Add a lock to the managed user settings page and require authentication for unlocking.

chrome/browser/resources/options/manage_profile_overlay.js

Index: chrome/browser/resources/options/manage_profile_overlay.js
diff --git a/chrome/browser/resources/options/manage_profile_overlay.js b/chrome/browser/resources/options/manage_profile_overlay.js
index 6e68ef41b0742470a821c3d76039afaf8eac2ced..6a6163f450a46b73c069b0e22b37f31f6a47fb8a 100644
--- a/chrome/browser/resources/options/manage_profile_overlay.js
+++ b/chrome/browser/resources/options/manage_profile_overlay.js
@@ -61,7 +61,8 @@ cr.define('options', function() {
       if (loadTimeData.getBoolean('managedUsersEnabled')) {
         $('create-profile-managed-container').hidden = false;
         $('managed-user-settings-button').onclick = function(event) {
-          OptionsPage.navigateToPage('managedUser');
+          chrome.send('displayPassphraseDialog',
+              ['ManageProfileOverlay.showManagedUserSettingsDialog']);

[Bernhard Bauer, 2013/01/07 14:20:22]

If our code gets more complicated, we might need to change the API so we can
pass in arbitrary closures, but right now that's probably not necessary.

           chrome.send('coreOptionsUserMetricsAction',
                       ['Options_ManagedUserPassphraseOverlay']);
         };
@@ -322,6 +323,15 @@ cr.define('options', function() {
     showCreateDialog_: function() {
       OptionsPage.navigateToPage('createProfile');
     },
+    /** Display the "Managed User Settings" dialog.
+     * This method is only called if the entered password is correct.
+     * @private
+     */
+    showManagedUserSettingsDialog_: function() {
+      OptionsPage.navigateToPage('managedUser');

[Pam (message me for reviews), 2013/01/07 14:51:49]

Hm, do we in any way prevent a user from just navigating there directly, by
typing in the options URL?

[Bernhard Bauer, 2013/01/08 17:43:14]

Either that, or ignore any commands that get sent from there unless the user has
successfully authenticated (so we need to keep some state for that). I think
that would be a bit more robust.

+      chrome.send('coreOptionsUserMetricsAction',
+          ['Options_FamilyControlSettings']);
+    },
   };
 
   // Forward public APIs to private implementations.
@@ -334,6 +344,7 @@ cr.define('options', function() {
     'showManageDialog',
     'showDeleteDialog',
     'showCreateDialog',
+    'showManagedUserSettingsDialog',
   ].forEach(function(name) {
     ManageProfileOverlay[name] = function() {
       var instance = ManageProfileOverlay.getInstance();