From 529ab9d36f00e9a21f03f271c88ef538fc5503f3 Mon Sep 17 00:00:00 2001
From: Joas Schilling <coding@schilljs.com>
Date: Fri, 26 Jun 2026 12:36:50 +0200
Subject: [PATCH] fix(config): Decrypt sensitive appconfigs when requested

Signed-off-by: Joas Schilling <coding@schilljs.com>
---
 build/psalm-baseline.xml                      |  4 ----
 core/Command/Config/ListConfigs.php           |  2 +-
 lib/private/AppConfig.php                     |  7 +++++++
 tests/Core/Command/Config/ListConfigsTest.php | 12 ++++++------
 4 files changed, 14 insertions(+), 11 deletions(-)

diff --git a/build/psalm-baseline.xml b/build/psalm-baseline.xml
index c1103a9e666..9ee571a33c0 100644
--- a/build/psalm-baseline.xml
+++ b/build/psalm-baseline.xml
@@ -2920,11 +2920,7 @@
     <DeprecatedMethod>
       <code><![CDATA[\OC_App::getAllApps()]]></code>
       <code><![CDATA[getFilteredValues]]></code>
-      <code><![CDATA[getValues]]></code>
     </DeprecatedMethod>
-    <FalsableReturnStatement>
-      <code><![CDATA[$this->appConfig->getValues($app, false)]]></code>
-    </FalsableReturnStatement>
   </file>
   <file src="core/Command/Db/ConvertType.php">
     <DeprecatedMethod>
diff --git a/core/Command/Config/ListConfigs.php b/core/Command/Config/ListConfigs.php
index a7c195276eb..1bb7f774698 100644
--- a/core/Command/Config/ListConfigs.php
+++ b/core/Command/Config/ListConfigs.php
@@ -127,7 +127,7 @@ class ListConfigs extends Base {
 		if ($noSensitiveValues) {
 			return $this->appConfig->getFilteredValues($app);
 		} else {
-			return $this->appConfig->getValues($app, false);
+			return $this->appConfig->getAllValues($app);
 		}
 	}
 
diff --git a/lib/private/AppConfig.php b/lib/private/AppConfig.php
index 1e55e89cc57..a445c33eda1 100644
--- a/lib/private/AppConfig.php
+++ b/lib/private/AppConfig.php
@@ -258,6 +258,13 @@ class AppConfig implements IAppConfig {
 		);
 
 		if (!$filtered) {
+			foreach ($values as $key => $value) {
+				$sensitive = $this->isSensitive($app, $key, null);
+				if ($sensitive && is_string($value) && str_starts_with($value, self::ENCRYPTION_PREFIX)) {
+					$values[$key] = $this->crypto->decrypt(substr($value, self::ENCRYPTION_PREFIX_LENGTH));
+				}
+			}
+
 			return $values;
 		}
 
diff --git a/tests/Core/Command/Config/ListConfigsTest.php b/tests/Core/Command/Config/ListConfigsTest.php
index e4af55116c0..e47c55724c7 100644
--- a/tests/Core/Command/Config/ListConfigsTest.php
+++ b/tests/Core/Command/Config/ListConfigsTest.php
@@ -106,10 +106,10 @@ class ListConfigsTest extends TestCase {
 				],
 				// app config
 				[
-					['files', false, [
+					['files', [
 						'enabled' => 'yes',
 					]],
-					['core', false, [
+					['core', [
 						'global_cache_gc_lastrun' => '1430388388',
 					]],
 				],
@@ -242,10 +242,10 @@ class ListConfigsTest extends TestCase {
 				],
 				// app config
 				[
-					['files', false, [
+					['files', [
 						'enabled' => 'yes',
 					]],
-					['core', false, [
+					['core', [
 						'global_cache_gc_lastrun' => '1430388388',
 					]],
 				],
@@ -280,7 +280,7 @@ class ListConfigsTest extends TestCase {
 				->method('getValue')
 				->willReturnMap($systemConfigMap);
 			$this->appConfig->expects($this->any())
-				->method('getValues')
+				->method('getAllValues')
 				->willReturnMap($appConfig);
 		} else {
 			$this->systemConfig->expects($this->any())
@@ -295,7 +295,7 @@ class ListConfigsTest extends TestCase {
 			->method('getApps')
 			->willReturn(['core', 'files']);
 		$this->appConfig->expects($this->any())
-			->method('getValues')
+			->method('getAllValues')
 			->willReturnMap($appConfig);
 
 		$this->consoleInput->expects($this->once())