store_certificate() and remove_certificate() wrote the option with update_option(), which runs the registered sanitize() callback in the admin (including admin-ajax). sanitize() expects raw form input, so it restored the previous certificate fields and encrypted the stored client secret a second time: "Generate certificate" did not keep the new certificate and broke an existing client secret. Internal writes now bypass the form sanitiser. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> |
||
|---|---|---|
| .. | ||
| class-m365-login-admin.php | ||
| class-m365-login-auth.php | ||
| class-m365-login-button.php | ||
| class-m365-login-certificate.php | ||
| class-m365-login-crypto.php | ||
| class-m365-login-graph.php | ||
| class-m365-login-jwt.php | ||
| class-m365-login-settings.php | ||
| class-m365-login.php | ||
| functions.php | ||