From 04bf3c234f49196dd89de4566c1baf00d45bc3d2 Mon Sep 17 00:00:00 2001
From: johnnyq <johnny@pittpc.com>
Date: Sat, 25 Jul 2026 17:08:22 -0400
Subject: [PATCH] Read API credential decrypt password from body instead of
 query string

Keeps the credential decryption secret out of the URL, so it no longer lands in web-server access logs, proxy logs, or browser history. credentials/read.php now reads api_key_decrypt_password from the request body, matching create/update. Consumers reading decrypted credentials must send it in the body, not the query string.
---
 admin/api_keys.php               | 2 +-
 admin/modals/api/api_key_add.php | 1 +
 api/v1/credentials/read.php      | 6 ++++--
 3 files changed, 6 insertions(+), 3 deletions(-)

diff --git a/admin/api_keys.php b/admin/api_keys.php
index 009f8cce..1530a41a 100644
--- a/admin/api_keys.php
+++ b/admin/api_keys.php
@@ -9,7 +9,7 @@ require_once "includes/inc_all_admin.php";
 $sql = mysqli_query(
     $mysqli,
     "SELECT SQL_CALC_FOUND_ROWS * FROM api_keys
-    LEFT JOIN users on api_keys.api_key_user_id = users.user_id
+    LEFT JOIN users on api_key_user_id = user_id
     WHERE (api_key_name LIKE '%$q%')
     ORDER BY $sort $order LIMIT $record_from, $record_to"
 );
diff --git a/admin/modals/api/api_key_add.php b/admin/modals/api/api_key_add.php
index 0cb64a76..6c7f938f 100644
--- a/admin/modals/api/api_key_add.php
+++ b/admin/modals/api/api_key_add.php
@@ -6,6 +6,7 @@ $key = randomString(32);
 $decryptPW = randomString(32);
 
 ob_start();
+
 ?>
 
 <div class="modal-header bg-dark">
diff --git a/api/v1/credentials/read.php b/api/v1/credentials/read.php
index d6bd98c0..584f6d8e 100644
--- a/api/v1/credentials/read.php
+++ b/api/v1/credentials/read.php
@@ -8,8 +8,10 @@ require_once '../require_get_method.php';
 $sql = false;
 
 $api_key_decrypt_password = '';
-if (isset($_GET['api_key_decrypt_password'])) {
-    $api_key_decrypt_password = $_GET['api_key_decrypt_password']; // No sanitization
+if (isset($_POST['api_key_decrypt_password'])) {
+    // Read from the request body (parsed by validate_api_key.php), NOT the query string,
+    // so this decryption secret never lands in web-server access logs or browser history.
+    $api_key_decrypt_password = $_POST['api_key_decrypt_password'];
 }
 
 // Specific credential/login via ID (single)