fix(pgp): prevent plaintext fallback in PGP/OX encryption

Block all three code paths in message_send_chat_pgp that previously
fell back to sending unencrypted messages: encryption failure, missing
PGP key, and missing LibGPGME. Each path now shows a specific error
in the chat window and returns NULL so the caller skips logging and
display.

Also replace the generic cons_show for OX signcrypt failure with a
win_println on the current window, ensuring the user sees the error
even when the chat window is not focused.

Improve p_gpg_encrypt error reporting by adding a gchar** err
out-parameter. Each failure path now sets a descriptive message
(e.g. missing recipient key, missing sender key, GPGME context
failure, encryption failure) so the caller can display the exact
reason to the user.

Fix a memory leak: gpgme_key_unref(receiver_key) was missing from
the sender_key failure path.

src/gitversion.h.in

@@ -1,6 +0,0 @@
-#ifndef PROF_GIT_BRANCH
-#define PROF_GIT_BRANCH @PROF_GIT_BRANCH@
-#endif
-#ifndef PROF_GIT_REVISION
-#define PROF_GIT_REVISION @PROF_GIT_REVISION@
-#endif

src/pgp/gpg.c

@@ -519,13 +519,15 @@ p_gpg_sign(const gchar* const str, const gchar* const fp)
 }
 
 gchar*
-p_gpg_encrypt(const gchar* const barejid, const gchar* const message, const gchar* const fp)
+p_gpg_encrypt(const gchar* const barejid, const gchar* const message, const gchar* const fp, gchar** err)
 {
     ProfPGPPubKeyId* pubkeyid = g_hash_table_lookup(pubkeys, barejid);
     if (!pubkeyid) {
+        *err = g_strdup("No PGP key found for recipient");
         return NULL;
     }
     if (!pubkeyid->id) {
+        *err = g_strdup("No key ID found for recipient");
         return NULL;
     }
 
@@ -538,6 +540,7 @@ p_gpg_encrypt(const gchar* const barejid, const gchar* const message, const gcha
     gpgme_ctx_t ctx;
     gpgme_error_t error = gpgme_new(&ctx);
     if (error) {
+        *err = g_strdup_printf("Failed to create GPGME context: %s %s", gpgme_strsource(error), gpgme_strerror(error));
         log_error("GPG: Failed to create gpgme context. %s %s", gpgme_strsource(error), gpgme_strerror(error));
         return NULL;
     }
@@ -545,6 +548,7 @@ p_gpg_encrypt(const gchar* const barejid, const gchar* const message, const gcha
     gpgme_key_t receiver_key;
     error = gpgme_get_key(ctx, pubkeyid->id, &receiver_key, 0);
     if (error || receiver_key == NULL) {
+        *err = g_strdup_printf("Failed to get receiver key '%s': %s %s", pubkeyid->id, gpgme_strsource(error), gpgme_strerror(error));
         log_error("GPG: Failed to get receiver_key. %s %s", gpgme_strsource(error), gpgme_strerror(error));
         gpgme_release(ctx);
         return NULL;
@@ -554,8 +558,10 @@ p_gpg_encrypt(const gchar* const barejid, const gchar* const message, const gcha
     gpgme_key_t sender_key = NULL;
     error = gpgme_get_key(ctx, fp, &sender_key, 0);
     if (error || sender_key == NULL) {
+        *err = g_strdup_printf("Failed to get sender key '%s': %s %s", fp, gpgme_strsource(error), gpgme_strerror(error));
         log_error("GPG: Failed to get sender_key. %s %s", gpgme_strsource(error), gpgme_strerror(error));
         gpgme_release(ctx);
+        gpgme_key_unref(receiver_key);
         return NULL;
     }
     keys[1] = sender_key;
@@ -574,7 +580,8 @@ p_gpg_encrypt(const gchar* const barejid, const gchar* const message, const gcha
     gpgme_key_unref(sender_key);
 
