Adding a DownloadRestrictions group policy.

components/policy/resources/policy_templates.json

Index: components/policy/resources/policy_templates.json
diff --git a/components/policy/resources/policy_templates.json b/components/policy/resources/policy_templates.json
index 7082782f95f149ff63d605023ee6f645f4f67f1f..4b6ff6c5050626415b0ead9915b6625d85bd18d6 100644
--- a/components/policy/resources/policy_templates.json
+++ b/components/policy/resources/policy_templates.json
@@ -143,7 +143,7 @@
 #   persistent IDs for all fields (but not for groups!) are needed. These are
 #   specified by the 'id' keys of each policy. NEVER CHANGE EXISTING IDs,
 #   because doing so would break the deployed wire format!
-#   For your editing convenience: highest ID currently used: 370
+#   For your editing convenience: highest ID currently used: 371
 #   And don't forget to also update the EnterprisePolicies enum of
 #   histograms.xml (run 'python tools/metrics/histograms/update_policies.py').
 #
@@ -1712,6 +1712,60 @@
       'label': '''Set media disk cache size''',
     },
     {
+      'name': 'DownloadRestrictions',
+      'type': 'int-enum',
+      'schema': {
+        'type': 'integer',
+        'enum': [ 0, 1, 2, 3 ],
+      },
+      'items': [
+        {
+          'name': 'DefaultDownloadSecurity',
+          'value': 0,
+          'caption': '''No special restrictions''',
+        },
+        {
+          'name': 'BlockDangerousDownloads',
+          'value': 1,
+          'caption': '''Block dangerous downloads''',
+        },
+        {
+          'name': 'BlockPotentiallyDangerousDownloads',
+          'value': 2,
+          'caption': '''Block potentially dangerous downloads''',
+        },
+        {
+          'name': 'BlockAllDownloads',
+          'value': 3,
+          'caption': '''Block all downloads''',
+        },
+      ],
+      'supported_on': ['chrome.*:60-', 'chrome_os:60-'],

[pastarmovj, 2017/06/14 08:48:35]

Shouldn't this be 61 by now?

[MAD, 2017/06/14 17:50:21]

Done.

+      'features': {
+        'can_be_recommended': True,
+        'dynamic_refresh': True,
+        'per_profile': True,
+      },
+      'example_value': 2,
+      'id': 371,
+      'caption': '''Allow download restrictions''',
+      'tags': ['local-data-access'],
+      'desc': '''Configures the type of downloads that <ph name="PRODUCT_NAME">$1<ex>Google Chrome</ex></ph> will completely block, without letting users override the security decision.
+
+      If you set this policy, <ph name="PRODUCT_NAME">$1<ex>Google Chrome</ex></ph> will prevent certain types of downloads, and won't let user bypass the security warnings.
+
+      When the 'Block dangerous downloads' option is chosen, all downloads are allowed, except for those that carry SafeBrowsing warnings.
+
+      When the 'Block potentially dangerous downloads' option is chosen, all downloads allowed, except for those that carry SafeBrowsing warnings of potentially dangerous downloads.
+
+      When the 'Block all downloads' option is chosen, all downloads are blocked.

[pastarmovj, 2017/06/14 08:48:35]

Add another paragraph that explains what does it mean for the policy to not be
set. I know it is obvious but MS best practices dictate the default behavior to
be explicitly documented. See any other policy for reference.

[MAD, 2017/06/14 17:50:21]

Done.

+
+      Note that these restrictions apply to downloads triggered from web page content, as well as the 'download link...' context menu option.
+
+      But these restrictions do not apply to the save / download of the currently displayed page, nor does it apply to saving as PDF from the printing options.''',

[pastarmovj, 2017/06/14 08:48:35]

Do we have a help center article about SafeBrowsing? It feels to me it will be
good to include a link here for people to know what does the restrictions above
really mean.

[pastarmovj, 2017/06/14 08:48:35]

nit: skip the "But ".

[MAD, 2017/06/14 17:50:21]

Done.

[MAD, 2017/06/14 17:50:21]

There are other mentions of safe browsing within other policies (some policies
being directly related to it). Should I add the link there too?

[pastarmovj, 2017/06/16 07:17:13]

If you want to you can do that in another CL. But at least this policy now has
great comprehensive description! :)

+      'label': '''Download restrictions''',
+    },
+    {
       'name': 'DownloadDirectory',
       'type': 'string',
       'schema': { 'type': 'string' },