Disable off-store extension installs by default.

chrome/browser/extensions/webstore_installer.cc

Index: chrome/browser/extensions/webstore_installer.cc
diff --git a/chrome/browser/extensions/webstore_installer.cc b/chrome/browser/extensions/webstore_installer.cc
index f86eba436c49c6ae3372c36950f69f4eb8eda5c3..36f8305027932d507570f3b3dbdb771a7bb7cbdf 100644
--- a/chrome/browser/extensions/webstore_installer.cc
+++ b/chrome/browser/extensions/webstore_installer.cc
@@ -290,9 +290,7 @@ void WebstoreInstaller::StartDownload(const FilePath& file) {
   // checks in ExtensionService::IsDownloadFromGallery. We should instead pass
   // the real referrer, track if this is an inline install in the whitelist
   // entry and look that up when checking that this is a valid download.
-  GURL referrer = controller_->GetActiveEntry()->GetURL();
-  if (flags_ & FLAG_INLINE_INSTALL)
-    referrer = GURL(extension_urls::GetWebstoreItemDetailURLPrefix() + id_);
+  GURL referrer = GURL(extension_urls::GetWebstoreItemDetailURLPrefix() + id_);

[Mihai Parparita -not on Chrome, 2012/05/12 00:15:45]

For the sake of posterity, Aaron and I discussed this a bit in #crx, and my take
is that the referrer spoofing is a hack, so we don't want to spread it even
further (e.g. for non-inline installs).

Generally, the ideal fix is to remove it entirely, and use Jon's spiffy new
"Approval" struct to keep track of webstore vs. non-webstore installs, instead
of doing referrer checks in places like
http://code.google.com/searchframe#OAMlx_jo-ck/src/chrome/browser/download/ch....

 
   content::DownloadSaveInfo save_info;
   save_info.file_path = file;