bool UserMayLoad(const extensions::Extension* extension, base::string16* error) const override; + bool UserMayModifySettings(const extensions::Extension* extension, + base::string16* error) const override; bool MustRemainInstalled(const extensions::Extension* extension, base::string16* error) const override; -- 2.11.4.GIT