Add a lock to the managed user settings page and require authentication for unlocking.

chrome/browser/managed_mode/managed_user_service.cc

Index: chrome/browser/managed_mode/managed_user_service.cc
diff --git a/chrome/browser/managed_mode/managed_user_service.cc b/chrome/browser/managed_mode/managed_user_service.cc
index 8fbc39a4c301063635e27ee5577a142d26fb80a7..7b1af12d34ff67167f7edee44d6b685034ad632c 100644
--- a/chrome/browser/managed_mode/managed_user_service.cc
+++ b/chrome/browser/managed_mode/managed_user_service.cc
@@ -105,6 +105,14 @@ bool ManagedUserService::ProfileIsManaged() const {
   return profile_->GetPrefs()->GetBoolean(prefs::kProfileIsManaged);
 }
 
+bool ManagedUserService::IsElevated() const {
+  PrefService* pref_service = profile_->GetPrefs();
+  // If there is no passphrase set, the profile is considered to be elevated.
+  if (pref_service->GetString(prefs::kManagedModeLocalPassphrase).empty())
+    return true;
+  return is_elevated_;
+}
+
 // static
 void ManagedUserService::RegisterUserPrefs(PrefServiceSyncable* prefs) {
   prefs->RegisterListPref(prefs::kManagedModeWhitelist,
@@ -114,6 +122,12 @@ void ManagedUserService::RegisterUserPrefs(PrefServiceSyncable* prefs) {
   prefs->RegisterIntegerPref(prefs::kDefaultManagedModeFilteringBehavior,
                              ManagedModeURLFilter::BLOCK,
                              PrefServiceSyncable::UNSYNCABLE_PREF);
+  prefs->RegisterStringPref(prefs::kManagedModeLocalPassphrase,
+                            "",
+                            PrefServiceSyncable::UNSYNCABLE_PREF);
+  prefs->RegisterStringPref(prefs::kManagedModeLocalSalt,
+                            "",
+                            PrefServiceSyncable::UNSYNCABLE_PREF);
 }
 
 scoped_refptr<const ManagedModeURLFilter>
@@ -309,7 +323,7 @@ void ManagedUserService::UpdateManualLists() {
   url_filter_context_.SetManualLists(GetWhitelist(), GetBlacklist());
 }
 
-void ManagedUserService::SetElevatedForTesting(bool is_elevated) {
+void ManagedUserService::SetElevated(bool is_elevated) {
   is_elevated_ = is_elevated;
 }