Prevent screen capture on Windows and macOS

[smlu]

On Windows this PR makes KeePassXC main window and all it's child windows invisible for screen recording and screen shooting.
This is done by capturing native events WM_NCCREATE & WM_ENTERIDLE, and set WDA_EXCLUDEFROMCAPTURE display affinity flag via SetWindowDisplayAffinity to the window in action or modal dialog. If for any reason the screen capturing of an app is desired i.e. demonstration, app should be run with --allow-screencapture argument. When screen capturing for the app is enabled a persistent warning is displayed to the user, and title bar text of every displayed window is modified to contain text [Screen Capture Allowed]. The title bar text is also modified to contain the same text In-app warning is displayed in case of an error occurs during the call to SetWindowDisplayAffinity function.

fix #5859

Screenshots

Demonstration of stealth mode vs running with --allow-screencapture arg:

Testing strategy

The implementation was tested using Snipping Tool app, making print screen via keyboard shortcut and using ScreenToGif screen recording app.

Type of change

• ✅ New feature (change that adds functionality)

[smlu]

Didn't have time to test this, but on the macOS the same could possible be achieved via undocumented API function CGSSetWindowCaptureExcludeShape. Here is an example code sample: https://github.com/heardrwt/RHAdditions/blob/69bed50e5f70304d3c3cf64e74e2005a8ec525eb/RHAdditions/NSWindow%2BRHPreventCaptureAdditions.m

[c3X69puyujLWudBjwQEjmTUgEXr49cGa74EqHiL]

this would be good to have

[droidmonkey]

I greatly simplified your code and made it far less Windows centric. Will see if the macOS implementation can be added as well.

[droidmonkey]

Got it! macOS screenshot protection enabled :-D

[smlu]

Awesome!

[smlu]

I greatly simplified your code and made it far less Windows centric. Will see if the macOS implementation can be added as well.

I've tested your changes and I found 1 problem. On windows, the modal windows of system file dialogs are not hidden from being captured by the screen recorder. For example when you browse for DB file or key file. I don't know if this is also the problem on macOS. This was the reason why I decided to handle prevention of app's screen being captured via native event filter. On Windows, I couldn't find any other way to do this through Qt framework and capture the native modal dialog belonging to the app being displayed. You don't get any signal or event whatsoever to notify you that another system dialog has opened that belongs to your app. So, the only solution I saw was to capture the native event WM_ENTERIDLE (WinUtils.cpp#L105) and hide the dialog that made the app idle. It's also possible there is some better solution to this problem, and I just didn't find it.

[thetuxinator]

Because of this feature, screensharing for example using Teams or Skype and co is no more possible as the Keeshare Window is also shown as a black window only in those cases so there should be a way to disable and enable it.

[thetuxinator]

Just discovered --allow-screencapture option from above, which also works in those cases

[2BeeOrNot]

Just tried 2.7.0 on macOS and wanted to make a screen capture to report a display issue and had a what the heck moment. I can't make a screen capture. Poking around and searching here I found this PR. Can/should there be an option in KPXC to allow screen captures instead of using terminal to start KPXC with --allow-screencapture? Won't this confuse users who want to make screen captures for training, documentation, whatever? How will users know to use --allow-screencapture from terminal?

[droidmonkey]

I just added it to our documentation so that's how.

[Kellett]

Just upgraded to 2.7 and had to spend a while trying to work out why this wasn't visible on any remote machines. Is there a setting to always open with "--allow-screencapture" without having to edit the auto-start entries / shortcuts?

[phoerious]

You add the flag to KeePassXC's auto-start entry.

[michaelk83]

You add the flag to KeePassXC's auto-start entry.

Or preferably, make a separate shortcut for only when that switch is actually needed.

[droidmonkey]

Create your own shortcuts, we aren't in the business of making it easy to circumvent a security feature. Actually wanting to screen record your database is very rare.

[Kellett]

I don't want to screen record the database. That probably is a rare thing. I just want to use it over a remote desktop connection. I can edit the shortcuts if that is the only option. I was just hoping there was a easier option.

[qohjjang]

Create your own shortcuts, we aren't in the business of making it easy to circumvent a security feature. Actually wanting to screen record your database is very rare.

Thanks for working hard to make this feature available.
It is actually very frustrating when you want to capture a screenshot of an entity (or remote access for that matter). Adding a shortcut to open it again is also not very good solution, as you may forget to close it again to prevent it.
As a user perspective, there should be an option that a user can tick it on/off on Setting or menu somewhere.

[marketbusiness]

Just discovered --allow-screencapture option from above, which also works in those cases

Hello, how do you use the --allow-screencapture command on a windows shortcut. I use keepass via team wiever but with this option set up it is impossible for me to use it

[michaelk83]

tldr: https://superuser.com/a/29571/1271887
step by step: https://www.digitalcitizen.life/shortcut-arguments-parameters-windows/