Add a lock to the managed user settings page and require authentication for unlocking.

chrome/browser/managed_mode/managed_user_service.cc

 // Copyright (c) 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/managed_mode/managed_user_service.h"
 
 #include "base/memory/ref_counted.h"
 #include "base/sequenced_task_runner.h"
 #include "chrome/browser/extensions/extension_service.h"
 #include "chrome/browser/extensions/extension_system.h"
@@ skipping 87 matching lines @@
   Init();
 }
 
 ManagedUserService::~ManagedUserService() {
 }
 
 bool ManagedUserService::ProfileIsManaged() const {
   return profile_->GetPrefs()->GetBoolean(prefs::kProfileIsManaged);
 }
 
+bool ManagedUserService::IsElevated() const {
+  PrefService* pref_service = profile_->GetPrefs();
+  // If there is no passphrase set, the profile is considered to be elevated.
+  if (pref_service->GetString(prefs::kManagedModeLocalPassphrase).empty())
+    return true;
+  return is_elevated_;
+}
+
 // static
 void ManagedUserService::RegisterUserPrefs(PrefServiceSyncable* prefs) {
   prefs->RegisterListPref(prefs::kManagedModeWhitelist,
                           PrefServiceSyncable::UNSYNCABLE_PREF);
   prefs->RegisterListPref(prefs::kManagedModeBlacklist,
                           PrefServiceSyncable::UNSYNCABLE_PREF);
   prefs->RegisterIntegerPref(prefs::kDefaultManagedModeFilteringBehavior,
                              ManagedModeURLFilter::BLOCK,
                              PrefServiceSyncable::UNSYNCABLE_PREF);
+  prefs->RegisterStringPref(prefs::kManagedModeLocalPassphrase,
+                            "",
+                            PrefServiceSyncable::UNSYNCABLE_PREF);
+  prefs->RegisterStringPref(prefs::kManagedModeLocalSalt,
+                            "",
+                            PrefServiceSyncable::UNSYNCABLE_PREF);
+  prefs->RegisterBooleanPref(prefs::kManagedModeLocked,

[Pam (message me for reviews), 2013/01/28 13:53:27]

What's the difference between locked == false and passphrase == ""?

[Adrian Kuegel, 2013/01/28 15:41:44]

Logically there is no difference, it would have just made the sync easier when
displaying the settings page. Anyway, after some thoughts I decided to remove
this preference again and do manual syncing with a callback function. There was
a callback function in place anyway which checks if the passphrase is set, so I
only had to modify it slightly.

+                             false,
+                             PrefServiceSyncable::UNSYNCABLE_PREF);
 }
 
 scoped_refptr<const ManagedModeURLFilter>
 ManagedUserService::GetURLFilterForIOThread() {
   return url_filter_context_.io_url_filter();
 }
 
 ManagedModeURLFilter* ManagedUserService::GetURLFilterForUIThread() {
   return url_filter_context_.ui_url_filter();
 }
@@ skipping 175 matching lines @@
 }
 
 void ManagedUserService::UpdateSiteLists() {
   url_filter_context_.LoadWhitelists(GetActiveSiteLists());
 }
 
 void ManagedUserService::UpdateManualLists() {
   url_filter_context_.SetManualLists(GetWhitelist(), GetBlacklist());
 }
 
-void ManagedUserService::SetElevatedForTesting(bool is_elevated) {
+void ManagedUserService::SetElevated(bool is_elevated) {
   is_elevated_ = is_elevated;
 }
 
 void ManagedUserService::Init() {
   if (!ProfileIsManaged())
     return;
 
   extensions::ExtensionSystem* extension_system =
       extensions::ExtensionSystem::Get(profile_);
   extensions::ManagementPolicy* management_policy =
@@ skipping 21 matching lines @@
 scoped_ptr<base::ListValue> ManagedUserService::GetWhitelist() {
   return make_scoped_ptr(
       profile_->GetPrefs()->GetList(prefs::kManagedModeWhitelist)->DeepCopy());
 }
 
 void ManagedUserService::AddURLPatternToManualList(
     bool is_whitelist,
     const std::string& url_pattern) {
   url_filter_context_.AddURLPatternToManualList(true, url_pattern);
 }