peptide-repo/prautoblogger
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: add Cloudflare token to encrypted fields list (fixes 401 on image gen)

Browse Source 
prautoblogger_cloudflare_ai_token was missing from the $encrypted array
in sanitize_field(), so the token was stored as plaintext. On read,
decrypt() failed on the non-encrypted value and returned empty string,
causing HTTP 401 on every Cloudflare Workers AI call.

Fix: add the field to the encrypted list so future saves encrypt it.
Also add legacy plaintext detection in get_api_token() and the validator
so the existing DB value works immediately and gets auto-encrypted on
first use.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
This commit is contained in:
peptiderepo
2026-04-18 07:24:01 +07:00
parent 51b385b938
commit 49aee0b446
3 changed files with 25 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
includes/admin/class-admin-page.php
View File

@@ -242,7 +242,7 @@ class PRAutoBlogger_Admin_Page {
$option_name = substr( $filter, strlen( 'sanitize_option_' ) );
}
$encrypted = [ 'prautoblogger_openrouter_api_key', 'prautoblogger_ga4_credentials_json' ];
$encrypted = [ 'prautoblogger_openrouter_api_key', 'prautoblogger_ga4_credentials_json', 'prautoblogger_cloudflare_ai_token' ];
if ( in_array( $option_name, $encrypted, true ) ) {
// Empty value means password field wasn't touched — keep existing.
if ( '' === $value ) {

19
includes/providers/class-cloudflare-image-support.php
View File

@@ -23,11 +23,24 @@ class PRAutoBlogger_Cloudflare_Image_Support {
* @return string Plaintext token, or empty string if not set / decrypt fails.
*/
public function get_api_token(): string {
$encrypted = (string) get_option( 'prautoblogger_cloudflare_ai_token', '' );
if ( '' === $encrypted ) {
$stored = (string) get_option( 'prautoblogger_cloudflare_ai_token', '' );
if ( '' === $stored ) {
return '';
}
return (string) PRAutoBlogger_Encryption::decrypt( $encrypted );
// If the token is already encrypted (has "enc:" prefix), decrypt it.
if ( PRAutoBlogger_Encryption::is_encrypted( $stored ) ) {
return (string) PRAutoBlogger_Encryption::decrypt( $stored );
}
// Legacy: token was saved as plaintext before the field was added to
// the encrypted list in sanitize_field(). Encrypt it now so future
// reads go through the normal path, then return the plaintext value.
$cipher = PRAutoBlogger_Encryption::encrypt( $stored );
if ( '' !== $cipher ) {
update_option( 'prautoblogger_cloudflare_ai_token', $cipher );
}
return $stored;
}
/**

10
includes/providers/class-cloudflare-image-validator.php
View File

@@ -40,8 +40,14 @@ class PRAutoBlogger_Cloudflare_Image_Validator {
);
}
$encrypted = (string) get_option( 'prautoblogger_cloudflare_ai_token', '' );
$api_token = '' === $encrypted ? '' : (string) PRAutoBlogger_Encryption::decrypt( $encrypted );
$stored = (string) get_option( 'prautoblogger_cloudflare_ai_token', '' );
$api_token = '';
if ( '' !== $stored ) {
// Handle legacy plaintext tokens (saved before the field was in the encrypted list).
$api_token = PRAutoBlogger_Encryption::is_encrypted( $stored )
? (string) PRAutoBlogger_Encryption::decrypt( $stored )
: $stored;
}
if ( '' === $api_token ) {
return $this->err(
'token_empty',