Add more management policy checking after extension installed

chrome/browser/extensions/extension_service.cc

 // Copyright (c) 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/extensions/extension_service.h"
 
 #include <algorithm>
 #include <iterator>
 #include <set>
 
@@ skipping 1416 matching lines @@
   const Version old_version(old_version_string);
 
   VLOG(1) << "AddComponentExtension " << extension->name();
   if (!old_version.IsValid() || !old_version.Equals(*extension->version())) {
     VLOG(1) << "Component extension " << extension->name() << " ("
         << extension->id() << ") installing/upgrading from '"
         << old_version_string << "' to " << extension->version()->GetString();
 
     AddNewOrUpdatedExtension(extension,
                              Extension::ENABLED,
+                             Extension::DISABLE_NONE,
                              extensions::kInstallFlagNone,
                              syncer::StringOrdinal(),
                              std::string());
     return;
   }
 
   AddExtension(extension);
 }
 
 void ExtensionService::CheckPermissionsIncrease(const Extension* extension,
@@ skipping 117 matching lines @@
   crash_keys::SetActiveExtensions(extension_ids);
 }
 
 void ExtensionService::OnExtensionInstalled(
     const Extension* extension,
     const syncer::StringOrdinal& page_ordinal,
     int install_flags) {
   CHECK(BrowserThread::CurrentlyOn(BrowserThread::UI));
 
   const std::string& id = extension->id();
-  bool initial_enable = ShouldEnableOnInstall(extension);
+  Extension::DisableReason initial_disable_reason = Extension::DISABLE_NONE;
+  bool initial_enable =
+      ShouldEnableOnInstall(extension, &initial_disable_reason);
   std::string install_parameter;
   const extensions::PendingExtensionInfo* pending_extension_info =
       pending_extension_manager()->GetById(id);
   if (pending_extension_info) {
     if (!pending_extension_info->ShouldAllowInstall(extension)) {
       pending_extension_manager()->Remove(id);
 
       LOG(WARNING) << "ShouldAllowInstall() returned false for "
                    << id << " of type " << extension->GetType()
                    << " and update URL "
@@ skipping 13 matching lines @@
     }
 
     install_parameter = pending_extension_info->install_parameter();
     pending_extension_manager()->Remove(id);
   } else {
     // We explicitly want to re-enable an uninstalled external
     // extension; if we're here, that means the user is manually
     // installing the extension.
     if (extension_prefs_->IsExternalExtensionUninstalled(id)) {
       initial_enable = true;
+      initial_disable_reason = Extension::DISABLE_NONE;
     }
   }
 
   // Unsupported requirements overrides the management policy.
   if (install_flags & extensions::kInstallFlagHasRequirementErrors) {
     initial_enable = false;
-    extension_prefs_->AddDisableReason(
-        id, Extension::DISABLE_UNSUPPORTED_REQUIREMENT);
+    initial_disable_reason = Extension::DISABLE_UNSUPPORTED_REQUIREMENT;
   // If the extension was disabled because of unsupported requirements but
   // now supports all requirements after an update and there are not other
   // disable reasons, enable it.
   } else if (extension_prefs_->GetDisableReasons(id) ==
       Extension::DISABLE_UNSUPPORTED_REQUIREMENT) {
     initial_enable = true;
+    initial_disable_reason = Extension::DISABLE_NONE;
     extension_prefs_->ClearDisableReasons(id);
   }
 
   if (install_flags & extensions::kInstallFlagIsBlacklistedForMalware) {
     // Installation of a blacklisted extension can happen from sync, policy,
     // etc, where to maintain consistency we need to install it, just never
     // load it (see AddExtension). Usually it should be the job of callers to
     // incercept blacklisted extension earlier (e.g. CrxInstaller, before even
     // showing the install dialogue).
     extension_prefs_->AcknowledgeBlacklistedExtension(id);
@@ skipping 23 matching lines @@
   }
 
   const Extension::State initial_state =
       initial_enable ? Extension::ENABLED : Extension::DISABLED;
   if (ShouldDelayExtensionUpdate(
           id,
           !!(install_flags & extensions::kInstallFlagInstallImmediately))) {
     extension_prefs_->SetDelayedInstallInfo(
         extension,
         initial_state,
+        initial_disable_reason,
         install_flags,
         extensions::ExtensionPrefs::DELAY_REASON_WAIT_FOR_IDLE,
         page_ordinal,
         install_parameter);
 
     // Transfer ownership of |extension|.
     delayed_installs_.Insert(extension);
 
