From fe50147755c7699bab098dcf391c1e90f3d1da79 Mon Sep 17 00:00:00 2001
From: Liviu-Mihail Concioiu <liviu.concioiu@gmail.com>
Date: Sun, 8 Feb 2026 21:30:03 +0100
Subject: [PATCH 1/2] Add warning message if URLQueryEncryptionSecretKey is not
 valid

Signed-off-by: Liviu-Mihail Concioiu <liviu.concioiu@gmail.com>
---
 .../classes/Controllers/HomeController.php    | 34 +++++++++++++++++++
 1 file changed, 34 insertions(+)

diff --git a/libraries/classes/Controllers/HomeController.php b/libraries/classes/Controllers/HomeController.php
index 78192f4e46..bbda118bfa 100644
--- a/libraries/classes/Controllers/HomeController.php
+++ b/libraries/classes/Controllers/HomeController.php
@@ -347,6 +347,40 @@ class HomeController extends AbstractController
             }
         }
 
+        /**
+         * Check if user does not have defined query encryption key and it is being used.
+         */
+        if ($cfg['URLQueryEncryption']) {
+            $encryptionKeyLength = 0;
+            // This can happen if the user did use getenv() to set URLQueryEncryptionSecretKey
+            if (is_string($cfg['URLQueryEncryptionSecretKey'])) {
+                $encryptionKeyLength = mb_strlen($cfg['URLQueryEncryptionSecretKey'], '8bit');
+            }
+
+            if ($encryptionKeyLength < SODIUM_CRYPTO_SECRETBOX_KEYBYTES) {
+                $this->errors[] = [
+                    'message' => __(
+                        'The configuration file needs a valid key for query encryption.'
+                        . ' A temporary key was automatically generated for you.'
+                        . ' Please refer to the [doc@cfg_URLQueryEncryptionSecretKey]documentation[/doc].'
+                    ),
+                    'severity' => 'warning',
+                ];
+            } elseif ($encryptionKeyLength > SODIUM_CRYPTO_SECRETBOX_KEYBYTES) {
+                $this->errors[] = [
+                    'message' => sprintf(
+                        __(
+                            'The query encryption key in the configuration file is longer than necessary.'
+                            . ' It should only be %d bytes long.'
+                            . ' Please refer to the [doc@cfg_URLQueryEncryptionSecretKey]documentation[/doc].'
+                        ),
+                        SODIUM_CRYPTO_SECRETBOX_KEYBYTES
+                    ),
+                    'severity' => 'warning',
+                ];
+            }
+        }
+
         /**
          * Check for existence of config directory which should not exist in
          * production environment.

From 4a6bccb1548a5404f111acb8b12b05e3d64f6883 Mon Sep 17 00:00:00 2001
From: Liviu-Mihail Concioiu <liviu.concioiu@gmail.com>
Date: Sun, 8 Feb 2026 21:40:08 +0100
Subject: [PATCH 2/2] Fix linting errors

Signed-off-by: Liviu-Mihail Concioiu <liviu.concioiu@gmail.com>
---
 phpstan-baseline.neon | 10 ++++++++++
 psalm-baseline.xml    |  4 ++++
 2 files changed, 14 insertions(+)

diff --git a/phpstan-baseline.neon b/phpstan-baseline.neon
index c23c8177ce..91f01daa6e 100644
--- a/phpstan-baseline.neon
+++ b/phpstan-baseline.neon
@@ -6105,6 +6105,16 @@ parameters:
 			count: 1
 			path: libraries/classes/Controllers/HomeController.php
 
+		-
+			message: "#^Cannot access offset 'URLQueryEncryption' on mixed\\.$#"
+			count: 1
+			path: libraries/classes/Controllers/HomeController.php
+
+		-
+			message: "#^Cannot access offset 'URLQueryEncryptionS…' on mixed\\.$#"
+			count: 1
+			path: libraries/classes/Controllers/HomeController.php
+
 		-
 			message: "#^Cannot access offset 'VersionCheck' on mixed\\.$#"
 			count: 1
diff --git a/psalm-baseline.xml b/psalm-baseline.xml
index 232362d17b..36ab128756 100644
--- a/psalm-baseline.xml
+++ b/psalm-baseline.xml
@@ -2091,6 +2091,10 @@
     </MixedArrayAssignment>
   </file>
   <file src="libraries/classes/Controllers/HomeController.php">
+    <InvalidArrayOffset occurrences="2">
+      <code>$cfg['URLQueryEncryption']</code>
+      <code>$cfg['URLQueryEncryptionSecretKey']</code>
+    </InvalidArrayOffset>
     <MixedArgument occurrences="3">
       <code>$message</code>
       <code>$this-&gt;config-&gt;get('ShowGitRevision') ?? true</code>