Adding a DownloadRestrictions group policy.

content/public/browser/download_item.h

Index: content/public/browser/download_item.h
diff --git a/content/public/browser/download_item.h b/content/public/browser/download_item.h
index 9b6d933c3c485261eb7146a72f279259b78a1b0f..c5fa6df29fab5a67d6ad4d27a90407e599e7f709 100644
--- a/content/public/browser/download_item.h
+++ b/content/public/browser/download_item.h
@@ -78,10 +78,10 @@ class CONTENT_EXPORT DownloadItem : public base::SupportsUserData {
 
   // How the final target path should be used.
   enum TargetDisposition {
-    TARGET_DISPOSITION_OVERWRITE, // Overwrite if the target already exists.
-    TARGET_DISPOSITION_PROMPT     // Prompt the user for the actual
-                                  // target. Implies
-                                  // TARGET_DISPOSITION_OVERWRITE.
+    TARGET_DISPOSITION_OVERWRITE,  // Overwrite if the target already exists.
+    TARGET_DISPOSITION_PROMPT      // Prompt the user for the actual
+                                   // target. Implies
+                                   // TARGET_DISPOSITION_OVERWRITE.
   };
 
   // Callback used with AcquireFileAndDeleteDownload().
@@ -435,8 +435,10 @@ class CONTENT_EXPORT DownloadItem : public base::SupportsUserData {
 
   // Called if a check of the download contents was performed and the results of
   // the test are available. This should only be called after AllDataSaved() is
-  // true.
-  virtual void OnContentCheckCompleted(DownloadDangerType danger_type) = 0;
+  // true. If |reason| is not DOWNLOAD_INTERRUPT_REASON_NONE, then the download
+  // file should be blocked.

[jochen (gone - plz use gerrit), 2017/06/14 08:16:49]

I find it kinda odd to pass an interrupt reason to this method, however, that
appears to be a common pattern on download item..

Would be less odd to have a generic DownloadItem::Interrupt(reason) instead of
having several methods take an interrupt reason so you can interrupt at those
points. Probably not for this CL to fix.

[MAD, 2017/06/14 17:50:21]

Agreed. Added a TODO. Thanks!

+  virtual void OnContentCheckCompleted(DownloadDangerType danger_type,
+                                       DownloadInterruptReason reason) = 0;
 
   // Mark the download to be auto-opened when completed.
   virtual void SetOpenWhenComplete(bool open) = 0;