     // Notify observers that app update is available.
     FOR_EACH_OBSERVER(extensions::UpdateObserver, update_observers_,
                       OnAppUpdateAvailable(extension));
     return;
   }
 
   extensions::SharedModuleService::ImportStatus status =
       shared_module_service_->SatisfyImports(extension);
   if (installs_delayed_for_gc_) {
     extension_prefs_->SetDelayedInstallInfo(
         extension,
         initial_state,
+        initial_disable_reason,
         install_flags,
         extensions::ExtensionPrefs::DELAY_REASON_GC,
         page_ordinal,
         install_parameter);
     delayed_installs_.Insert(extension);
   } else if (status != SharedModuleService::IMPORT_STATUS_OK) {
     if (status == SharedModuleService::IMPORT_STATUS_UNSATISFIED) {
       extension_prefs_->SetDelayedInstallInfo(
           extension,
           initial_state,
+          initial_disable_reason,
           install_flags,
           extensions::ExtensionPrefs::DELAY_REASON_WAIT_FOR_IMPORTS,
           page_ordinal,
           install_parameter);
       delayed_installs_.Insert(extension);
     }
   } else {
     AddNewOrUpdatedExtension(extension,
                              initial_state,
+                             initial_disable_reason,
                              install_flags,
                              page_ordinal,
                              install_parameter);
   }
 }
 
 void ExtensionService::OnExtensionManagementSettingsChanged() {
   error_controller_->ShowErrorIfNeeded();
 
   // Revokes blocked permissions from active_permissions for all extensions.
@@ skipping 11 matching lines @@
           settings->GetBlockedPermissions(extension.get()).get());
     }
   }
 
   CheckManagementPolicy();
 }
 
 void ExtensionService::AddNewOrUpdatedExtension(
     const Extension* extension,
     Extension::State initial_state,
+    Extension::DisableReason initial_disable_reason,
     int install_flags,
     const syncer::StringOrdinal& page_ordinal,
     const std::string& install_parameter) {
   CHECK(BrowserThread::CurrentlyOn(BrowserThread::UI));
   bool was_ephemeral = extension_prefs_->IsEphemeralApp(extension->id());
-  extension_prefs_->OnExtensionInstalled(
-      extension, initial_state, page_ordinal, install_flags, install_parameter);
+  extension_prefs_->OnExtensionInstalled(extension, initial_state,
+                                         initial_disable_reason, page_ordinal,
+                                         install_flags, install_parameter);
   delayed_installs_.Remove(extension->id());
   if (InstallVerifier::NeedsVerification(*extension))
     system_->install_verifier()->VerifyExtension(extension->id());
   FinishInstallation(extension, was_ephemeral);
 }
 
 void ExtensionService::MaybeFinishDelayedInstallation(
     const std::string& extension_id) {
   // Check if the extension already got installed.
   if (!delayed_installs_.Contains(extension_id))
@@ skipping 393 matching lines @@
     case chrome::NOTIFICATION_PROFILE_DESTRUCTION_STARTED: {
       OnProfileDestructionStarted();
       break;
     }
 
     default:
       NOTREACHED() << "Unexpected notification type.";
   }
 }
 
-bool ExtensionService::ShouldEnableOnInstall(const Extension* extension) {
+bool ExtensionService::ShouldEnableOnInstall(
+    const Extension* extension,
+    Extension::DisableReason* disable_reason) {
+  // Extensions disabled by managemeny policy should always be disabled, even
+  // if it's force-installed.
+  if (system_->management_policy()->MustRemainDisabled(
+          extension, disable_reason, nullptr)) {
+    return false;
+  }
+
   // Extensions installed by policy can't be disabled. So even if a previous
   // installation disabled the extension, make sure it is now enabled.
-  if (system_->management_policy()->MustRemainEnabled(extension, NULL))
+  if (system_->management_policy()->MustRemainEnabled(extension, nullptr))
     return true;
 
-  if (extension_prefs_->IsExtensionDisabled(extension->id()))
+  if (extension_prefs_->IsExtensionDisabled(extension->id())) {
+    *disable_reason = Extension::DISABLE_NONE;

[Finnur, 2014/11/11 22:58:03]

It is a bit weird to set this only when this function returns false. Is that on
purpose?

[binjin, 2014/11/12 16:33:18]

Yes, the |disable_reason| will be ignored if true is returned.

     return false;
+  }
 
   if (FeatureSwitch::prompt_for_external_extensions()->IsEnabled()) {
     // External extensions are initially disabled. We prompt the user before
     // enabling them. Hosted apps are excepted because they are not dangerous
     // (they need to be launched by the user anyway).
     if (extension->GetType() != Manifest::TYPE_HOSTED_APP &&
         Manifest::IsExternalLocation(extension->location()) &&
         !extension_prefs_->IsExternalExtensionAcknowledged(extension->id())) {
+      *disable_reason = Extension::DISABLE_NONE;
       return false;
     }
   }
 
   return true;
 }
 
 bool ExtensionService::ShouldDelayExtensionUpdate(
     const std::string& extension_id,
     bool install_immediately) const {
@@ skipping 207 matching lines @@
 }
 
 void ExtensionService::OnProfileDestructionStarted() {
   ExtensionIdSet ids_to_unload = registry_->enabled_extensions().GetIDs();
   for (ExtensionIdSet::iterator it = ids_to_unload.begin();
        it != ids_to_unload.end();
        ++it) {
     UnloadExtension(*it, UnloadedExtensionInfo::REASON_PROFILE_SHUTDOWN);
   }
 }