Options: Mask connector API keys on All Options screen#11158
Options: Mask connector API keys on All Options screen#11158jorgefilipecosta wants to merge 2 commits intoWordPress:trunkfrom
Conversation
|
The following accounts have interacted with this PR and/or linked issues. I will continue to update these lists as activity occurs. You can also manually ask me to refresh this list by adding the Core Committers: Use this line as a base for the props when committing in SVN: To understand the WordPress project's expectations around crediting contributors, please review the Contributor Attribution page in the Core Handbook. |
Test using WordPress PlaygroundThe changes in this pull request can previewed and tested using a WordPress Playground instance. WordPress Playground is an experimental project that creates a full WordPress instance entirely within the browser. Some things to be aware of
For more details about these limitations and more, check out the Limitations page in the WordPress Playground documentation. |
gziolo
left a comment
gziolo
left a comment
There was a problem hiding this comment.
This works perfectly fine in my testing for the All Options screen. We can iterate when we figure out a better approach.
src/wp-admin/options.php
Outdated
| } | ||
| } elseif ( str_starts_with( $option->option_name, 'connectors_' ) | ||
| && str_ends_with( $option->option_name, '_api_key' ) | ||
| && function_exists( '_wp_connectors_mask_api_key' ) |
There was a problem hiding this comment.
Why would a WordPress installation not include _wp_connectors_mask_api_key()?
There was a problem hiding this comment.
The check was removed 👍
Connector API keys were visible in plain text on the wp-admin/options.php page because it queries the database directly, bypassing the get_option() filter that normally masks these values. This adds masking for options matching the `connectors_*_api_key` pattern using the existing `_wp_connectors_mask_api_key()` function, and disables editing from this screen.
jorgefilipecosta
force-pushed
the
mask-connector-api-keys-options-page
branch
from
abbbdae to
c192fc2
Compare
3 participants
Summary
wp-admin/options.phppage using the existing_wp_connectors_mask_api_key()functionconnectors_*_api_keypattern are displayed with bullets + last 4 charsTicket: https://core.trac.wordpress.org/ticket/64793#ticket
Test plan
wp-admin/options.php••••••••••••PDU')Screenshot