Implement admin control (by policy) over which extensions the user can install and run. Currently we intercept in two locations:

1) When the user tries to install an extension (includes error message). 
2) Every time the browser starts up and the currently installed extensions are loaded (silently skips the extension). 

I implemented a whitelist and a blacklist approach, calling it a allow/deny list to not clash with the global blacklist we have for extensions. A blacklist of '*' means all extensions are blacklisted. If an extension is on the blacklist it cannot be installed/loaded, unless it also appears on the whitelist. 

I also fleshed out the LIST_TYPE support for policy values, so that we don't have to use comma separated REG_SZ values for lists and can instead use ADM support for listboxes. 

BUG=47085
TEST=ExtensionsServiceTest.BlacklistedByPolicyWillNotInstall, ConfigurationPolicyProviderWinTest.TestExtensionInstall*

Review URL: http://codereview.chromium.org/3014053

git-svn-id: svn://svn.chromium.org/chrome/trunk/src@55727 0039d316-1c4b-4281-b951-d872f2087c98

1 files changed, 6 insertions, 0 deletions

diff --git a/chrome/browser/extensions/crx_installer.cc b/chrome/browser/extensions/crx_installer.cc
index ddc1404..b24a02d 100644
--- a/chrome/browser/extensions/crx_installer.cc
+++ b/chrome/browser/extensions/crx_installer.cc
@@ -201,6 +201,12 @@ void CrxInstaller::ConfirmInstall() {
     return;
   }
 
+  if (!frontend_->extension_prefs()->IsExtensionAllowedByPolicy(
+      extension_->id())) {
+    ReportFailureFromUIThread("This extension is blacklisted by admin policy.");
+    return;
+  }
+
   GURL overlapping_url;
   Extension* overlapping_extension =
       frontend_->GetExtensionByOverlappingWebExtent(extension_->web_extent());