Take the 2-minute tour ×
WordPress Development Stack Exchange is a question and answer site for WordPress developers and administrators. It's 100% free, no registration required.

For example, in this tutorial, the code suggested when saving meta box data is

/* Verify the nonce before proceeding. */
if ( !isset( $_POST['smashing_post_class_nonce'] ) || !wp_verify_nonce( $_POST['smashing_post_class_nonce'], basename( __FILE__ ) ) )
    return $post_id;

/* Get the post type object. */
$post_type = get_post_type_object( $post->post_type );

/* Check if the current user has permission to edit the post. */
if ( !current_user_can( $post_type->cap->edit_post, $post_id ) )
    return $post_id;

The checking of nonce and user role seems reluctant, seems they hook into the save_post, which is almost the last line in the function wp_insert_post, WordPress should already performed the needed checks, right?

So I can safely remove them?

share|improve this question
2  
Not trying to be a jerk, but just for clarification, do you mean "redundant" instead of "reluctant"? –  helgatheviking Jun 29 '13 at 12:12

1 Answer 1

No, not really. You're assuming the function that called wp_insert_post() has already performed those checks. But wp_insert_post() may be used in other pages too, not just the edit page, by plugins, or even themes (many of them with security holes).

That's why you should ensure that your code runs only where you want to by using the nonce.


Ok I'm editing the answer because the comment reply would be too long.

If a plugin expose wp_insert_post, it is not only my new custom field will be hacked, it is all the post fields will get hacked. (again, this is the bug in plugin) So, I really can't see verifying my own custom field can bring any additional security

But it would get "hacked" with the help of your code. Think about the quick post form on dashboard home. It doesn't have input fields for your post meta, does it? On submission, wp_insert_post -> save_post gets called and if $_POST contains your meta fields (it's easy to edit the source and add some), they will get saved by your meta box code. Essentially, if you don't do nonce checks, your making it possible to change your meta fields from any form in WordPress that involves post editing, not just the one to which you attached your custom input fields. Is this what you want?

I am NOT creating a new action, so if the core wordpress's code allow calling wp_insert_post without verifying the nonce, this is a bug in WP. (As you can see they all called the check_admin_referer in the post.php.

The purpose of wp_insert_post is to insert posts, not to check from where the data comes from. However I do agree that the save_post action was badly placed. Such functions should not fire actions and filters at all. Instead the action should have been fired by each form submission handler. Besides the fact that this action introduces more inconsistencies in the WP API, it also facilitates exploits...

share|improve this answer
    
+1 Worst case, redundant is better than "hacked" –  s_ha_dum Jun 29 '13 at 15:09
    
@OneTrickPony, I think in this way: I am NOT creating a new action, so if the core wordpress's code allow calling wp_insert_post without verifying the nonce, this is a bug in WP. (As you can see they all called the check_admin_referer in the post.php. If a plugin expose wp_insert_post, it is not only my new custom field will be hacked, it is all the post fields will get hacked. (again, this is the bug in plugin) So, I really can't see verifying my own custom field can bring any additional security. –  Yoga Jul 1 '13 at 16:25
    
@Yoga: I added the reply in my A –  onetrickpony Jul 1 '13 at 17:13
    
Thanks. My reply to your question: " Essentially, if you don't do nonce checks, your making it possible to change your meta fields" Yes, but does it matter? WP already checked the user has permission to update the post, so even the user hacked to update the meta in the quick post form, they hack their own data and why bother? If this is important, WP should already using one nonce per field, not per form. –  Yoga Jul 2 '13 at 15:52
    
The quick post form was just an example. There are plugins out there which can call wp_insert_post on visitor actions, to update post views, or ratings etc. –  onetrickpony Jul 3 '13 at 15:21

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.