user32: Do not allow a change of capture if the currently capture window is a menu unless explicitly specified.
diff --git a/server/queue.c b/server/queue.c
index d880dff..cfe9818 100644
--- a/server/queue.c
+++ b/server/queue.c
@@ -2145,6 +2145,12 @@
{
struct thread_input *input = queue->input;
+ /* if in menu mode, reject all requests to change focus, except if the menu bit is set */
+ if (input->menu_owner && !(req->flags & CAPTURE_MENU))
+ {
+ set_error(STATUS_ACCESS_DENIED);
+ return;
+ }
reply->previous = input->capture;
input->capture = get_user_full_handle( req->handle );
input->menu_owner = (req->flags & CAPTURE_MENU) ? input->capture : 0;