[Payment Request] Require user gesture for skip-UI.
Before this patch, calling `new PaymentRequest(https://foo.com).show()`
without a user gesture could skip the payment sheet and go directly into
the payment handler for https://foo.com, i.e., the skip-UI flow.
This patch passes the user gesture flag from the renderer to the browser
and prevents the skip-UI flow for the cases when show() was called
without a user gesture.
After this patch, calling `new PaymentRequest(https://foo.com).show()`
without a user gesture will show the payment sheet, so the user will
have to explicitly provide the user gesture by tapping the "Pay" button
in the payment sheet before invoking the payment app.
Bug: 828427
Change-Id: Iaea5fe3ede1bbd4b68f2c06f63bde4bd36a38e43
Reviewed-on: https://chromium-review.googlesource.com/993412
Reviewed-by: Chris Palmer <[email protected]>
Reviewed-by: anthonyvd <[email protected]>
Commit-Queue: Rouslan Solomakhin <[email protected]>
Cr-Commit-Position: refs/heads/master@{#547862}diff --git a/components/payments/content/payment_request.h b/components/payments/content/payment_request.h
index 400ae351..3d7fe46 100644
--- a/components/payments/content/payment_request.h
+++ b/components/payments/content/payment_request.h
@@ -65,7 +65,7 @@
std::vector<mojom::PaymentMethodDataPtr> method_data,
mojom::PaymentDetailsPtr details,
mojom::PaymentOptionsPtr options) override;
- void Show() override;
+ void Show(bool is_user_gesture) override;
void UpdateWith(mojom::PaymentDetailsPtr details) override;
void NoUpdatedPaymentDetails() override;
void Abort() override;
@@ -165,6 +165,9 @@
// Whether a completion was already recorded for this Payment Request.
bool has_recorded_completion_ = false;
+ // Whether PaymentRequest.show() was invoked with a user gesture.
+ bool is_show_user_gesture_ = false;
+
base::WeakPtrFactory<PaymentRequest> weak_ptr_factory_;
DISALLOW_COPY_AND_ASSIGN(PaymentRequest);
