| @@ -83,8 +83,13 @@ | ||
| 83 | 83 | { |
| 84 | 84 | return true; |
| 85 | 85 | } |
| 86 | 86 | |
| 87 | + public function getEffectiveBucket(): string | |
| 88 | + { | |
| 89 | + return S3Settings::resolveEffectiveBucket($this->getSettings()); | |
| 90 | + } | |
| 91 | + | |
| 87 | 92 | public function needsReconfigure(): bool |
| 88 | 93 | { |
| 89 | 94 | return S3Settings::resolveConfiguredBucket($this->getSettings()) === ''; |
| 90 | 95 | } |
| @@ -232,10 +237,28 @@ | ||
| 232 | 237 | $data['buckets'] = $settings['buckets']; |
| 233 | 238 | } |
| 234 | 239 | |
| 235 | 240 | $mergeKeys = array_diff($this->hiddenSettingKeys(), ['create_new_bucket', 'new_bucket_name', 'new_bucket_region']); |
| 241 | + $credentialKeys = ['access_key', 'secret_key']; | |
| 242 | + $storedAuthMethod = Arr::get($settings, 'auth_method'); | |
| 243 | + | |
| 236 | 244 | foreach ($mergeKeys as $key) { |
| 237 | - if (!array_key_exists($key, $data) && isset($settings[$key])) { | |
| 245 | + $isCredential = in_array($key, $credentialKeys, true); | |
| 246 | + | |
| 247 | + // In define mode getSettings() resolves credentials from the wp-config | |
| 248 | + // constants, so merging one here would copy it into the database and | |
| 249 | + // break revocation. Never fall back to a value we do not own. | |
| 250 | + if ($isCredential && $storedAuthMethod === 'define') { | |
| 251 | + continue; | |
| 252 | + } | |
| 253 | + | |
| 254 | + // Credentials are stripped from the settings response, so an empty | |
| 255 | + // submitted value means "unchanged" and must fall back to storage. | |
| 256 | + $isMissing = $isCredential | |
| 257 | + ? empty($data[$key]) | |
| 258 | + : !array_key_exists($key, $data); | |
| 259 | + | |
| 260 | + if ($isMissing && isset($settings[$key])) { | |
| 238 | 261 | $data[$key] = $settings[$key]; |
| 239 | 262 | } |
| 240 | 263 | } |
| 241 | 264 | |
| @@ -285,9 +308,12 @@ | ||
| 285 | 308 | return $verificationResult; |
| 286 | 309 | } |
| 287 | 310 | } |
| 288 | 311 | |
| 289 | - if (!empty($data['bucket'])) { | |
| 312 | + // A credentials-only step must not run a bucket check: on failure the | |
| 313 | + // branch below persists the stored settings and discards the credentials | |
| 314 | + // the user just entered. Mirrors the guards further down. | |
| 315 | + if (!empty($data['bucket']) && !Arr::get($data, 'verify_only_credentials')) { | |
| 290 | 316 | $bucketValidation = S3InputValidator::validateBucket($data['bucket']); |
| 291 | 317 | if (is_wp_error($bucketValidation)) { |
| 292 | 318 | return $bucketValidation; |
| 293 | 319 | } |
