From 6b360a9b14e0a881735540bfa5d27a880fadde29 Mon Sep 17 00:00:00 2001
From: Jonathan White <support@dmapps.us>
Date: Sat, 23 Aug 2025 19:17:29 -0400
Subject: [PATCH] Add special error message for untrusted iframes

---
 keepassxc-browser/_locales/en/messages.json    | 4 ++++
 keepassxc-browser/content/fill.js              | 5 ++++-
 keepassxc-browser/content/keepassxc-browser.js | 2 +-
 3 files changed, 9 insertions(+), 2 deletions(-)

diff --git a/keepassxc-browser/_locales/en/messages.json b/keepassxc-browser/_locales/en/messages.json
index 715e50f..af2b34b 100644
--- a/keepassxc-browser/_locales/en/messages.json
+++ b/keepassxc-browser/_locales/en/messages.json
@@ -370,6 +370,10 @@
         "message": "No logins found.",
         "description": "Shown when no credentials are found for the current page."
     },
+    "credentialsBlockedInIframe": {
+        "message": "Credential fill blocked in untrusted iframe.",
+        "description": "Alert message when filling credentials is blocked due to iframe restrictions."
+    },
     "credentialsMultipleFound": {
         "message": "More than one login was found in KeePassXC!",
         "description": "Alert message when trying to fill username and/or password when multiple credentials are found."
diff --git a/keepassxc-browser/content/fill.js b/keepassxc-browser/content/fill.js
index b7846cb..73ddfa8 100644
--- a/keepassxc-browser/content/fill.js
+++ b/keepassxc-browser/content/fill.js
@@ -217,7 +217,7 @@ kpxcFill.fillFromUsernameIcon = async function(combination) {
  */
 kpxcFill.fillInCredentials = async function(combination, predefinedUsername, uuid, passOnly = false) {
     if (kpxc.credentials.length === 0) {
-        kpxcUI.createNotification('error', tr('credentialsNoLoginsFound'));
+        showErrorNotification(`${tr('credentialsNoLoginsFound')} ${document.location.origin}`);
         return;
     }
 
@@ -358,6 +358,9 @@ const showErrorNotification = async function(errorMessage, notificationType = 'e
     const connectedDatabase = await sendMessage('get_connected_database');
     if (!connectedDatabase?.identifier) {
         kpxcUI.createNotification('error', tr('errorCurrentDatabaseNotConnected'));
+    } else if (!await isIframeAllowed()) {
+        // Special error if we are blocking due to iframe
+        kpxcUI.createNotification('error', tr('credentialsBlockedInIframe'));
     } else {
         kpxcUI.createNotification(notificationType, errorMessage);
     }
diff --git a/keepassxc-browser/content/keepassxc-browser.js b/keepassxc-browser/content/keepassxc-browser.js
index b021893..c1a68cc 100755
--- a/keepassxc-browser/content/keepassxc-browser.js
+++ b/keepassxc-browser/content/keepassxc-browser.js
@@ -646,7 +646,7 @@ kpxc.rememberCredentialsFromContextMenu = async function() {
 // Credential Banner can force the retrieval for reloading new/modified credentials.
 kpxc.retrieveCredentials = async function(force = false) {
     if (!await isIframeAllowed()) {
-        return [];
+        return;
     }
 
     kpxc.url = document.location.href;