'array', 'sanitize_callback' => function ( $input ) { return promvia_sanitize_settings( $input, get_option( PROMVIA_OPTION, array() ) ); }, 'default' => promvia_default_settings(), ) ); } add_action( 'admin_init', 'promvia_register_settings' ); function promvia_add_menu() { add_options_page( __( 'Promvia', 'promvia' ), __( 'Promvia', 'promvia' ), 'manage_options', 'promvia', 'promvia_render_settings_page' ); } add_action( 'admin_menu', 'promvia_add_menu' ); /** * Creates the "Promvia" application password when the settings page receives its own POST (nonce + * manage_options), and returns it for THIS response only. Nothing is written anywhere: WordPress core * never stores the plaintext and neither do we (review 2026-10-14 I4). Null when the request is not ours. * * @return array|null array( 'password' => string, 'login' => string ) | array( 'error' => 'nonce'|'http'|'unavailable'|'error' ) | null */ function promvia_create_app_password_from_post() { if ( ! isset( $_POST['promvia_action'] ) || 'create_app_password' !== $_POST['promvia_action'] ) { return null; } // phpcs:ignore WordPress.Security.NonceVerification.Missing -- the nonce is checked right below $nonce = isset( $_POST['_promvia_nonce'] ) ? sanitize_text_field( wp_unslash( $_POST['_promvia_nonce'] ) ) : ''; // phpcs:ignore WordPress.Security.NonceVerification.Missing if ( ! wp_verify_nonce( $nonce, 'promvia_create_app_password' ) ) { return array( 'error' => 'nonce' ); } if ( ! current_user_can( 'manage_options' ) ) { return array( 'error' => 'nonce' ); } $user_id = get_current_user_id(); $reason = promvia_app_passwords_blocked_reason( is_ssl(), wp_is_application_passwords_available_for_user( $user_id ) ); if ( null !== $reason ) { return array( 'error' => $reason ); } $created = WP_Application_Passwords::create_new_application_password( $user_id, array( 'name' => 'Promvia' ) ); if ( is_wp_error( $created ) ) { return array( 'error' => 'error' ); } return array( 'password' => $created[0], 'login' => wp_get_current_user()->user_login ); } function promvia_render_settings_page() { if ( ! current_user_can( 'manage_options' ) ) { return; } $result = promvia_create_app_password_from_post(); $s = promvia_settings(); $reason = promvia_app_passwords_blocked_reason( is_ssl(), wp_is_application_passwords_available_for_user( get_current_user_id() ) ); $consent_api = function_exists( 'wp_has_consent' ); ?>