Merge "Import translations. DO NOT MERGE" into nyc-dev
diff --git a/res/layout/trusted_credential.xml b/res/layout/trusted_credential.xml
index ea13939..cc146f8 100644
--- a/res/layout/trusted_credential.xml
+++ b/res/layout/trusted_credential.xml
@@ -15,37 +15,37 @@
 -->
 <LinearLayout
     xmlns:android="http://schemas.android.com/apk/res/android"
-    android:layout_width="fill_parent"
+    android:layout_width="match_parent"
     android:layout_height="wrap_content"
     android:gravity="center_vertical"
     android:background="?android:attr/selectableItemBackground"
     android:paddingStart="?android:attr/listPreferredItemPaddingStart"
     android:paddingEnd="?android:attr/listPreferredItemPaddingEnd"
     android:paddingTop="15dip"
-    android:paddingBottom="15dip">
+    android:paddingBottom="15dip"
+    android:orientation="horizontal">
 
-    <RelativeLayout
-        android:layout_width="0px"
+    <LinearLayout
+        android:layout_width="0dp"
         android:layout_height="wrap_content"
-        android:layout_weight="1">
+        android:layout_weight="1"
+        android:orientation="vertical">
 
         <TextView
             android:id="@+id/trusted_credential_subject_primary"
-            android:layout_width="fill_parent"
+            android:layout_width="wrap_content"
             android:layout_height="wrap_content"
-            android:layout_weight="1"
-            android:textAppearance="?android:attr/textAppearanceMedium" />
+            android:textAppearance="?android:attr/textAppearanceMedium"
+            android:textAlignment="viewStart"/>
 
         <TextView
             android:id="@+id/trusted_credential_subject_secondary"
-            android:layout_width="fill_parent"
+            android:layout_width="wrap_content"
             android:layout_height="wrap_content"
-            android:layout_below="@id/trusted_credential_subject_primary"
-            android:layout_alignStart="@id/trusted_credential_subject_primary"
             android:textAppearance="?android:attr/textAppearanceSmall"
-            android:textColor="?android:attr/textColorSecondary" />
-
-    </RelativeLayout>
+            android:textColor="?android:attr/textColorSecondary"
+            android:textAlignment="viewStart"/>
+    </LinearLayout>
 
     <!-- Switch is invisible and not gone so that the height is consistent between tabs -->
     <Switch
diff --git a/src/com/android/settings/MonitoringCertInfoActivity.java b/src/com/android/settings/MonitoringCertInfoActivity.java
index 2392397..aea2a37 100644
--- a/src/com/android/settings/MonitoringCertInfoActivity.java
+++ b/src/com/android/settings/MonitoringCertInfoActivity.java
@@ -27,6 +27,8 @@
 import android.os.UserHandle;
 import android.provider.Settings;
 
+import com.android.settingslib.RestrictedLockUtils;
+
 /**
  * Activity that shows a dialog explaining that a CA cert is allowing someone to monitor network
  * traffic. This activity should be launched for the user into which the CA cert is installed
@@ -46,8 +48,10 @@
         DevicePolicyManager dpm = getSystemService(DevicePolicyManager.class);
         final int numberOfCertificates = getIntent().getIntExtra(
                 Settings.EXTRA_NUMBER_OF_CERTIFICATES, 1);
-        final CharSequence title = getResources().getQuantityText(
-                R.plurals.ssl_ca_cert_dialog_title, numberOfCertificates);
+        final int titleId = RestrictedLockUtils.getProfileOrDeviceOwner(this, mUserId) != null
+                ? R.plurals.ssl_ca_cert_settings_button // Check certificate
+                : R.plurals.ssl_ca_cert_dialog_title; // Trust or remove certificate
+        final CharSequence title = getResources().getQuantityText(titleId, numberOfCertificates);
         setTitle(title);
 
