xdg-activation: distinguish activation and urgency requests

Check if the app that requested a token has provided a valid input
serial and a focused surface. Downgrade activation request to urgency
otherwise.

This is mostly in line with what other Wayland compositors decided to
do, and offers a better security than the original logic.

3 files changed, 12 insertions, 1 deletions

diff --git a/sway/desktop/launcher.c b/sway/desktop/launcher.c
index 4a4255d7..0c02b997 100644
--- a/sway/desktop/launcher.c
+++ b/sway/desktop/launcher.c
@@ -216,6 +216,8 @@ struct launcher_ctx *launcher_ctx_create(struct wlr_xdg_activation_token_v1 *tok
         ctx->fallback_name = strdup(fallback_name);
         ctx->token = token;
         ctx->node = node;
+        // Having surface set means that the focus check in wlroots has passed
+        ctx->had_focused_surface = token->surface != NULL;
 
         ctx->node_destroy.notify = ctx_handle_node_destroy;
         wl_signal_add(&ctx->node->events.destroy, &ctx->node_destroy);
diff --git a/sway/tree/view.c b/sway/tree/view.c
index 5525bf63..4a0d8069 100644
--- a/sway/tree/view.c
+++ b/sway/tree/view.c
@@ -412,6 +412,12 @@ void view_request_activate(struct sway_view *view, struct sway_seat *seat) {
         transaction_commit_dirty();
 }
 
+void view_request_urgent(struct sway_view *view) {
+        if (config->focus_on_window_activation != FOWA_NONE) {
+                view_set_urgent(view, true);
+        }
+}
+
 void view_set_csd_from_server(struct sway_view *view, bool enabled) {
         sway_log(SWAY_DEBUG, "Telling view %p to set CSD to %i", view, enabled);
         if (view->xdg_decoration) {
diff --git a/sway/xdg_activation_v1.c b/sway/xdg_activation_v1.c
index 72c7fa4c..b7c80dd4 100644
--- a/sway/xdg_activation_v1.c
+++ b/sway/xdg_activation_v1.c
@@ -44,8 +44,11 @@ void xdg_activation_v1_handle_request_activate(struct wl_listener *listener,
                 seat = ctx->token->seat ? ctx->token->seat->data : NULL;
         }
 
-        if (seat) {
+        if (seat && ctx->had_focused_surface) {
                 view_request_activate(view, seat);
+        } else {
+                // The token is valid, but cannot be used to activate a window
+                view_request_urgent(view);
         }
 }