bug: deleteFromPlatforms() does not decrypt credentials before passing to service plugins #226

New Issue

2026-06-29T14:19:44Z

jmiller commented

2026-06-29 14:19:44 +00:00

Description

CrossPostDispatcher::deleteFromPlatforms() at line 618 reads credentials from the database as raw JSON:

$credentials = json_decode($post->credentials, true) ?: [];

But credentials are stored encrypted via CredentialHelper::encrypt(). The dispatch() and QueueProcessor::processQueue() methods correctly use CredentialHelper::decrypt(), but deleteFromPlatforms() does not.

This means the "Delete from platforms on unpublish" feature silently fails for all services with encrypted credentials -- the service plugin receives empty or garbage credential arrays and returns a credential validation error.

Fix

Replace line 618:

$credentials = json_decode($post->credentials, true) ?: [];

With:

$credentials = CredentialHelper::decrypt($post->credentials ?: '');

Impact

Severity: High -- the delete-on-unpublish feature is completely broken for encrypted credentials
Affected file: source/packages/com_mokosuitecross/src/Helper/CrossPostDispatcher.php
Affected line: 618

## Description `CrossPostDispatcher::deleteFromPlatforms()` at line 618 reads credentials from the database as raw JSON: ```php $credentials = json_decode($post->credentials, true) ?: []; ``` But credentials are stored encrypted via `CredentialHelper::encrypt()`. The `dispatch()` and `QueueProcessor::processQueue()` methods correctly use `CredentialHelper::decrypt()`, but `deleteFromPlatforms()` does not. This means the "Delete from platforms on unpublish" feature silently fails for all services with encrypted credentials -- the service plugin receives empty or garbage credential arrays and returns a credential validation error. ## Fix Replace line 618: ```php $credentials = json_decode($post->credentials, true) ?: []; ``` With: ```php $credentials = CredentialHelper::decrypt($post->credentials ?: ''); ``` ## Impact - **Severity**: High -- the delete-on-unpublish feature is completely broken for encrypted credentials - **Affected file**: `source/packages/com_mokosuitecross/src/Helper/CrossPostDispatcher.php` - **Affected line**: 618

jmiller commented

2026-06-29 14:19:50 +00:00

Branch created: feature/226-bug-deletefromplatforms-does-not-decrypt

git fetch origin
git checkout feature/226-bug-deletefromplatforms-does-not-decrypt

Branch created: [`feature/226-bug-deletefromplatforms-does-not-decrypt`](https://git.mokoconsulting.tech/MokoConsulting/MokoSuiteCross/src/branch/feature/226-bug-deletefromplatforms-does-not-decrypt) ```bash git fetch origin git checkout feature/226-bug-deletefromplatforms-does-not-decrypt ```

jmiller referenced this issue

2026-06-29 14:31:00 +00:00

bug: deleteFromPlatforms() uses wrong credential decryption and deprecated event API #223

jmiller referenced this issue from a commit

2026-06-29 16:28:16 +00:00

fix: resolve 10 critical/medium bugs from deep dive audit

jmiller referenced this issue

2026-06-29 16:28:52 +00:00

fix: resolve 10 critical/medium bugs from deep dive audit #252

Sign in to join this conversation.