         final AlertDialog.Builder builder = new AlertDialog.Builder(this);
diff --git a/src/com/android/settings/TrustedCredentialsDialogBuilder.java b/src/com/android/settings/TrustedCredentialsDialogBuilder.java
index da557fe..31042cb 100644
--- a/src/com/android/settings/TrustedCredentialsDialogBuilder.java
+++ b/src/com/android/settings/TrustedCredentialsDialogBuilder.java
@@ -34,6 +34,7 @@
 
 import com.android.internal.widget.LockPatternUtils;
 import com.android.settings.TrustedCredentialsSettings.CertHolder;
+import com.android.settingslib.RestrictedLockUtils;
 
 import java.security.cert.X509Certificate;
 import java.util.ArrayList;
@@ -221,10 +222,11 @@
                     && isUserSecure(certHolder.getUserId())
                     && !mDpm.isCaCertApproved(certHolder.getAlias(), certHolder.getUserId());
 
-            // The ok button is optional. User can still dismiss the dialog by other means.
-            // Display it only when trust button is not displayed, because we want users to
-            // either remove or trust a CA cert when the cert is installed by DPC app.
-            CharSequence displayText = mActivity.getText(mNeedsApproval
+            final boolean isProfileOrDeviceOwner = RestrictedLockUtils.getProfileOrDeviceOwner(
+                    mActivity, certHolder.getUserId()) != null;
+
+            // Show trust button only when it requires consumer user (non-PO/DO) to approve
+            CharSequence displayText = mActivity.getText(!isProfileOrDeviceOwner && mNeedsApproval
                     ? R.string.trusted_credentials_trust_label
                     : android.R.string.ok);
             mPositiveButton = updateButton(DialogInterface.BUTTON_POSITIVE, displayText);
diff --git a/src/com/android/settings/vpn2/AppManagementFragment.java b/src/com/android/settings/vpn2/AppManagementFragment.java
index 8ad64d4..fa43129 100644
--- a/src/com/android/settings/vpn2/AppManagementFragment.java
+++ b/src/com/android/settings/vpn2/AppManagementFragment.java
@@ -15,21 +15,15 @@
  */
 package com.android.settings.vpn2;
 
-import android.annotation.NonNull;
 import android.app.AlertDialog;
 import android.app.AppOpsManager;
 import android.app.Dialog;
 import android.app.DialogFragment;
-import android.app.Notification;
-import android.app.NotificationManager;
-import android.app.PendingIntent;
 import android.content.Context;
 import android.content.DialogInterface;
-import android.content.Intent;
 import android.content.pm.PackageInfo;
 import android.content.pm.PackageManager;
 import android.content.pm.PackageManager.NameNotFoundException;
-import android.content.res.Resources;
 import android.net.ConnectivityManager;
 import android.os.Bundle;
 import android.os.UserHandle;
@@ -42,16 +36,17 @@
 import com.android.internal.net.VpnConfig;
 import com.android.settings.R;
 import com.android.settings.SettingsPreferenceFragment;
+import com.android.settings.Utils;
+import com.android.settingslib.RestrictedLockUtils;
 import com.android.settingslib.RestrictedSwitchPreference;
 import com.android.settingslib.RestrictedPreference;
-import com.android.settings.Utils;
 
 import java.util.List;
 
 import static android.app.AppOpsManager.OP_ACTIVATE_VPN;
 
 public class AppManagementFragment extends SettingsPreferenceFragment
-        implements Preference.OnPreferenceClickListener {
+        implements Preference.OnPreferenceChangeListener, Preference.OnPreferenceClickListener {
 
     private static final String TAG = "AppManagementFragment";
 
@@ -116,7 +111,7 @@
         mPreferenceAlwaysOn = (RestrictedSwitchPreference) findPreference(KEY_ALWAYS_ON_VPN);
         mPreferenceForget = (RestrictedPreference) findPreference(KEY_FORGET_VPN);
 
-        mPreferenceAlwaysOn.setOnPreferenceClickListener(this);
+        mPreferenceAlwaysOn.setOnPreferenceChangeListener(this);
         mPreferenceForget.setOnPreferenceClickListener(this);
     }
 
