Add a group policy controlling which sites can install extensions.

chrome/browser/ui/webui/extensions/install_extension_handler.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/ui/webui/extensions/install_extension_handler.h"
 
 #include "base/bind.h"
 #include "base/string_util.h"
 #include "base/utf_string_conversions.h"
 #include "chrome/browser/extensions/crx_installer.h"
@@ skipping 66 matching lines @@
   if (file_to_install_.empty()) {
     LOG(ERROR) << "No file captured to install.";
     return;
   }
 
   Profile* profile = Profile::FromWebUI(web_ui());
   scoped_refptr<CrxInstaller> crx_installer(
       CrxInstaller::Create(
           ExtensionSystem::Get(profile)->extension_service(),
           new ExtensionInstallPrompt(profile)));
-  crx_installer->set_allow_off_store_install(true);
+  crx_installer->set_off_store_install_allow_reason(
+      CrxInstaller::OffStoreInstallAllowedFromSettingsPage);
 
   const bool kCaseSensitive = false;
 
   // Have to use EndsWith() because FilePath::Extension() would return ".js" for
   // "foo.user.js".
   if (EndsWith(file_to_install_.BaseName().value(),
                FILE_PATH_LITERAL(".user.js"),
                kCaseSensitive)) {
     crx_installer->InstallUserScript(
         file_to_install_,
         net::FilePathToFileURL(file_to_install_));
   } else if (EndsWith(file_to_install_.BaseName().value(),
                       FILE_PATH_LITERAL(".crx"),
                       kCaseSensitive)) {
     crx_installer->InstallCrx(file_to_install_);
   } else {
     CHECK(false);
   }
 
   file_to_install_.clear();
 }