← All changes | app/Http/Controllers/GlobalIntegrationController.php +5 -0 6.2.6 → trunk View file →

		@@ -38,8 +38,13 @@
38	38	try {
39	39	$settingsKey = sanitize_text_field($this->request->get('settings_key'));
40	40	$integration = wp_unslash($this->request->get('integration'));
41	41
	42	+ // SECURITY (FINDING-16): connected credentials are redacted on read; restore any field
	43	+ // the browser posted back still masked so a re-save (e.g. "Verify Connection Again")
	44	+ // cannot overwrite a live credential with the '********' mask.
	45	+ $integration = (new GlobalIntegrationService())->unmaskCredentials($settingsKey, $integration);
	46	+
42	47	do_action_deprecated(
43	48	'fluentform_save_global_integration_settings_' . $settingsKey,
44	49	[
45	50	$integration