Document the idiosyncrasies of policy provisioning on Windows.

components/policy/core/common/policy_loader_win.cc

 // Copyright (c) 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "components/policy/core/common/policy_loader_win.h"
 
 #include <windows.h>
 #include <lm.h>       // For limits.
 #include <ntdsapi.h>  // For Ds[Un]Bind
 #include <rpc.h>      // For struct GUID
@@ skipping 57 matching lines @@
 const char kLegacyBrowserSupportExtensionId[] =
     "heildphpnddilhkemkielfhnkaagiabh";
 
 // The web store url that is the only trusted source for extensions.
 const char kExpectedWebStoreUrl[] =
     ";https://clients2.google.com/service/update2/crx";
 // String to be prepended to each blocked entry.
 const char kBlockedExtensionPrefix[] = "[BLOCKED]";
 
 // List of policies that are considered only if the user is part of a AD domain.
+// Please document any new additions in policy_templates.json!
 const char* kInsecurePolicies[] = {
     key::kMetricsReportingEnabled,
     key::kDefaultSearchProviderEnabled,
     key::kHomepageIsNewTabPage,
     key::kHomepageLocation,
     key::kRestoreOnStartup,
     key::kRestoreOnStartupURLs
 };
 
 // The GUID of the registry settings group policy extension.
@@ skipping 45 matching lines @@
 }
 
 // Verifies that untrusted policies contain only safe values. Modifies the
 // |policy| in place.
 void FilterUntrustedPolicy(PolicyMap* policy) {
   if (base::win::IsEnrolledToDomain())
     return;
 
   int invalid_policies = 0;
   const PolicyMap::Entry* map_entry =
-      policy->Get(policy::key::kExtensionInstallForcelist);
+      policy->Get(key::kExtensionInstallForcelist);
   if (map_entry && map_entry->value) {
     const base::ListValue* policy_list_value = NULL;
     if (!map_entry->value->GetAsList(&policy_list_value))
       return;
 
     scoped_ptr<base::ListValue> filtered_values(new base::ListValue);
     for (base::ListValue::const_iterator list_entry(policy_list_value->begin());
          list_entry != policy_list_value->end(); ++list_entry) {
       std::string entry;
       if (!(*list_entry)->GetAsString(&entry))
         continue;
       size_t pos = entry.find(';');
       if (pos == std::string::npos)
         continue;
       // Only allow custom update urls in enterprise environments.
       if (!LowerCaseEqualsASCII(entry.substr(pos), kExpectedWebStoreUrl)) {
         entry = kBlockedExtensionPrefix + entry;
         invalid_policies++;
       }
 
       filtered_values->AppendString(entry);
     }
     if (invalid_policies) {
-      policy->Set(policy::key::kExtensionInstallForcelist,
+      policy->Set(key::kExtensionInstallForcelist,
                   map_entry->level, map_entry->scope,
                   filtered_values.release(),
                   map_entry->external_data_fetcher);
 
-      const PolicyDetails* details = policy::GetChromePolicyDetails(
-          policy::key::kExtensionInstallForcelist);
+      const PolicyDetails* details = GetChromePolicyDetails(
+          key::kExtensionInstallForcelist);
       UMA_HISTOGRAM_SPARSE_SLOWLY("EnterpriseCheck.InvalidPolicies",
                                   details->id);
     }
   }
 
   for (size_t i = 0; i < arraysize(kInsecurePolicies); ++i) {
     if (policy->Get(kInsecurePolicies[i])) {
       // TODO(pastarmovj): Surface this issue in the about:policy page.
       policy->Erase(kInsecurePolicies[i]);
       invalid_policies++;
       const PolicyDetails* details =
-          policy::GetChromePolicyDetails(kInsecurePolicies[i]);
+          GetChromePolicyDetails(kInsecurePolicies[i]);
       UMA_HISTOGRAM_SPARSE_SLOWLY("EnterpriseCheck.InvalidPolicies",
                                   details->id);
     }
   }
 
   UMA_HISTOGRAM_COUNTS("EnterpriseCheck.InvalidPoliciesDetected",
                        invalid_policies);
 }
 
 // A helper class encapsulating run-time-linked function calls to Wow64 APIs.
@@ skipping 491 matching lines @@
           "418183 PolicyLoaderWin::OnObjectSignaled"));
 
   DCHECK(object == user_policy_changed_event_.handle() ||
          object == machine_policy_changed_event_.handle())
       << "unexpected object signaled policy reload, obj = "
       << std::showbase << std::hex << object;
   Reload(false);
 }
 
 }  // namespace policy