Add a lock to the managed user settings page and require authentication for unlocking.

chrome/browser/managed_mode/managed_user_service.cc

Index: chrome/browser/managed_mode/managed_user_service.cc
diff --git a/chrome/browser/managed_mode/managed_user_service.cc b/chrome/browser/managed_mode/managed_user_service.cc
index 8fbc39a4c301063635e27ee5577a142d26fb80a7..10ec8f035b7f29bb85d5b3f3dc8c63c69f3973ec 100644
--- a/chrome/browser/managed_mode/managed_user_service.cc
+++ b/chrome/browser/managed_mode/managed_user_service.cc
@@ -105,6 +105,14 @@ bool ManagedUserService::ProfileIsManaged() const {
   return profile_->GetPrefs()->GetBoolean(prefs::kProfileIsManaged);
 }
 
+bool ManagedUserService::IsElevated() const {
+  PrefService* pref_service = profile_->GetPrefs();
+  // If there is no passphrase set, the profile is considered to be elevated.
+  if (pref_service->GetString(prefs::kManagedModeLocalPassphrase).empty())
+    return true;
+  return is_elevated_;
+}
+
 // static
 void ManagedUserService::RegisterUserPrefs(PrefServiceSyncable* prefs) {
   prefs->RegisterListPref(prefs::kManagedModeWhitelist,
@@ -114,6 +122,15 @@ void ManagedUserService::RegisterUserPrefs(PrefServiceSyncable* prefs) {
   prefs->RegisterIntegerPref(prefs::kDefaultManagedModeFilteringBehavior,
                              ManagedModeURLFilter::BLOCK,
                              PrefServiceSyncable::UNSYNCABLE_PREF);
+  prefs->RegisterStringPref(prefs::kManagedModeLocalPassphrase,
+                            "",
+                            PrefServiceSyncable::UNSYNCABLE_PREF);
+  prefs->RegisterStringPref(prefs::kManagedModeLocalSalt,
+                            "",
+                            PrefServiceSyncable::UNSYNCABLE_PREF);
+  prefs->RegisterBooleanPref(prefs::kManagedModeLocked,

[Pam (message me for reviews), 2013/01/28 13:53:27]

What's the difference between locked == false and passphrase == ""?

[Adrian Kuegel, 2013/01/28 15:41:44]

Logically there is no difference, it would have just made the sync easier when
displaying the settings page. Anyway, after some thoughts I decided to remove
this preference again and do manual syncing with a callback function. There was
a callback function in place anyway which checks if the passphrase is set, so I
only had to modify it slightly.

+                             false,
+                             PrefServiceSyncable::UNSYNCABLE_PREF);
 }
 
 scoped_refptr<const ManagedModeURLFilter>
@@ -309,7 +326,7 @@ void ManagedUserService::UpdateManualLists() {
   url_filter_context_.SetManualLists(GetWhitelist(), GetBlacklist());
 }
 
-void ManagedUserService::SetElevatedForTesting(bool is_elevated) {
+void ManagedUserService::SetElevated(bool is_elevated) {
   is_elevated_ = is_elevated;
 }