Changeset 66878 in webkit

Timestamp:

Sep 7, 2010 5:47:17 AM (14 years ago)

Author:

satish@chromium.org

Message:

2010-09-07 Satish Sampath <​satish@chromium.org>

Reviewed by Jeremy Orlow.

Ignore programmatic clicks on speech input button for security reasons.
​https://bugs.webkit.org/show_bug.cgi?id=45181

• fast/speech/speech-button-ignore-generated-events-expected.txt: Added.
• fast/speech/speech-button-ignore-generated-events.html: Added.

2010-09-07 Satish Sampath <​satish@chromium.org>

Reviewed by Jeremy Orlow.

Ignore programmatic clicks on speech input button for security reasons.
​https://bugs.webkit.org/show_bug.cgi?id=45181

Test: fast/speech/speech-button-ignore-generated-events.html

• rendering/TextControlInnerElements.cpp: (WebCore::InputFieldSpeechButtonElement::defaultEventHandler):

Location:

trunk

Files:

• LayoutTests/ChangeLog (modified) (1 diff)
• LayoutTests/fast/speech/speech-button-ignore-generated-events-expected.txt (added)
• LayoutTests/fast/speech/speech-button-ignore-generated-events.html (added)
• WebCore/ChangeLog (modified) (1 diff)
• WebCore/rendering/TextControlInnerElements.cpp (modified) (1 diff)

trunk/LayoutTests/ChangeLog

@@ +1 @@
+2010-09-07  Satish Sampath  <satish@chromium.org>
+
+        Reviewed by Jeremy Orlow.
+
+        Ignore programmatic clicks on speech input button for security reasons.
+        https://bugs.webkit.org/show_bug.cgi?id=45181
+
+        * fast/speech/speech-button-ignore-generated-events-expected.txt: Added.
+        * fast/speech/speech-button-ignore-generated-events.html: Added.
+
 2010-09-07  Pavel Podivilov  <podivilov@chromium.org>
 

trunk/WebCore/ChangeLog

@@ +1 @@
+2010-09-07  Satish Sampath  <satish@chromium.org>
+
+        Reviewed by Jeremy Orlow.
+
+        Ignore programmatic clicks on speech input button for security reasons.
+        https://bugs.webkit.org/show_bug.cgi?id=45181
+
+        Test: fast/speech/speech-button-ignore-generated-events.html
+
+        * rendering/TextControlInnerElements.cpp:
+        (WebCore::InputFieldSpeechButtonElement::defaultEventHandler):
+
 2010-09-07  Kent Hansen  <kent.hansen@nokia.com>
 

trunk/WebCore/rendering/TextControlInnerElements.cpp

@@ -396 +396 @@
 void InputFieldSpeechButtonElement::defaultEventHandler(Event* event)
 {
+    // For privacy reasons, only allow clicks directly coming from the user.
+    if (!event->fromUserGesture()) {
+        HTMLDivElement::defaultEventHandler(event);
+        return;
+    }
+
     // On mouse down, select the text and set focus.
     HTMLInputElement* input = static_cast<HTMLInputElement*>(shadowAncestorNode());