Some records transmitted without user permission

[lazyeugene]

Win7 x64
FF22 + PassIFox 1.1.5
KeePass 2.22 + KeePassHttp 1.8.1.0

I'm getting popup with permission request when PassIFox requests for username/password. But some records it fetches directly without permission request (a balloon with request info - all that I see), I'm 100% sure I didn't give permission earlier because:

1. Today is the first day I use whole this stuff
2. I've rechecked entry settings in KeePass and there is no saved settings for that entry.
   Interesting thing: I've renamed this entry (just added an "https://" prefix to it's title) and after page was reloaded I've got a permission request. I think it is KeePassHttp's responsibility to make a request, so it may be a bug. Or maybe I don't understand something.

[lsgd]

KeePassHttp creates new entries with domain as title.
If you add new credentials via PassIFox to KeePass and your domain is http://www.example.org the created entrys title will be www .example.org. (added white space --> no link)

No matter if KeePassHttp created the entry or not, access to entries is granted automatically if the title contains the domain name of the requested page. This is the only case for which access is granted automatically (despite of the setting you can set for granting access always).

[lazyeugene]

So, if I have an old KeePass DB with many domain-named entries, I need to rename them to something like http://old.domain.name to be sure that acceess will NOT be granted automatically without my permission? And there are no other backdoors?

[lsgd]

It should work with renaming it.
But I'm currently reflecting this behaviour... It does not make sense to grant access automatically to entries which contains the domain name in title. It would be better to set granted access to all entries which are created by KeePassHttp.

[vlna]

The issue still persist. Any item with non-url Title (eg "Sample Entry") returns content without explicit permission. Only option I found is to create Advanced > String fields > Add > KeePassHttp Settings > {"Allow":[],"Deny":["Sample Entry"]} to block access at all. As I know, there is no way to force plugin to ask on every access for these items.

Configuration: Manjaro XFCE, KeePass 2.54, KeeAgent 0.12.1.0, KeePassHttp 1.8.4.2, KeePassNatMsg 2.0.17.0 and python_keepass_http as a client