Supervised users: Slightly relax restrictions around extensions.

chrome/browser/ui/webui/extensions/extension_settings_handler.cc

Index: chrome/browser/ui/webui/extensions/extension_settings_handler.cc
diff --git a/chrome/browser/ui/webui/extensions/extension_settings_handler.cc b/chrome/browser/ui/webui/extensions/extension_settings_handler.cc
index 74c8a42627b9d5ece0495cdb83ae0703c82c4079..b3a79fbf698aedd54037098badffb8d58b8a1534 100644
--- a/chrome/browser/ui/webui/extensions/extension_settings_handler.cc
+++ b/chrome/browser/ui/webui/extensions/extension_settings_handler.cc
@@ -276,6 +276,12 @@ base::DictionaryValue* ExtensionSettingsHandler::CreateExtensionDetailValue(
   // recommended install.
   DCHECK(!(managed_install || recommended_install) || !suspicious_install);
 
+  // |web_ui()| can be null in unit tests.
+  bool installed_by_custodian =
+      web_ui() && Profile::FromWebUI(web_ui())->IsSupervised() &&
+      extension->was_installed_by_custodian();
+  extension_data->SetBoolean("installedByCustodian", installed_by_custodian);
+
   GURL icon =
       ExtensionIconSource::GetIconURL(extension,
                                       extension_misc::EXTENSION_ICON_MEDIUM,
@@ -1081,6 +1087,11 @@ void ExtensionSettingsHandler::HandleEnableMessage(
   if (!extension)
     return;
 
+  if (Profile::FromWebUI(web_ui())->IsSupervised() &&
+      extension->was_installed_by_custodian()) {

[Pam (message me for reviews), 2015/02/23 10:18:50]

It really seems like being installed by a custodian should mean
UserMayModifySettings = false, which would simplify both these.

[Marc Treib, 2015/02/23 12:07:38]

As mentioned above: UserMayModifySettings = false really means "nothing may ever
change the enabled state of this extension, ever", which breaks our "update with
new permissions" flow.

[Pam (message me for reviews), 2015/02/23 12:20:17]

So that's something we should sort out fairly soon -- figure out whether it
really should be only user-initiated changes, and then either fix the semantics
or fix the name.  But not necessarily for this CL. For now, a comment on the
method in management_policy.h would be good.

[Marc Treib, 2015/02/23 12:33:59]

Done.

+    return;
+  }
+
   if (!management_policy_->UserMayModifySettings(extension, NULL)) {
     LOG(ERROR) << "An attempt was made to enable an extension that is "
                << "non-usermanagable. Extension id: " << extension->id();
@@ -1165,6 +1176,11 @@ void ExtensionSettingsHandler::HandleAllowFileAccessMessage(
   if (!extension)
     return;
 
+  if (Profile::FromWebUI(web_ui())->IsSupervised() &&
+      extension->was_installed_by_custodian()) {
+    return;
+  }
+
   if (!management_policy_->UserMayModifySettings(extension, NULL)) {
     LOG(ERROR) << "An attempt was made to change allow file access of an"
                << " extension that is non-usermanagable. Extension id : "