Purchase Prompts Hidden Behind CoreGui Menu on Console/Controller

If a developer prompts you to purchase something before or while the CoreGui Menu is open, it will purchase whatever they prompted when you press A despite the purchase prompt behind hidden by the CoreGui Menu.

Reproduction code:

game:GetService("UserInputService").InputBegan:Connect(function(input, gameProcessed)
	if input.KeyCode == Enum.KeyCode.ButtonStart then
		game:GetService("MarketplaceService"):PromptProductPurchase(game.Players.LocalPlayer, 1317026618);
	end
end)

Expected behavior

Purchase prompts should not be possible while the CoreGui Menu is open, or alternatively, button input should only interact with the CoreGui Menu until it is closed.

13 Likes

Roblox shipped a critical clickjack exploit. :grimacing:

I think the ideal behavior is the alternative because that aligns with the behavior of the pc’s escape menu. For context, the escape menu on pc sinks all other bound actions by having the highest input priority.

3 Likes

Yup this has been an issue since 2021/2022. My games have received occasional reports about this behaviour as I bind a product purchase to R2. I fixed several games in 2022 and had to do it again the other day. I cannot reproduce on PS5 or PC with a controller but the following code fixes the issue:

function buy(actionName, actionInputState, actionInputObject)
	if actionInputState == Enum.UserInputState.Begin then
		-- prompt purchase
	end
end
ContextActionService:BindAction("Buy",buy,false,Enum.KeyCode.ButtonR2)

Not checking the UserInputState results in the bug, checking it doesn’t (in my experience)

2 Likes

Interestingly, it appears that this is a widespread issue among Roblox clients. I’ve reported a similar problem on mobile, which resulted in a loss of approximately 9,000 Robux. I hope this post prompts an engineer to investigate the matter.