Extension white and force lists (set by policy) should have priority over auto-updated Google black…

chrome/browser/extensions/admin_policy.cc

Index: chrome/browser/extensions/admin_policy.cc
diff --git a/chrome/browser/extensions/admin_policy.cc b/chrome/browser/extensions/admin_policy.cc
index 8ec3f53100a87f82d9e79c0c7d77e17bf5a19f9f..c25e31bc685911640ea9c7688759110c5993863e 100644
--- a/chrome/browser/extensions/admin_policy.cc
+++ b/chrome/browser/extensions/admin_policy.cc
@@ -41,24 +41,29 @@ bool BlacklistedByDefault(const base::ListValue* blacklist) {
   return blacklist && blacklist->Find(wildcard) != blacklist->end();
 }
 
-bool UserMayLoad(const base::ListValue* blacklist,
+bool UserMayLoad(bool is_google_blacklisted,
+                 const base::ListValue* blacklist,
                  const base::ListValue* whitelist,
+                 const base::ListValue* forcelist,
                  const Extension* extension,
                  string16* error) {
   if (IsRequired(extension))
     return true;
 
-  if (!blacklist || blacklist->empty())
+  if ((!blacklist || blacklist->empty()) && !is_google_blacklisted)
     return true;
 
-  // Check the whitelist first.
+  // Check the whitelist/forcelist first (takes precedence over Google
+  // blacklist).
   base::StringValue id_value(extension->id());
-  if (whitelist && whitelist->Find(id_value) != whitelist->end())
+  if ((whitelist && whitelist->Find(id_value) != whitelist->end()) ||
+      (forcelist && forcelist->Find(id_value) != forcelist->end()))
     return true;
 
-  // Then check the blacklist (the admin blacklist, not the Google blacklist).
-  bool result = blacklist->Find(id_value) == blacklist->end() &&
-      !BlacklistedByDefault(blacklist);
+  // Then check both admin and Google blacklists.
+  bool result = !is_google_blacklisted &&
+                (!blacklist || blacklist->Find(id_value) == blacklist->end()) &&

[qfel, 2012/08/13 16:03:02]

Checking for NULL blacklist is redundant here, but it's not very clear at the
first sight so I'm leaving it here.

+                !BlacklistedByDefault(blacklist);
   if (error && !result) {
     *error = l10n_util::GetStringFUTF16(
           IDS_EXTENSION_CANT_INSTALL_POLICY_BLACKLIST,