From 034e46b0551aa81ee8a21a537dd9e9612600bcd6 Mon Sep 17 00:00:00 2001
From: gorhill <rhill@raymondhill.net>
Date: Sun, 12 Nov 2017 07:44:28 -0500
Subject: [PATCH] mind isTrusted for click events (see
 https://palant.de/2017/11/11/on-web-extensions-shortcomings-and-their-impact-on-add-on-security)

---
 src/js/scriptlets/element-picker.js | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/src/js/scriptlets/element-picker.js b/src/js/scriptlets/element-picker.js
index fbcbddc3f..c3bd4faa8 100644
--- a/src/js/scriptlets/element-picker.js
+++ b/src/js/scriptlets/element-picker.js
@@ -1092,6 +1092,7 @@ var filterChoiceFromEvent = function(ev) {
 /******************************************************************************/
 
 var onDialogClicked = function(ev) {
+    if ( ev.isTrusted === false ) { return; }
 
     // If the dialog is hidden, clicking on it force it to become visible.
     if ( dialog.classList.contains('hide') ) {
@@ -1310,7 +1311,8 @@ var onSvgTouchStartStop = (function() {
                 type: 'touch',
                 target: ev.target,
                 clientX: ev.changedTouches[0].pageX,
-                clientY: ev.changedTouches[0].pageY
+                clientY: ev.changedTouches[0].pageY,
+                isTrusted: ev.isTrusted
             });
             ev.preventDefault();
             return;
@@ -1346,6 +1348,8 @@ var onSvgTouchStartStop = (function() {
 /******************************************************************************/
 
 var onSvgClicked = function(ev) {
+    if ( ev.isTrusted === false ) { return; }
+
     // If zap mode, highlight element under mouse, this makes the zapper usable
     // on touch screens.
     if ( pickerBody.classList.contains('zap') ) {