Security: OAuth credentials stored in plaintext JSON #112

New Issue

2026-06-06T11:50:08Z

jmiller commented

2026-06-06 11:50:08 +00:00

Audit Finding

Severity: Medium

Issue:
OAuth access tokens, refresh tokens, API keys, and secrets are stored as plaintext JSON in the credentials column. CLAUDE.md states credentials should use Joomla's encrypted params, but the implementation uses json_encode() without encryption.

Fix: Encrypt credentials JSON before storing using sodium_crypto_secretbox() and decrypt on read.

Files: OAuthHelper.php, ServiceModel.php

## Audit Finding **Severity:** Medium **Issue:** OAuth access tokens, refresh tokens, API keys, and secrets are stored as plaintext JSON in the `credentials` column. CLAUDE.md states credentials should use Joomla's encrypted params, but the implementation uses `json_encode()` without encryption. **Fix:** Encrypt credentials JSON before storing using `sodium_crypto_secretbox()` and decrypt on read. **Files:** `OAuthHelper.php`, `ServiceModel.php`

jmiller commented

2026-06-06 11:50:10 +00:00

Branch created: feature/112-security-oauth-credentials-stored-in-pla

git fetch origin
git checkout feature/112-security-oauth-credentials-stored-in-pla

Branch created: [`feature/112-security-oauth-credentials-stored-in-pla`](https://git.mokoconsulting.tech/MokoConsulting/MokoJoomCross/src/branch/feature/112-security-oauth-credentials-stored-in-pla) ```bash git fetch origin git checkout feature/112-security-oauth-credentials-stored-in-pla ```

jmiller referenced this issue from a commit

2026-06-06 14:33:22 +00:00

security: fix 9 security and critical bugs (#107-#115, #120)

jmiller closed this issue

2026-06-06 14:35:10 +00:00

Sign in to join this conversation.

Priority -

Type —

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: MokoConsulting/MokoJoomCross#112