     if (error) {
-        log_error("GPG: Failed to encrypt message. %s %s", gpgme_strsource(error), gpgme_strerror(error));
+        *err = g_strdup_printf("Encryption failed: (%s) %s", gpgme_strsource(error), gpgme_strerror(error));
+        log_error("GPG: Failed to encrypt message. (%s) %s", gpgme_strsource(error), gpgme_strerror(error));
         return NULL;
     }
 

src/pgp/gpg.h

@@ -42,7 +42,7 @@ gboolean p_gpg_available(const gchar* const barejid);
 const gchar* p_gpg_libver(void);
 gchar* p_gpg_sign(const gchar* const str, const gchar* const fp);
 void p_gpg_verify(const gchar* const barejid, const gchar* const sign);
-gchar* p_gpg_encrypt(const gchar* const barejid, const gchar* const message, const gchar* const fp);
+gchar* p_gpg_encrypt(const gchar* const barejid, const gchar* const message, const gchar* const fp, gchar** err);
 gchar* p_gpg_decrypt(const gchar* const cipher);
 void p_gpg_free_decrypted(gchar* decrypted);
 gchar* p_gpg_autocomplete_key(const gchar* const search_str, gboolean previous, void* context);

src/ui/window.c

@@ -43,7 +43,7 @@
 #include "ai/ai_client.h"
 
 static const int PAD_MIN_HEIGHT = 100;
-static const int PAD_THRESHOLD = 12000; // above buffer cap (~9000): reclaims dead pad space, never fires while scrolling
+static const int PAD_DEAD_SPACE_LIMIT = 2000; // reclaim once the pad holds this much dead space (cursor past live buffer); size-independent, so it never fires while scrolling
 static gboolean _in_redraw = FALSE;
 
 static void
@@ -56,9 +56,10 @@ _win_ensure_pad_capacity(ProfWin* window, WINDOW* win, int lines_needed)
     int cur_height = getmaxy(win);
     int cur_width = getmaxx(win);
     if (lines_needed >= cur_height - 1) {
-        // If we are getting too large, trigger a redraw to clean up old lines
-        // but only if we are not already in a redraw process.
-        if (window && cur_height >= PAD_THRESHOLD && !_in_redraw) {
+        // redraw to reclaim dead pad space (cursor far past live buffer, e.g. a long
+        // append-only session); dead space never accrues while scrolling, only here
+        int dead = window ? getcury(win) - window->layout->buffer->lines : 0;
+        if (window && dead > PAD_DEAD_SPACE_LIMIT && !_in_redraw) {
             win_redraw(window);
         } else {
             // resize to required lines + some buffer for next messages

src/xmpp/iq.c

@@ -99,11 +99,11 @@ static void _disco_items_result_handler(xmpp_stanza_t* const stanza);
 static void _last_activity_get_handler(xmpp_stanza_t* const stanza);
 static void _version_get_handler(xmpp_stanza_t* const stanza);
 static void _ping_get_handler(xmpp_stanza_t* const stanza);
+static void _disco_autoping_warning_message(GHashTable* features);
 
 static int _version_result_id_handler(xmpp_stanza_t* const stanza, void* const userdata);
 static int _disco_info_response_id_handler(xmpp_stanza_t* const stanza, void* const userdata);
 static int _disco_info_response_id_handler_onconnect(xmpp_stanza_t* const stanza, void* const userdata);
-static int _disco_autoping_warning_message(GHashTable* features);
 static int _http_upload_response_id_handler(xmpp_stanza_t* const stanza, void* const upload_ctx);
 static int _last_activity_response_id_handler(xmpp_stanza_t* const stanza, void* const userdata);
 static int _room_info_response_id_handler(xmpp_stanza_t* const stanza, void* const userdata);
@@ -2431,7 +2431,9 @@ _disco_info_response_id_handler_onconnect(xmpp_stanza_t* const stanza, void* con
             child = xmpp_stanza_get_next(child);
         }
 
-        if (!from) {
+        // Prevent repetitions by avoiding checks of disco items (from connection_set_disco_items)
+        const char* domain = connection_get_domain();
+        if (from && domain && g_ascii_strcasecmp(from, domain) == 0) {
             _disco_autoping_warning_message(features);
         }
     }
@@ -2441,20 +2443,19 @@ _disco_info_response_id_handler_onconnect(xmpp_stanza_t* const stanza, void* con
     return 0;
 }
 
