From c94bea0a1bea95308c67af8a03cf25c39a88f30f Mon Sep 17 00:00:00 2001
From: Joas Schilling <coding@schilljs.com>
Date: Fri, 26 Jun 2026 12:36:50 +0200
Subject: [PATCH] fix(config): Decrypt sensitive appconfigs when requested

Signed-off-by: Joas Schilling <coding@schilljs.com>
---
 build/psalm-baseline.xml                      |  4 ----
 core/Command/Config/ListConfigs.php           |  2 +-
 lib/private/AppConfig.php                     |  7 +++++++
 tests/Core/Command/Config/ListConfigsTest.php | 12 ++++++------
 4 files changed, 14 insertions(+), 11 deletions(-)

diff --git a/build/psalm-baseline.xml b/build/psalm-baseline.xml
index 0baef5b023446..49e45aad9f0b2 100644
--- a/build/psalm-baseline.xml
+++ b/build/psalm-baseline.xml
@@ -3002,11 +3002,7 @@
   <file src="core/Command/Config/ListConfigs.php">
     <DeprecatedMethod>
       <code><![CDATA[getFilteredValues]]></code>
-      <code><![CDATA[getValues]]></code>
     </DeprecatedMethod>
-    <FalsableReturnStatement>
-      <code><![CDATA[$this->appConfig->getValues($app, false)]]></code>
-    </FalsableReturnStatement>
   </file>
   <file src="core/Command/Db/ConvertType.php">
     <DeprecatedMethod>
diff --git a/core/Command/Config/ListConfigs.php b/core/Command/Config/ListConfigs.php
index 9e56e47660f72..9003ec49c938d 100644
--- a/core/Command/Config/ListConfigs.php
+++ b/core/Command/Config/ListConfigs.php
@@ -132,7 +132,7 @@ protected function getAppConfigs(string $app, bool $noSensitiveValues) {
 		if ($noSensitiveValues) {
 			return $this->appConfig->getFilteredValues($app);
 		} else {
-			return $this->appConfig->getValues($app, false);
+			return $this->appConfig->getAllValues($app);
 		}
 	}
 
diff --git a/lib/private/AppConfig.php b/lib/private/AppConfig.php
index 01015aa944019..d5655ac94f188 100644
--- a/lib/private/AppConfig.php
+++ b/lib/private/AppConfig.php
@@ -265,6 +265,13 @@ function (string $key) use ($prefix): bool {
 		);
 
 		if (!$filtered) {
+			foreach ($values as $key => $value) {
+				$sensitive = $this->isSensitive($app, $key, null);
+				if ($sensitive && is_string($value) && str_starts_with($value, self::ENCRYPTION_PREFIX)) {
+					$values[$key] = $this->crypto->decrypt(substr($value, self::ENCRYPTION_PREFIX_LENGTH));
+				}
+			}
+
 			return $values;
 		}
 
diff --git a/tests/Core/Command/Config/ListConfigsTest.php b/tests/Core/Command/Config/ListConfigsTest.php
index 555710132f0b8..d08911a53a66f 100644
--- a/tests/Core/Command/Config/ListConfigsTest.php
+++ b/tests/Core/Command/Config/ListConfigsTest.php
@@ -107,10 +107,10 @@ public static function listData(): array {
 				],
 				// app config
 				[
-					['files', false, [
+					['files', [
 						'enabled' => 'yes',
 					]],
-					['core', false, [
+					['core', [
 						'global_cache_gc_lastrun' => '1430388388',
 					]],
 				],
@@ -243,10 +243,10 @@ public static function listData(): array {
 				],
 				// app config
 				[
-					['files', false, [
+					['files', [
 						'enabled' => 'yes',
 					]],
-					['core', false, [
+					['core', [
 						'global_cache_gc_lastrun' => '1430388388',
 					]],
 				],
@@ -281,7 +281,7 @@ public function testList($app, $systemConfigs, $systemConfigMap, $appConfig, $pr
 				->method('getValue')
 				->willReturnMap($systemConfigMap);
 			$this->appConfig->expects($this->any())
-				->method('getValues')
+				->method('getAllValues')
 				->willReturnMap($appConfig);
 		} else {
 			$this->systemConfig->expects($this->any())
@@ -296,7 +296,7 @@ public function testList($app, $systemConfigs, $systemConfigMap, $appConfig, $pr
 			->method('getApps')
 			->willReturn(['core', 'files']);
 		$this->appConfig->expects($this->any())
-			->method('getValues')
+			->method('getAllValues')
 			->willReturnMap($appConfig);
 
 		$this->consoleInput->expects($this->once())