Changeset 57313 in webkit

Timestamp:

Apr 8, 2010 11:43:19 PM (14 years ago)

Author:

abarth@webkit.org

Message:

2010-04-08 Chris Evans <​cevans@chromium.org>

Reviewed by Sam Weinig.

Add test for POST & _blank popup blocker bypass.
​https://bugs.webkit.org/show_bug.cgi?id=34541

• fast/events/popup-blocked-to-post-blank.html: added
• fast/events/popup-blocked-to-post-blank-expected.txt: added

2010-04-08 Chris Evans <​cevans@chromium.org>

Reviewed by Sam Weinig.

Use the new UserGestureIndictor for _blank POST requests.

​https://bugs.webkit.org/show_bug.cgi?id=34541

Test: fast/events/popup-blocked-to-post-blank.html

• bindings/v8/ScriptController.cpp: (WebCore::ScriptController::processingUserGesture): Use UserGestureIndicator in more cases.
• page/EventHandler.cpp: (WebCore::EventHandler): Impact from UserGestureIndicator API change. (WebCore::FrameLoader::submitForm): Block the load immediately if popups are not allowed and it would open a new window.
• loader/RedirectScheduler.cpp: (WebCore::ScheduledFormSubmission::ScheduledFormSubmission): Note the UserGestureIndicator status at the time of submission. (WebCore::ScheduledFormSubmission::fire): Use the stored UserGestureIndicator status in the asynchronous callback.
• dom/UserGestureIndicator.h:
• dom/UserGestureIndicator.cpp: (WebCore::UserGestureIndicator::UserGestureIndicator): Add ability to store a negative indication.

Location:

trunk

Files:

• LayoutTests/ChangeLog (modified) (1 diff)
• LayoutTests/fast/events/popup-blocked-to-post-blank-expected.txt (added)
• LayoutTests/fast/events/popup-blocked-to-post-blank.html (added)
• WebCore/ChangeLog (modified) (1 diff)
• WebCore/bindings/v8/ScriptController.cpp (modified) (1 diff)
• WebCore/dom/UserGestureIndicator.cpp (modified) (1 diff)
• WebCore/dom/UserGestureIndicator.h (modified) (1 diff)
• WebCore/loader/FrameLoader.cpp (modified) (1 diff)
• WebCore/loader/RedirectScheduler.cpp (modified) (4 diffs)
• WebCore/page/EventHandler.cpp (modified) (5 diffs)

trunk/LayoutTests/ChangeLog

@@ +1 @@
+2010-04-08  Chris Evans  <cevans@chromium.org>
+
+        Reviewed by Sam Weinig.
+
+        Add test for POST & _blank popup blocker bypass.
+        https://bugs.webkit.org/show_bug.cgi?id=34541
+
+        * fast/events/popup-blocked-to-post-blank.html: added
+        * fast/events/popup-blocked-to-post-blank-expected.txt: added
+
 2010-04-08  Ojan Vafai  <ojan@chromium.org>
 

trunk/WebCore/ChangeLog

@@ +1 @@
+2010-04-08  Chris Evans  <cevans@chromium.org>
+
+        Reviewed by Sam Weinig.
+
+        Use the new UserGestureIndictor for _blank POST requests.
+
+        https://bugs.webkit.org/show_bug.cgi?id=34541
+
+        Test: fast/events/popup-blocked-to-post-blank.html
+
+        * bindings/v8/ScriptController.cpp:
+        (WebCore::ScriptController::processingUserGesture):
+          Use UserGestureIndicator in more cases.
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler):
+          Impact from UserGestureIndicator API change.
+        (WebCore::FrameLoader::submitForm):
+          Block the load immediately if popups are not allowed and it would
+          open a new window.
+        * loader/RedirectScheduler.cpp:
+        (WebCore::ScheduledFormSubmission::ScheduledFormSubmission):
+          Note the UserGestureIndicator status at the time of submission.
+        (WebCore::ScheduledFormSubmission::fire):
+          Use the stored UserGestureIndicator status in the asynchronous
+          callback.
+        * dom/UserGestureIndicator.h:
+        * dom/UserGestureIndicator.cpp:
+        (WebCore::UserGestureIndicator::UserGestureIndicator):
+          Add ability to store a negative indication.
+
 2010-03-29  Antonio Gomes  <tonikitoo@webkit.org>
 

trunk/WebCore/bindings/v8/ScriptController.cpp

@@ -155 +155 @@
 {
     Frame* activeFrame = V8Proxy::retrieveFrameForEnteredContext();
-    // No script is running, so it must be run by users.
+    // No script is running, so it is user-initiated unless the gesture stack
+    // explicitly says it is not.
     if (!activeFrame)
-        return true;
+        return UserGestureIndicator::processingUserGesture();
 
