Add a lock to the managed user settings page and require authentication for unlocking.

chrome/browser/resources/options/manage_profile_overlay.js

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 cr.define('options', function() {
   var OptionsPage = options.OptionsPage;
   var ArrayDataModel = cr.ui.ArrayDataModel;
 
   /**
    * ManageProfileOverlay class
@@ skipping 43 matching lines @@
 
       $('manage-profile-name').oninput = function(event) {
         self.onNameChanged_(event, 'manage');
       };
       $('create-profile-name').oninput = function(event) {
         self.onNameChanged_(event, 'create');
       };
       if (loadTimeData.getBoolean('managedUsersEnabled')) {
         $('create-profile-managed-container').hidden = false;
         $('managed-user-settings-button').onclick = function(event) {
-          OptionsPage.navigateToPage('managedUser');
+          chrome.send('displayPassphraseDialog',
+              ['ManageProfileOverlay.showManagedUserSettingsDialog']);

[Bernhard Bauer, 2013/01/07 14:20:22]

If our code gets more complicated, we might need to change the API so we can
pass in arbitrary closures, but right now that's probably not necessary.

           chrome.send('coreOptionsUserMetricsAction',
                       ['Options_ManagedUserPassphraseOverlay']);
         };
       }
       $('manage-profile-cancel').onclick =
           $('delete-profile-cancel').onclick =
               $('create-profile-cancel').onclick = function(event) {
         OptionsPage.closeOverlay();
       };
       $('manage-profile-ok').onclick = function(event) {
@@ skipping 240 matching lines @@
       OptionsPage.showPageByName('manageProfile', false);
     },
 
     /**
      * Display the "Create Profile" dialog.
      * @private
      */
     showCreateDialog_: function() {
       OptionsPage.navigateToPage('createProfile');
     },
+    /** Display the "Managed User Settings" dialog.
+     * This method is only called if the entered password is correct.
+     * @private
+     */
+    showManagedUserSettingsDialog_: function() {
+      OptionsPage.navigateToPage('managedUser');

[Pam (message me for reviews), 2013/01/07 14:51:49]

Hm, do we in any way prevent a user from just navigating there directly, by
typing in the options URL?

[Bernhard Bauer, 2013/01/08 17:43:14]

Either that, or ignore any commands that get sent from there unless the user has
successfully authenticated (so we need to keep some state for that). I think
that would be a bit more robust.

+      chrome.send('coreOptionsUserMetricsAction',
+          ['Options_FamilyControlSettings']);
+    },
   };
 
   // Forward public APIs to private implementations.
   [
     'receiveDefaultProfileIcons',
     'receiveNewProfileDefaults',
     'receiveProfileNames',
     'setProfileInfo',
     'setProfileName',
     'showManageDialog',
     'showDeleteDialog',
     'showCreateDialog',
+    'showManagedUserSettingsDialog',
   ].forEach(function(name) {
     ManageProfileOverlay[name] = function() {
       var instance = ManageProfileOverlay.getInstance();
       return instance[name + '_'].apply(instance, arguments);
     };
   });
 
   function CreateProfileOverlay() {
     OptionsPage.call(this, 'createProfile',
                      loadTimeData.getString('createProfileTabTitle'),
@@ skipping 28 matching lines @@
       $('create-profile-ok').disabled = true;
     },
   };
 
   // Export
   return {
     ManageProfileOverlay: ManageProfileOverlay,
     CreateProfileOverlay: CreateProfileOverlay,
   };
 });