← All changes | app/Http/Controllers/GlobalIntegrationController.php +15 -1 6.2.2 → trunk View file →

		@@ -11,12 +11,21 @@
11	11
12	12	public function index(GlobalIntegrationService $globalIntegrationService)
13	13	{
14	14	try {
15		- $returnData = $globalIntegrationService->get($this->request->all());
	15	+ $attributes = $this->request->all();
	16	+ $returnData = $globalIntegrationService->get($attributes);
16	17	if (Arr::isTrue($returnData, 'status')) {
17	18	return $this->sendSuccess($returnData);
18	19	}
	20	+ // No settings_key provided is a list-style call, not an error; return 200 with empty payload.
	21	+ if (!Arr::get($attributes, 'settings_key')) {
	22	+ return $this->sendSuccess([
	23	+ 'status' => false,
	24	+ 'integration' => [],
	25	+ 'settings' => [],
	26	+ ]);
	27	+ }
19	28	return $this->sendError($returnData);
20	29	} catch (Exception $e) {
21	30	return $this->sendError([
22	31	'message' => $e->getMessage(),
		@@ -28,8 +37,13 @@
28	37	{
29	38	try {
30	39	$settingsKey = sanitize_text_field($this->request->get('settings_key'));
31	40	$integration = wp_unslash($this->request->get('integration'));
	41	+
	42	+ // SECURITY (FINDING-16): connected credentials are redacted on read; restore any field
	43	+ // the browser posted back still masked so a re-save (e.g. "Verify Connection Again")
	44	+ // cannot overwrite a live credential with the '********' mask.
	45	+ $integration = (new GlobalIntegrationService())->unmaskCredentials($settingsKey, $integration);
32	46
33	47	do_action_deprecated(
34	48	'fluentform_save_global_integration_settings_' . $settingsKey,
35	49	[