Disable off-store extension installs by default.

chrome/browser/extensions/webstore_installer.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/extensions/webstore_installer.h"
 
 #include "base/basictypes.h"
 #include "base/bind.h"
 #include "base/command_line.h"
 #include "base/file_util.h"
@@ skipping 272 matching lines @@
   if (file.empty()) {
     ReportFailure(kDownloadDirectoryError);
     return;
   }
 
   // TODO(mihaip): For inline installs, we pretend like the referrer is the
   // gallery, even though this could be an inline install, in order to pass the
   // checks in ExtensionService::IsDownloadFromGallery. We should instead pass
   // the real referrer, track if this is an inline install in the whitelist
   // entry and look that up when checking that this is a valid download.
-  GURL referrer = controller_->GetActiveEntry()->GetURL();
-  if (flags_ & FLAG_INLINE_INSTALL)
-    referrer = GURL(extension_urls::GetWebstoreItemDetailURLPrefix() + id_);
+  GURL referrer = GURL(extension_urls::GetWebstoreItemDetailURLPrefix() + id_);

[Mihai Parparita -not on Chrome, 2012/05/12 00:15:45]

For the sake of posterity, Aaron and I discussed this a bit in #crx, and my take
is that the referrer spoofing is a hack, so we don't want to spread it even
further (e.g. for non-inline installs).

Generally, the ideal fix is to remove it entirely, and use Jon's spiffy new
"Approval" struct to keep track of webstore vs. non-webstore installs, instead
of doing referrer checks in places like
http://code.google.com/searchframe#OAMlx_jo-ck/src/chrome/browser/download/ch....

 
   content::DownloadSaveInfo save_info;
   save_info.file_path = file;
 
   // The download url for the given extension is contained in |download_url_|.
   // We will navigate the current tab to this url to start the download. The
   // download system will then pass the crx to the CrxInstaller.
   download_util::RecordDownloadSource(
       download_util::INITIATED_BY_WEBSTORE_INSTALLER);
   scoped_ptr<DownloadUrlParameters> params(
@@ skipping 14 matching lines @@
 }
 
 void WebstoreInstaller::ReportSuccess() {
   if (delegate_) {
     delegate_->OnExtensionInstallSuccess(id_);
     delegate_ = NULL;
   }
 
   Release();  // Balanced in Start().
 }