PHPackages brocode/module-config-explorer - PHPackages - PHPackages [Skip to content](#main-content)[PHPackages](/)[Directory](/)[Categories](/categories)[Trending](/trending)[Leaderboard](/leaderboard)[Changelog](/changelog)[Analyze](/analyze)[Collections](/collections)[Log in](/login)[Sign up](/register) 1. [Directory](/) 2. / 3. [Security](/categories/security) 4. / 5. brocode/module-config-explorer ActiveMagento2-module[Security](/categories/security) brocode/module-config-explorer ============================== Read-only Magento 2 admin grid and REST API over core\_config\_data. Encrypted values are redacted by default in both; plaintext reveal is REST-only and gated behind a system toggle, an ACL resource, and an explicit request flag. 1.1.0(yesterday)001MITPHPPHP ~8.1.0||~8.2.0||~8.3.0||~8.4.0 Since Aug 24Pushed yesterdayCompare [ Source](https://github.com/brosenberger/module-config-explorer)[ Packagist](https://packagist.org/packages/brocode/module-config-explorer)[ Docs](https://github.com/brosenberger/module-config-explorer)[ Fund](https://www.buymeacoffee.com/brosenberger)[ RSS](/packages/brocode-module-config-explorer/feed)WikiDiscussions main Synced today READMEChangelogDependencies (6)Versions (2)Used By (0) BroCode\_ConfigExplorer ======================= [](#brocode_configexplorer) Read-only admin grid and REST API over `core_config_data`, with encrypted values redacted by default in both. ``` composer require brocode/module-config-explorer bin/magento module:enable BroCode_ConfigExplorer bin/magento setup:upgrade ``` What this is ------------ [](#what-this-is) - An admin grid at **Stores → Settings → Config Data Explorer**, filterable by path, scope, and scope ID. Encrypted values always render as `***` here — there is no reveal control in the grid at all, by design. - `GET /V1/config-explorer/config`, the same filters over REST, plus an optional `revealEncrypted` flag that is refused unless three independent gates all open. - No write path anywhere. There is no save, no delete, and no `POST`/`PUT`/`DELETE`route; the resource model binds to the native table for reads only. [![Config Data Explorer grid showing three rows under general/store_information: a store-view override with Origin Database, and two default-scope rows with Origin env.php and config.php, one with its origin hint open](docs/config-grid.png)](docs/config-grid.png) *Stock 2.4.8-p5, filtered to one path prefix at a store view. `city` is a real store-view row; `name` and `phone` look like ordinary default rows but are shadowed by `env.php` and `config.php`. Origin names the file, and the hint names the database value it is shadowing.* Why the grid never reveals -------------------------- [](#why-the-grid-never-reveals) Redaction in the grid is unconditional, even for a user who holds the reveal ACL. Plaintext is available only through an explicit REST call, which leaves a request trace, rather than through a checkbox that stays on in a shared admin session. [![Config Data Explorer grid filtered to carriers/usps, showing carriers/usps/password masked as three asterisks with the Encrypted column reading Yes](docs/encrypted-masked.png)](docs/encrypted-masked.png) *`carriers/usps/password` shows `***` with Encrypted `Yes`. There is no reveal control on this screen for any role.* Access model ------------ [](#access-model) Three gates, all required, checked in this order: GateWhereDefault`brocode_config_explorer/general/allow_encrypted_reveal`**Stores → Configuration → Services → BroCode Config Data Explorer**No`BroCode_ConfigExplorer::config_view_encrypted`ACL resourceGranted to no role`revealEncrypted=true`REST request parameter`false`The toggle is checked before the ACL, so a caller who holds the resource on an installation with the switch off is refused. Asking for plaintext without being allowed it raises `AuthorizationException` — a caller never receives a silently redacted response when they explicitly asked to see the real value. [![The module's setting under the Services tab](docs/settings-under-services.png)](docs/settings-under-services.png) *The setting lives under Services, beside Magento Web API and OAuth, rather than in a vendor-specific top-level tab.