-static int
+static void
 _disco_autoping_warning_message(GHashTable* features)
 {
     gboolean server_supports_ping = g_hash_table_contains(features, "urn:xmpp:ping");
-    gboolean users_prefers_warning = prefs_get_boolean(PREF_AUTOPING_WARNING);
+    gboolean user_prefers_warning = prefs_get_boolean(PREF_AUTOPING_WARNING);
     gboolean is_autoping_enabled = prefs_get_autoping() != 0;
 
-    if (!is_autoping_enabled && server_supports_ping && users_prefers_warning) {
+    if (!is_autoping_enabled && server_supports_ping && user_prefers_warning) {
         cons_show("This server supports XEP-0199: XMPP Ping (better keepalive detection),\n"
                   "but autoping feature is currently disabled in settings.\n"
                   "Consider enabling it (e.g., `/autoping set 30`) for improved connection stability.\n"
                   "Use `/autoping warning off` to disable this message.");
     }
-    return 0;
 }
 
 static int

src/xmpp/message.c

@@ -467,12 +467,15 @@ message_send_chat_pgp(const char* const barejid, const char* const msg, gboolean
     auto_char char* jid = chat_session_get_jid(barejid);
     char* id = connection_create_stanza_id();
 
+    ProfWin* current = wins_get_current();
+
     xmpp_stanza_t* message = NULL;
 #ifdef HAVE_LIBGPGME
     ProfAccount* account = accounts_get_account(session_get_account_name());
     if (account->pgp_keyid) {
         auto_jid Jid* jidp = jid_create(jid);
-        auto_gchar gchar* encrypted = p_gpg_encrypt(jidp->barejid, msg, account->pgp_keyid);
+        auto_gchar gchar* err = NULL;
+        auto_gchar gchar* encrypted = p_gpg_encrypt(jidp->barejid, msg, account->pgp_keyid, &err);
         if (encrypted) {
             message = xmpp_message_new(ctx, STANZA_TYPE_CHAT, jid, id);
             xmpp_message_set_body(message, "This message is encrypted (XEP-0027).");
@@ -486,18 +489,31 @@ message_send_chat_pgp(const char* const barejid, const char* const msg, gboolean
             xmpp_stanza_add_child(message, x);
             xmpp_stanza_release(x);
         } else {
-            message = xmpp_message_new(ctx, STANZA_TYPE_CHAT, jid, id);
-            xmpp_message_set_body(message, msg);
+            if (current) {
+                win_println(current, THEME_ERROR, "-", "Unable to encrypt message for %s: %s.", jid, err);
+            }
+            log_error("Message not encrypted for %s: %s.", jid, err);
+            account_free(account);
+            free(id);
+            return NULL;
         }
     } else {
-        message = xmpp_message_new(ctx, STANZA_TYPE_CHAT, jid, id);
-        xmpp_message_set_body(message, msg);
+        if (current) {
+            win_println(current, THEME_ERROR, "-", "No PGP key configured for this account.");
+        }
+        log_error("No PGP key configured, message not sent.");
+        account_free(account);
+        free(id);
+        return NULL;
     }
     account_free(account);
 #else
-    // ?
-    message = xmpp_message_new(ctx, STANZA_TYPE_CHAT, jid, id);
-    xmpp_message_set_body(message, msg);
+    if (current) {
+        win_println(current, THEME_ERROR, "-", "LibGPGME not available, message not sent.");
+    }
+    log_error("LibGPGME not available, message not sent.");
+    free(id);
+    return NULL;
 #endif
 
