Add a group policy controlling which sites can install extensions.

chrome/browser/download/download_crx_util.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 //
 // Download code which handles CRX files (extensions, themes, apps, ...).
 
 #include "chrome/browser/download/download_util.h"
 #include "chrome/browser/extensions/crx_installer.h"
 #include "chrome/browser/extensions/extension_install_prompt.h"
 #include "chrome/browser/extensions/extension_service.h"
+#include "chrome/browser/extensions/extension_system.h"
 #include "chrome/browser/extensions/webstore_installer.h"
 #include "chrome/browser/profiles/profile.h"
 #include "chrome/common/chrome_notification_types.h"
 #include "chrome/common/extensions/extension_switch_utils.h"
 #include "content/public/browser/download_item.h"
 #include "content/public/browser/notification_service.h"
 
 using content::BrowserThread;
 using content::DownloadItem;
 
@@ skipping 15 matching lines @@
   if (mock_install_prompt_for_testing) {
     result = mock_install_prompt_for_testing;
     mock_install_prompt_for_testing = NULL;
   } else {
     result = new ExtensionInstallPrompt(profile);
   }
 
   return result;
 }
 
+bool OffStoreInstallAllowedByPrefs(Profile* profile, const DownloadItem& item) {
+  ExtensionPrefs* prefs =
+      ExtensionSystem::Get(profile)->extension_service()->extension_prefs();
+  CHECK(prefs);
+
+  URLPatternSet url_patterns = prefs->GetAllowedInstallSites();
+
+  // TODO(aa): RefererURL is cleared in some cases, for example when going
+  // between secure and non-secure URLs. It would be better if DownloadItem
+  // tracked the initiating page explicitly.
+  return url_patterns.MatchesURL(item.GetURL()) &&
+      url_patterns.MatchesURL(item.GetReferrerUrl());
+}
+
 }  // namespace
 
 // Tests can call this method to inject a mock ExtensionInstallPrompt
 // to be used to confirm permissions on a downloaded CRX.
 void SetMockInstallPromptForTesting(ExtensionInstallPrompt* mock_prompt) {
   mock_install_prompt_for_testing = mock_prompt;
 }
 
 scoped_refptr<CrxInstaller> OpenChromeExtension(
     Profile* profile,
     const DownloadItem& download_item) {
   DCHECK(BrowserThread::CurrentlyOn(BrowserThread::UI));
 
   ExtensionService* service = profile->GetExtensionService();
   CHECK(service);
 
   scoped_refptr<CrxInstaller> installer(
       CrxInstaller::Create(
           service,
           CreateExtensionInstallPrompt(profile),
           WebstoreInstaller::GetAssociatedApproval(download_item)));
 
   installer->set_delete_source(true);
   installer->set_install_cause(extension_misc::INSTALL_CAUSE_USER_DOWNLOAD);
 
+  if (OffStoreInstallAllowedByPrefs(profile, download_item)) {
+    installer->set_off_store_install_allow_reason(
+        CrxInstaller::OffStoreInstallAllowedBecausePref);
+  }
+
   if (UserScript::IsURLUserScript(download_item.GetURL(),
                                   download_item.GetMimeType())) {
     installer->InstallUserScript(download_item.GetFullPath(),
                                  download_item.GetURL());
   } else {
     bool is_gallery_download =
         WebstoreInstaller::GetAssociatedApproval(download_item) != NULL;
     installer->set_original_mime_type(download_item.GetOriginalMimeType());
     installer->set_apps_require_extension_mime_type(true);
     installer->set_download_url(download_item.GetURL());
@@ skipping 15 matching lines @@
   if (download_item.GetMimeType() == extensions::Extension::kMimeType ||
       UserScript::IsURLUserScript(download_item.GetURL(),
                                   download_item.GetMimeType())) {
     return true;
   } else {
     return false;
   }
 }
 
 }  // namespace download_crx_util