Only import certificates with Web trust from ONC if the user is managed and matches the enterprise …

chrome/browser/chromeos/cros/onc_network_parser.h

Index: chrome/browser/chromeos/cros/onc_network_parser.h
diff --git a/chrome/browser/chromeos/cros/onc_network_parser.h b/chrome/browser/chromeos/cros/onc_network_parser.h
index af8fd28e0cd20884f55aabf0488d721cb87bb55a..c8190354a24222b0893949fee995be52cdfa2211 100644
--- a/chrome/browser/chromeos/cros/onc_network_parser.h
+++ b/chrome/browser/chromeos/cros/onc_network_parser.h
@@ -60,6 +60,12 @@ class OncNetworkParser : public NetworkParser {
   virtual ~OncNetworkParser();
   static const EnumMapper<PropertyIndex>* property_mapper();
 
+  // Certificates pushed from a policy source with Web trust are only imported
+  // with ParseCertificate() if this permission is granted.
+  void set_allow_web_trust_from_policy(bool allow) {
+    allow_web_trust_from_policy_ = allow;
+  }
+
   // Returns the number of networks in the "NetworkConfigs" list.
   int GetNetworkConfigsSize() const;
 
@@ -226,6 +232,10 @@ class OncNetworkParser : public NetworkParser {
   // Where the ONC blob comes from.
   NetworkUIData::ONCSource onc_source_;
 
+  // Whether certificates with Web trust should be stored when pushed from a
+  // policy source.
+  bool allow_web_trust_from_policy_;
+
   scoped_ptr<base::DictionaryValue> root_dict_;
   base::ListValue* network_configs_;
   base::ListValue* certificates_;