     if (state) {
@@ -546,7 +562,10 @@ message_send_chat_ox(const char* const barejid, const char* const msg, gboolean
     xmpp_stanza_to_text(signcrypt, &c, &s);
     char* signcrypt_e = p_ox_gpg_signcrypt(account->jid, barejid, c);
     if (signcrypt_e == NULL) {
-        cons_show("Unable to send OX message. Check log file and profanity-ox-setup man page for details.");
+        ProfWin* current = wins_get_current();
+        if (current) {
+            win_println(current, THEME_ERROR, "-", "Unable to send OX message. Check log file and profanity-ox-setup man page for details.");
+        }
         log_error("Message not signcrypted.");
         return NULL;
     }

tests/functionaltests/functionaltests.c

@@ -155,6 +155,8 @@ main(int argc, char* argv[])
         PROF_FUNC_TEST(autoping_warning_not_shown_when_server_unsupported),
         PROF_FUNC_TEST(autoping_warning_not_shown_when_autoping_enabled),
         PROF_FUNC_TEST(autoping_warning_not_shown_when_user_disabled),
+        PROF_FUNC_TEST(autoping_warning_not_shown_for_user_jid),
+        PROF_FUNC_TEST(autoping_warning_not_shown_for_subdomain_service),
 
         /* Service Discovery - XEP-0030 */
         PROF_FUNC_TEST(disco_info_shows_identity),

tests/functionaltests/test_autoping.c

@@ -194,7 +194,7 @@ autoping_warning_not_shown_when_autoping_enabled(void** state)
 void
 autoping_warning_not_shown_when_user_disabled(void** state)
 {
-    // User opted out -> no warning. Command takes on|off ("enable|disable" doc is wrong).
+    // User opted out -> no warning.
     _stub_server_disco(TRUE);
 
     prof_input("/autoping set 0");
@@ -208,3 +208,48 @@ autoping_warning_not_shown_when_user_disabled(void** state)
     prof_timeout(NEGATIVE_ASSERT_TIMEOUT);
     assert_false(prof_output_regex(AUTOPING_WARNING_MATCH));
 }
+
+void
+autoping_warning_not_shown_for_user_jid(void** state)
+{
+    // disco#info from a user JID (with '@') should not trigger the warning,
+    // only server responses (no '@') should.
+    stbbr_for_query("http://jabber.org/protocol/disco#info",
+        "<iq to='stabber@localhost/profanity' type='result' from='buddy1@localhost'>"
+            "<query xmlns='http://jabber.org/protocol/disco#info'>"
+                "<identity category='person' type='chat' name='Buddy1'/>"
+                "<feature var='urn:xmpp:ping'/>"
+            "</query>"
+        "</iq>"
+    );
+
+    prof_input("/autoping set 0");
+    assert_true(prof_output_exact("Autoping disabled."));
+
+    prof_connect();
+
+    prof_timeout(NEGATIVE_ASSERT_TIMEOUT);
+    assert_false(prof_output_regex(AUTOPING_WARNING_MATCH));
+}
+
+void
+autoping_warning_not_shown_for_subdomain_service(void** state)
+{
+    // disco#info from a subdomain service should not trigger the warning, only the server's own domain should
+    stbbr_for_query("http://jabber.org/protocol/disco#info",
+        "<iq to='stabber@localhost/profanity' type='result' from='conf.localhost'>"
+            "<query xmlns='http://jabber.org/protocol/disco#info'>"
+                "<identity category='conference' type='text' name='Conference Service'/>"
+                "<feature var='urn:xmpp:ping'/>"
+            "</query>"
+        "</iq>"
+    );
+
+    prof_input("/autoping set 0");
+    assert_true(prof_output_exact("Autoping disabled."));
+
+    prof_connect();
+
+    prof_timeout(NEGATIVE_ASSERT_TIMEOUT);
+    assert_false(prof_output_regex(AUTOPING_WARNING_MATCH));
+}

tests/functionaltests/test_autoping.h

@@ -8,3 +8,5 @@ void autoping_warning_shown_when_disabled(void** state);
 void autoping_warning_not_shown_when_server_unsupported(void** state);
 void autoping_warning_not_shown_when_autoping_enabled(void** state);
 void autoping_warning_not_shown_when_user_disabled(void** state);
+void autoping_warning_not_shown_for_user_jid(void** state);
+void autoping_warning_not_shown_for_subdomain_service(void** state);