* REST usage ---------- [](#rest-usage) ``` # redacted, the default curl -X GET "https://example.com/rest/V1/config-explorer/config?path=braintree" \ -H "Authorization: Bearer $TOKEN" # plaintext, only with the toggle on and the ACL resource granted curl -X GET "https://example.com/rest/V1/config-explorer/config?path=braintree&revealEncrypted=true" \ -H "Authorization: Bearer $TOKEN" ``` Every entry carries `is_encrypted`, so a consumer can tell a redacted `***` apart from a value that genuinely is `***`, and apart from an empty one. How encrypted fields are detected --------------------------------- [](#how-encrypted-fields-are-detected) `Model/Config/EncryptedPathResolver` walks the merged `system.xml` structure and matches any field whose `backend_model` is `Magento\Config\Model\Config\Backend\Encrypted` **or a subclass of it**, honouring `` overrides when a field stores under a different path than it is declared at. Magento core answers a narrower version of the same question in `Structure::getFieldPathsByAttribute()`, which `Magento\EncryptionKey` uses to find rows to re-encrypt on a key rotation. This module deliberately does not reuse it: 1. Core compares `backend_model` with `==` against one class name, so a **subclass**of `Encrypted` is never returned. In a re-encrypt routine that is a missed row; in a redaction routine it is a leaked secret. 2. Core builds structure paths and ignores ``, so a field storing under an overridden path would be matched against the wrong `core_config_data` row. Limitations ----------- [](#limitations) - **Detection is declaration-based.** A field is recognised as encrypted only when its declared `backend_model` extends `Encrypted`. A custom backend model that calls the encryptor without extending it is invisible here and its value will be shown in full. Audit your own `system.xml` before treating this as a security boundary — [BroCode\_EncryptedConfigAudit](https://github.com/brosenberger/module-encrypted-config-audit)scans for the related declaration defect. - **`getList()` takes scalar filters, not `SearchCriteriaInterface`.** Deliberate for v1: the filters map to the three columns that matter for this table. There is no paging on the REST response. - Targets Magento 2.4.6+ on PHP 8.1–8.4. Not tested below 2.4.6. Verification status ------------------- [](#verification-status) The encrypted-path resolver is covered by a logic test over the merged-structure shape (exact class, subclass, leading backslash, `config_path` override, nested groups, unloadable class, empty structure). The grid, the REST route, and the ACL wiring have not yet been exercised against a running Magento instance. ### Health Score 41 — FairBetter than 87% of packages Maintenance100 Actively maintained with recent releases Popularity1 Limited adoption so far Community7 Small or concentrated contributor base Maturity50 Maturing project, gaining track record Bus Factor1 Top contributor holds 100% of commits — single point of failure How is this calculated?**Maintenance (25%)** — Last commit recency, latest release date, and issue-to-star ratio. Uses a 2-year decay window. **Popularity (30%)** — Total and monthly downloads, GitHub stars, and forks. Logarithmic scaling prevents top-heavy scores. **Community (15%)** — Contributors, dependents, forks, watchers, and maintainers. Measures real ecosystem engagement. **Maturity (30%)** — Project age, version count, PHP version support, and release stability. ### Release Activity Cadence Unknown Total 1 Last Release 1d ago ### Community Maintainers ![](https://www.gravatar.com/avatar/9453d161c28a18e817351e00d7ebe81ada31842a249ffb3389830b3483584e60?d=identicon)[brosenberger](/maintainers/brosenberger) --- Top Contributors [![brosenberger](https://avatars.githubusercontent.com/u/2969243?v=4)](https://github.com/brosenberger "brosenberger (2 commits)") --- Tags securityencryptionmagentoREST APImagento2core\_config\_dataadmin Gridbrocode ### Code Quality TestsPHPUnit ### Embed Badge ![Health badge](/badges/brocode-module-config-explorer/health.svg) ``` [![Health](https://phpackages.com/badges/brocode-module-config-explorer/health.svg)](https://phpackages.com/packages/brocode-module-config-explorer) ``` ### Alternatives [mollie/magento2 Mollie Payment Module for Magento 2 1142.0M17](/packages/mollie-magento2)[loki/magento2-components Core module for defining Alpine.js components with advanced AJAX features 1015.1k29](/packages/loki-magento2-components)[run-as-root/magento2-prometheus-exporter Magento2 Prometheus Exporter 69362.0k](/packages/run-as-root-magento2-prometheus-exporter)[buckaroo/magento2 Buckaroo Magento 2 extension 32426.0k8](/packages/buckaroo-magento2)[zwernemann/module-withdrawal Magento 2 EU Withdrawal Button Module - Adds a withdrawal/revocation button for orders in compliance with EU Directive (EU) 2023/2673 2610.9k2](/packages/zwernemann-module-withdrawal)[opengento/module-category-import-export This module add the capability to import and export the categories from the back-office. 1312.0k3](/packages/opengento-module-category-import-export) PHPackages © 2026 [Directory](/)[Categories](/categories)[Trending](/trending)[Changelog](/changelog)[Analyze](/analyze)