Disable certificate patterns for device policy ONC files

chrome/browser/chromeos/cros/onc_network_parser.cc

Index: chrome/browser/chromeos/cros/onc_network_parser.cc
diff --git a/chrome/browser/chromeos/cros/onc_network_parser.cc b/chrome/browser/chromeos/cros/onc_network_parser.cc
index 8814d0cb3d1dddf57500882a572486c78d74a33e..0453cbbd0bb8badf13ae041cbec3b1106ada2201 100644
--- a/chrome/browser/chromeos/cros/onc_network_parser.cc
+++ b/chrome/browser/chromeos/cros/onc_network_parser.cc
@@ -1374,10 +1374,15 @@ bool OncNetworkParser::ParseClientCertPattern(OncNetworkParser* parser,
     return false;
   }
 
+  // Below, we fail when parsing certificate patterns for device policy ONC so
+  // that an unmanaged user can't get to the place where a cert is presented for
+  // them involuntarily.
+
   switch (index) {
     case PROPERTY_INDEX_ONC_CERTIFICATE_PATTERN_ENROLLMENT_URI: {
       std::vector<std::string> resulting_list;
-      if (!GetAsListOfStrings(value, &resulting_list))
+      if (!GetAsListOfStrings(value, &resulting_list) ||
+          parser->onc_source() == NetworkUIData::ONC_SOURCE_DEVICE_POLICY)

[Mattias Nissler (ping if slow), 2012/08/28 11:38:09]

nit: Other code in this file seems to add curly braces for the
two-line-conditional, single-line-body case. Same below.

[Greg Spencer (Chromium), 2012/09/17 18:25:44]

Done.

         return false;
       CertificatePattern pattern = network->client_cert_pattern();
       pattern.set_enrollment_uri_list(resulting_list);
@@ -1386,7 +1391,8 @@ bool OncNetworkParser::ParseClientCertPattern(OncNetworkParser* parser,
     }
     case PROPERTY_INDEX_ONC_CERTIFICATE_PATTERN_ISSUER_CA_REF: {
       std::vector<std::string> resulting_list;
-      if (!GetAsListOfStrings(value, &resulting_list))
+      if (!GetAsListOfStrings(value, &resulting_list) ||
+          parser->onc_source() == NetworkUIData::ONC_SOURCE_DEVICE_POLICY)
         return false;
       CertificatePattern pattern = network->client_cert_pattern();
       pattern.set_issuer_ca_ref_list(resulting_list);
@@ -1417,7 +1423,8 @@ bool OncNetworkParser::ParseIssuerPattern(OncNetworkParser* parser,
                                           const base::Value& value,
                                           Network* network) {
   IssuerSubjectPattern pattern;
-  if (ParseIssuerSubjectPattern(&pattern, parser, index, value, network)) {
+  if (ParseIssuerSubjectPattern(&pattern, parser, index, value, network) &&
+      parser->onc_source() != NetworkUIData::ONC_SOURCE_DEVICE_POLICY) {
     CertificatePattern cert_pattern = network->client_cert_pattern();
     cert_pattern.set_issuer(pattern);
     network->set_client_cert_pattern(cert_pattern);
@@ -1432,7 +1439,8 @@ bool OncNetworkParser::ParseSubjectPattern(OncNetworkParser* parser,
                                            const base::Value& value,
                                            Network* network) {
   IssuerSubjectPattern pattern;
-  if (ParseIssuerSubjectPattern(&pattern, parser, index, value, network)) {
+  if (ParseIssuerSubjectPattern(&pattern, parser, index, value, network) &&
+      parser->onc_source() != NetworkUIData::ONC_SOURCE_DEVICE_POLICY) {
     CertificatePattern cert_pattern = network->client_cert_pattern();
     cert_pattern.set_subject(pattern);
     network->set_client_cert_pattern(cert_pattern);