fix(app): guard the autofill picker against overlays

The picker decides which entry fills the requesting app, so it drops
touches under another app's overlay, as the publisher warning does.
The entry view now uses cachesPassphrase too, so the cache rule lives in
one place, and the publisher warning's app name gets its closing quote.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

3 files changed, 7 insertions, 2 deletions

diff --git a/app/src/main/java/app/passwordstore/ui/autofill/AutofillFilterView.kt b/app/src/main/java/app/passwordstore/ui/autofill/AutofillFilterView.kt
index 880ab2eb..c607b81f 100644
--- a/app/src/main/java/app/passwordstore/ui/autofill/AutofillFilterView.kt
+++ b/app/src/main/java/app/passwordstore/ui/autofill/AutofillFilterView.kt
@@ -101,6 +101,10 @@ class AutofillFilterView : AppCompatActivity() {
 
   override fun onCreate(savedInstanceState: Bundle?) {
     super.onCreate(savedInstanceState)
+    // The picker decides which entry fills the requesting app: drop touches under an overlay, as
+    // the
+    // publisher warning does.
+    window.decorView.filterTouchesWhenObscured = true
     setFinishOnTouchOutside(true)
 
     val params = window.attributes
diff --git a/app/src/main/java/app/passwordstore/ui/entry/EntryViewModel.kt b/app/src/main/java/app/passwordstore/ui/entry/EntryViewModel.kt
index 5714f2a6..6296a9b6 100644
--- a/app/src/main/java/app/passwordstore/ui/entry/EntryViewModel.kt
+++ b/app/src/main/java/app/passwordstore/ui/entry/EntryViewModel.kt
@@ -19,6 +19,7 @@ import app.passwordstore.data.crypto.CryptoRepository
 import app.passwordstore.data.crypto.PGPPassphraseCache
 import app.passwordstore.data.passfile.PasswordEntry
 import app.passwordstore.injection.prefs.SettingsPreferences
+import app.passwordstore.ui.autofill.cachesPassphrase
 import app.passwordstore.util.auth.BiometricAuthenticator.Result as BiometricResult
 import app.passwordstore.util.coroutines.DispatcherProvider
 import app.passwordstore.util.extensions.getString
@@ -123,7 +124,7 @@ constructor(
     this.clearCache = clearCache
     val app = context.applicationContext
     viewModelScope.launch {
-      if (decrypt(passphrase, app) && auth is BiometricResult.Success) {
+      if (decrypt(passphrase, app) && cachesPassphrase(cacheEnabled, auth)) {
         runCatching {
             passphraseCache.cachePassphrase(app, ids.first(), passphrase)
             settings.edit { putBoolean(PreferenceKeys.CLEAR_PASSPHRASE_CACHE, clearCache) }
diff --git a/app/src/main/res/values/strings.xml b/app/src/main/res/values/strings.xml
index 653cf72c..a84f3358 100644
--- a/app/src/main/res/values/strings.xml
+++ b/app/src/main/res/values/strings.xml
@@ -213,7 +213,7 @@
   <string name="oreo_autofill_warning_publisher_header">This app\'s publisher has changed since you first associated a HardenedPass entry with it:</string>
   <string name="oreo_autofill_warning_publisher_footer"><b>The currently installed app may be trying to steal your credentials by pretending to be a trusted app.</b>\n\nTry to uninstall and reinstall the app from a trusted source, such as the Play Store, Amazon Appstore, F-Droid, or your phone manufacturer\'s store.</string>
   <string name="oreo_autofill_warning_publisher_install_time">Installed: %1$s</string>
-  <string name="oreo_autofill_warning_publisher_app_name" translatable="false">“%1$s“</string>
+  <string name="oreo_autofill_warning_publisher_app_name" translatable="false">“%1$s”</string>
   <string name="oreo_autofill_warning_publisher_advanced_info_template" translatable="false">Package:\n%1$s\n\nHash:\n%2$s</string>
   <string name="oreo_autofill_warning_publisher_advanced_info_button">Advanced information</string>
   <string name="oreo_autofill_warning_publisher_changed_disable_autofill_button">Keep Autofill disabled</string>