Encryption: Stop decrypting EE encrypted secrets with legacy encryption (#50090) (#51309)

(cherry picked from commit 7a614fd8a1)

Co-authored-by: Tania <yalyna.ts@gmail.com>

pkg/services/secrets/manager/manager.go

@@ -303,8 +303,15 @@ func newRandomDataKey() ([]byte, error) {
 }
 
 func (s *SecretsService) Decrypt(ctx context.Context, payload []byte) ([]byte, error) {
+	if len(payload) == 0 {
+		return nil, fmt.Errorf("unable to decrypt empty payload")
+	}
+
 	// Use legacy encryption service if featuremgmt.FlagDisableEnvelopeEncryption toggle is on
 	if s.features.IsEnabled(featuremgmt.FlagDisableEnvelopeEncryption) {
+		if len(payload) > 0 && payload[0] == '#' {
+			return nil, fmt.Errorf("failed to decrypt a secret encrypted with envelope encryption: envelope encryption is disabled")
+		}
 		return s.enc.Decrypt(ctx, payload, setting.SecretKey)
 	}
 
@@ -321,11 +328,6 @@ func (s *SecretsService) Decrypt(ctx context.Context, payload []byte) ([]byte, e
 		}
 	}()
 
-	if len(payload) == 0 {
-		err = fmt.Errorf("unable to decrypt empty payload")
-		return nil, err
-	}
-
 	var dataKey []byte
 
 	if payload[0] != '#' {