@@ -140,8 +135,6 @@
         switch (key) {
             case KEY_FORGET_VPN:
                 return onForgetVpnClick();
-            case KEY_ALWAYS_ON_VPN:
-                return onAlwaysOnVpnClick();
             default:
                 Log.w(TAG, "unknown key is clicked: " + key);
                 return false;
@@ -149,44 +142,71 @@
     }
 
     @Override
+    public boolean onPreferenceChange(Preference preference, Object newValue) {
+        switch (preference.getKey()) {
+            case KEY_ALWAYS_ON_VPN:
+                return onAlwaysOnVpnClick((Boolean) newValue);
+            default:
+                Log.w(TAG, "unknown key is clicked: " + preference.getKey());
+                return false;
+        }
+    }
+
+    @Override
     protected int getMetricsCategory() {
         return MetricsEvent.VPN;
     }
 
     private boolean onForgetVpnClick() {
+        updateRestrictions();
+        if (!mPreferenceForget.isEnabled()) {
+            return false;
+        }
         AppDialogFragment.show(this, mForgetVpnDialogFragmentListener, mPackageInfo, mVpnLabel,
                 true /* editing */, true);
         return true;
     }
 
-    private boolean onAlwaysOnVpnClick() {
-        final boolean isChecked = mPreferenceAlwaysOn.isChecked();
+    private boolean onAlwaysOnVpnClick(final boolean isChecked) {
         if (isChecked && isLegacyVpnLockDownOrAnotherPackageAlwaysOn()) {
             // Show dialog if user replace always-on-vpn package and show not checked first
-            mPreferenceAlwaysOn.setChecked(false);
             ReplaceExistingVpnFragment.show(this);
+            return false;
         } else {
-            setAlwaysOnVpnByUI(isChecked);
+            return setAlwaysOnVpnByUI(isChecked);
         }
-        return true;
     }
 
-    private void setAlwaysOnVpnByUI(boolean isEnabled) {
+    private boolean setAlwaysOnVpnByUI(boolean isEnabled) {
+        updateRestrictions();
+        if (!mPreferenceAlwaysOn.isEnabled()) {
+            return false;
+        }
         // Only clear legacy lockdown vpn in system user.
         if (mUserId == UserHandle.USER_SYSTEM) {
             VpnUtils.clearLockdownVpn(getContext());
         }
-        mConnectivityManager.setAlwaysOnVpnPackageForUser(mUserId, isEnabled ? mPackageName : null,
-                /* lockdownEnabled */ false);
-        if (isEnabled && !isVpnAlwaysOn()) {
+        final boolean success = mConnectivityManager.setAlwaysOnVpnPackageForUser(mUserId,
+                isEnabled ? mPackageName : null, /* lockdownEnabled */ false);
+        if (isEnabled && (!success || !isVpnAlwaysOn())) {
             CannotConnectFragment.show(this, mVpnLabel);
         }
-        updateUI();
+        return success;
     }
 
     private void updateUI() {
         if (isAdded()) {
             mPreferenceAlwaysOn.setChecked(isVpnAlwaysOn());
+            updateRestrictions();
+        }
+    }
+
+    private void updateRestrictions() {
+        if (isAdded()) {
+            mPreferenceAlwaysOn.checkRestrictionAndSetDisabled(UserManager.DISALLOW_CONFIG_VPN,
+                    mUserId);
+            mPreferenceForget.checkRestrictionAndSetDisabled(UserManager.DISALLOW_CONFIG_VPN,
+                    mUserId);
         }
     }
 
@@ -300,7 +320,10 @@
         @Override
         public void onClick(DialogInterface dialog, int which) {
             if (getTargetFragment() instanceof AppManagementFragment) {
-                ((AppManagementFragment) getTargetFragment()).setAlwaysOnVpnByUI(true);
+                final AppManagementFragment target = (AppManagementFragment) getTargetFragment();
+                if (target.setAlwaysOnVpnByUI(true)) {
+                    target.updateUI();
+                }
             }
         }
     }