Options: Mask connector API keys on All Options screen.

Connector API keys were visible in plain text on `wp-admin/options.php`
because it queries the database directly, bypassing the `get_option()`
filter that normally masks these values.
This adds masking for options matching the `connectors_*_api_key` pattern
using the existing `_wp_connectors_mask_api_key()` function, and disables
editing from this screen.

Props jorgefilipecosta, gziolo, ocean90.
Fixes #64793.
Built from https://develop.svn.wordpress.org/trunk@61829


git-svn-id: http://core.svn.wordpress.org/trunk@61116 1a063a9b-81f0-0310-95a4-ce76da25c4cd
This commit is contained in:
jorgefilipecosta
2026-03-04 20:26:43 +00:00
parent 6b28eb9266
commit c9661dcfb8
2 changed files with 7 additions and 1 deletions

View File

@@ -423,6 +423,12 @@ foreach ( (array) $options as $option ) :
$value = 'SERIALIZED DATA';
$disabled = true;
}
} elseif ( str_starts_with( $option->option_name, 'connectors_' )
&& str_ends_with( $option->option_name, '_api_key' )
) {
// Mask connector API keys and prevent updates from this screen.
$value = _wp_connectors_mask_api_key( $option->option_value );
$disabled = true;
} else {
$value = $option->option_value;
$options_to_update[] = $option->option_name;

View File

@@ -16,7 +16,7 @@
*
* @global string $wp_version
*/
$wp_version = '7.0-beta2-61828';
$wp_version = '7.0-beta2-61829';
/**
* Holds the WordPress DB revision, increments when changes are made to the WordPress DB schema.