AS1024/itflow
1
0
Fork 0
mirror of https://github.com/itflow-org/itflow synced 2026-08-16 20:45:12 +00:00
Code Issues Packages Projects Releases Wiki Activity

Read API credential decrypt password from body instead of query string

Browse Source 
Keeps the credential decryption secret out of the URL, so it no longer lands in web-server access logs, proxy logs, or browser history. credentials/read.php now reads api_key_decrypt_password from the request body, matching create/update. Consumers reading decrypted credentials must send it in the body, not the query string.
This commit is contained in:
johnnyq
2026-07-25 17:08:22 -04:00
parent e6daf00528
commit 04bf3c234f
3 changed files with 6 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
admin/api_keys.php
View File

@@ -9,7 +9,7 @@ require_once "includes/inc_all_admin.php";
$sql = mysqli_query( $sql = mysqli_query(
$mysqli, $mysqli,
"SELECT SQL_CALC_FOUND_ROWS * FROM api_keys "SELECT SQL_CALC_FOUND_ROWS * FROM api_keys
LEFT JOIN users on api_keys.api_key_user_id = users.user_id LEFT JOIN users on api_key_user_id = user_id
WHERE (api_key_name LIKE '%$q%') WHERE (api_key_name LIKE '%$q%')
ORDER BY $sort $order LIMIT $record_from, $record_to" ORDER BY $sort $order LIMIT $record_from, $record_to"
); );

1
admin/modals/api/api_key_add.php
View File

@@ -6,6 +6,7 @@ $key = randomString(32);
$decryptPW = randomString(32); $decryptPW = randomString(32);
ob_start(); ob_start();
?> ?>
<div class="modal-header bg-dark"> <div class="modal-header bg-dark">

6
api/v1/credentials/read.php
View File

@@ -8,8 +8,10 @@ require_once '../require_get_method.php';
$sql = false; $sql = false;
$api_key_decrypt_password = ''; $api_key_decrypt_password = '';
if (isset($_GET['api_key_decrypt_password'])) { if (isset($_POST['api_key_decrypt_password'])) {
$api_key_decrypt_password = $_GET['api_key_decrypt_password']; // No sanitization // Read from the request body (parsed by validate_api_key.php), NOT the query string,
// so this decryption secret never lands in web-server access logs or browser history.
$api_key_decrypt_password = $_POST['api_key_decrypt_password'];
} }
// Specific credential/login via ID (single) // Specific credential/login via ID (single)