kiosk: Tighten cert manager UI

chrome/browser/chromeos/login/app_launch_controller.cc

 // Copyright 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/chromeos/login/app_launch_controller.h"
 
 #include "base/bind.h"
 #include "base/callback.h"
 #include "base/files/file_path.h"
 #include "base/json/json_file_value_serializer.h"
@@ skipping 343 matching lines @@
     return can_configure_network_callback_->Run();
 
   if (IsEnterpriseManaged()) {
     bool should_prompt;
     if (CrosSettings::Get()->GetBoolean(
             kAccountsPrefDeviceLocalAccountPromptForNetworkWhenOffline,
             &should_prompt)) {
       return should_prompt;
     }
 
-    // Default to true to allow network configuration if the policy is missing.
-    return true;
+    // Network configuration has to be explicitly allowed by the policy.
+    // Default to false if the policy is missing.
+    return false;
   }
 
   return user_manager::UserManager::Get()->GetOwnerAccountId().is_valid();
 }
 
 bool AppLaunchController::NeedOwnerAuthToConfigureNetwork() {
   if (need_owner_auth_to_configure_network_callback_)
     return need_owner_auth_to_configure_network_callback_->Run();
 
   return !IsEnterpriseManaged();
@@ skipping 136 matching lines @@
   KioskAppLaunchError::Save(error);
   chrome::AttemptUserExit();
   CleanUp();
 }
 
 bool AppLaunchController::IsShowingNetworkConfigScreen() {
   return network_config_requested_;
 }
 
 }   // namespace chromeos