From 05a45346a5fb2e43fa989abbe8255c8dfd3c155c Mon Sep 17 00:00:00 2001
From: Calixte Denizet <calixte.denizet@gmail.com>
Date: Wed, 23 Apr 2025 15:25:09 +0200
Subject: [PATCH] Disable userActivation before executing a
 setTimeout/setInterval callback

Fixes issue #19850.
---
 src/scripting_api/app.js | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/src/scripting_api/app.js b/src/scripting_api/app.js
index 978025936..72e2505ec 100644
--- a/src/scripting_api/app.js
+++ b/src/scripting_api/app.js
@@ -88,9 +88,10 @@ class App extends PDFObject {
   }
 
   _evalCallback({ callbackId, interval }) {
+    const documentObj = this._document.obj;
     if (callbackId === USERACTIVATION_CALLBACKID) {
       // Special callback id for userActivation stuff.
-      this._document.obj._userActivation = false;
+      documentObj._userActivation = false;
       return;
     }
     const expr = this._timeoutCallbackIds.get(callbackId);
@@ -99,7 +100,12 @@ class App extends PDFObject {
     }
 
     if (expr) {
+      const saveUserActivation = documentObj._userActivation;
+      // A setTimeout/setInterval callback is executed so it can't be a user
+      // choice.
+      documentObj._userActivation = false;
       this._globalEval(expr);
+      documentObj._userActivation = saveUserActivation;
     }
   }