     V8Proxy* activeProxy = activeFrame->script()->proxy();

trunk/WebCore/dom/UserGestureIndicator.cpp

@@ -31 +31 @@
 bool UserGestureIndicator::s_processingUserGesture = false;
 
-UserGestureIndicator::UserGestureIndicator()
+UserGestureIndicator::UserGestureIndicator(ProcessingUserGestureState state)
     : m_previousValue(s_processingUserGesture)
 {
-    s_processingUserGesture = true;
+    if (state == DefinitelyProcessingUserGesture)
+        s_processingUserGesture = true;
 }
 

trunk/WebCore/dom/UserGestureIndicator.h

@@ -31 +31 @@
 namespace WebCore {
 
+enum ProcessingUserGestureState {
+    DefinitelyProcessingUserGesture,
+    PossiblyProcessingUserGesture
+};
+
 class UserGestureIndicator : public Noncopyable {
 public:
     static bool processingUserGesture() { return s_processingUserGesture; }
-    
-    UserGestureIndicator();
+
+    explicit UserGestureIndicator(ProcessingUserGestureState);
     ~UserGestureIndicator();
-    
+
 private:
     static bool s_processingUserGesture;

trunk/WebCore/loader/FrameLoader.cpp

@@ -477 +477 @@
         return;
     if (!targetFrame) {
+        if (!DOMWindow::allowPopUp(m_frame) && !isProcessingUserGesture())
+            return;
+
         targetFrame = m_frame;
         frameRequest.setFrameName(targetOrBaseTarget);

trunk/WebCore/loader/RedirectScheduler.cpp

@@ -44 +44 @@
 #include "HTMLFrameOwnerElement.h"
 #include "Page.h"
+#include "UserGestureIndicator.h"
 #include <wtf/CurrentTime.h>
 
@@ -176 +177 @@
         , m_event(event)
         , m_formState(formState)
+        , m_wasProcessingUserGesture(UserGestureIndicator::processingUserGesture())
     {
         ASSERT(!frameRequest.isEmpty());
@@ -183 +185 @@
     virtual void fire(Frame* frame)
     {
+        UserGestureIndicator gestureIndicator(m_wasProcessingUserGesture ? DefinitelyProcessingUserGesture : PossiblyProcessingUserGesture);
+
         // The submitForm function will find a target frame before using the redirection timer.
         // Now that the timer has fired, we need to repeat the security check which normally is done when
@@ -201 +205 @@
     const RefPtr<Event> m_event;
     const RefPtr<FormState> m_formState;
+    bool m_wasProcessingUserGesture;
 };
 

trunk/WebCore/page/EventHandler.cpp

@@ -1167 +1167 @@
 {
     RefPtr<FrameView> protector(m_frame->view());
-    
-    UserGestureIndicator gestureIndicator;
-    
+
+    UserGestureIndicator gestureIndicator(DefinitelyProcessingUserGesture);
+
     cancelFakeMouseMoveEvent();
     m_mousePressed = true;
@@ -1298 +1298 @@
 {
     RefPtr<FrameView> protector(m_frame->view());
-    
-    UserGestureIndicator gestureIndicator;
+
+    UserGestureIndicator gestureIndicator(DefinitelyProcessingUserGesture);
 
     // We get this instead of a second mouse-up 
@@ -1468 +1468 @@
     RefPtr<FrameView> protector(m_frame->view());
     
-    UserGestureIndicator gestureIndicator;
+    UserGestureIndicator gestureIndicator(DefinitelyProcessingUserGesture);
 
 #if ENABLE(PAN_SCROLLING)
@@ -2128 +2128 @@
     if (!node)
         return false;
-    
-    UserGestureIndicator gestureIndicator;
+
+    UserGestureIndicator gestureIndicator(DefinitelyProcessingUserGesture);
 
     if (FrameView* view = m_frame->view())
@@ -2697 +2697 @@
     const Vector<PlatformTouchPoint>& points = event.touchPoints();
     AtomicString* eventName = 0;
-    
-    UserGestureIndicator gestureIndicator;
+
+    UserGestureIndicator gestureIndicator(DefinitelyProcessingUserGesture);
 
     for (unsigned i = 0; i < points.size(); ++i) {