Enable WebContents elevation for managed users.

chrome/browser/ui/webui/extensions/extension_settings_handler.cc

Index: chrome/browser/ui/webui/extensions/extension_settings_handler.cc
diff --git a/chrome/browser/ui/webui/extensions/extension_settings_handler.cc b/chrome/browser/ui/webui/extensions/extension_settings_handler.cc
index 5ce90be5cd8826e0b280b042bc3db7aa9621f7d0..cc814108fa15c9d4c998ef4abe4cf655f94fe284 100644
--- a/chrome/browser/ui/webui/extensions/extension_settings_handler.cc
+++ b/chrome/browser/ui/webui/extensions/extension_settings_handler.cc
@@ -32,6 +32,7 @@
 #include "chrome/browser/extensions/unpacked_installer.h"
 #include "chrome/browser/extensions/updater/extension_updater.h"
 #include "chrome/browser/google/google_util.h"
+#include "chrome/browser/managed_mode/managed_mode_navigation_observer.h"
 #include "chrome/browser/managed_mode/managed_user_service.h"
 #include "chrome/browser/managed_mode/managed_user_service_factory.h"
 #include "chrome/browser/profiles/profile.h"
@@ -131,7 +132,7 @@ DictionaryValue* ExtensionSettingsHandler::CreateExtensionDetailValue(
   extension->GetBasicInfo(enabled, extension_data);
 
   extension_data->SetBoolean("userModifiable",
-      management_policy_->UserMayModifySettings(extension, NULL));
+      CheckUserMayModifySettings(extension));
 
   GURL icon =
       ExtensionIconSource::GetIconURL(extension,
@@ -554,8 +555,10 @@ void ExtensionSettingsHandler::ReloadUnpackedExtensions() {
 void ExtensionSettingsHandler::PassphraseDialogCallback(bool success) {
   if (!success)
     return;
-  Profile* profile = Profile::FromWebUI(web_ui());
-  ManagedUserServiceFactory::GetForProfile(profile)->SetElevated(true);
+  ManagedModeNavigationObserver* observer =
+      ManagedModeNavigationObserver::FromWebContents(
+          web_ui()->GetWebContents());
+  observer->set_elevated(true);
   HandleRequestExtensionsData(NULL);
 }
 
@@ -570,11 +573,29 @@ void ExtensionSettingsHandler::ManagedUserSetElevated(const ListValue* args) {
         base::Bind(&ExtensionSettingsHandler::PassphraseDialogCallback,
                    base::Unretained(this)));
   } else {
-    service->SetElevated(false);
+    ManagedModeNavigationObserver* observer =
+        ManagedModeNavigationObserver::FromWebContents(
+            web_ui()->GetWebContents());
+    observer->set_elevated(false);
     HandleRequestExtensionsData(NULL);
   }
 }
 
+bool ExtensionSettingsHandler::CheckUserMayModifySettings(
+    const Extension* extension) {
+  ManagedUserService* service = ManagedUserServiceFactory::GetForProfile(
+      Profile::FromWebUI(web_ui()));
+  bool need_elevation =
+      service->ProfileIsManaged() &&
+      service->IsElevatedForWebContents(web_ui()->GetWebContents());
+  if (need_elevation)
+    service->AddElevationForExtension(extension->id());

[Bernhard Bauer, 2013/03/27 15:48:14]

Often when we have the need to balance calls like this, we add a stack-allocated
object that takes care of that when it is destroyed. In this case, it would be
something like  "ScopedExtensionElevation", and it would drop elevation when it
is destroyed.

[Adrian Kuegel, 2013/03/27 16:17:43]

Done.

+  bool result = management_policy_->UserMayModifySettings(extension, NULL);
+  if (need_elevation)
+    service->RemoveElevationForExtension(extension->id());
+  return result;
+}
+
 void ExtensionSettingsHandler::HandleRequestExtensionsData(
     const ListValue* args) {
   DictionaryValue results;
@@ -624,7 +645,8 @@ void ExtensionSettingsHandler::HandleRequestExtensionsData(
       ManagedUserServiceFactory::GetForProfile(profile);
 
   bool is_managed = service->ProfileIsManaged();
-  bool is_elevated = service->IsElevated();
+  bool is_elevated =
+      service->IsElevatedForWebContents(web_ui()->GetWebContents());
   bool developer_mode =
       (!is_managed || is_elevated) &&
       profile->GetPrefs()->GetBoolean(prefs::kExtensionsUIDeveloperMode);
@@ -735,8 +757,7 @@ void ExtensionSettingsHandler::HandleEnableMessage(const ListValue* args) {
 
   const Extension* extension =
       extension_service_->GetInstalledExtension(extension_id);
-  if (!extension ||
-      !management_policy_->UserMayModifySettings(extension, NULL)) {
+  if (!extension || !CheckUserMayModifySettings(extension)) {
     LOG(ERROR) << "Attempt to enable an extension that is non-usermanagable was"
                << "made. Extension id: " << extension->id();
     return;
@@ -766,8 +787,17 @@ void ExtensionSettingsHandler::HandleEnableMessage(const ListValue* args) {
       prefs->SetBrowserActionVisibility(extension, true);
     }
   } else {
+    ManagedUserService* service = ManagedUserServiceFactory::GetForProfile(
+        Profile::FromWebUI(web_ui()));
+    bool need_elevation =
+        service->ProfileIsManaged() &&
+        service->IsElevatedForWebContents(web_ui()->GetWebContents());
+    if (need_elevation)
+      service->AddElevationForExtension(extension_id);
     extension_service_->DisableExtension(
         extension_id, Extension::DISABLE_USER_ACTION);
+    if (need_elevation)
+      service->RemoveElevationForExtension(extension_id);
   }
 }
 
@@ -810,7 +840,7 @@ void ExtensionSettingsHandler::HandleAllowFileAccessMessage(
   if (!extension)
     return;
 
-  if (!management_policy_->UserMayModifySettings(extension, NULL)) {
+  if (!CheckUserMayModifySettings(extension)) {
     LOG(ERROR) << "Attempt to change allow file access of an extension that is "
                << "non-usermanagable was made. Extension id : "
                << extension->id();
@@ -829,7 +859,7 @@ void ExtensionSettingsHandler::HandleUninstallMessage(const ListValue* args) {
   if (!extension)
     return;
 
-  if (!management_policy_->UserMayModifySettings(extension, NULL)) {
+  if (!CheckUserMayModifySettings(extension)) {
     LOG(ERROR) << "Attempt to uninstall an extension that is non-usermanagable "
                << "was made. Extension id : " << extension->id();
     return;