Take the 2-minute tour ×
WordPress Development Stack Exchange is a question and answer site for WordPress developers and administrators. It's 100% free, no registration required.

Why is it advised for admin panel metaboxes to use nonces? Every example I see of creation and saving metabox data there are nonces involved but aren't nonces a bit unnecessary in this case?

share|improve this question

1 Answer 1

up vote 2 down vote accepted

WordPress nonces are meant to prevent unauthorized execution of code. In the case of meta boxes, they are protecting you against malicious users potentially adding unauthorized meta-information to your posts and pages by forging POST requests. Why wouldn't you want to use nonces?

share|improve this answer
    
Idk, I've just started reading into nonces, but if a user is already logged into the admin panel as an admin anyway then nonces or not they would still be able to execute code in the metabox. –  Howdy_McGee Aug 7 '13 at 16:51
    
Nonces are roughly defined here, but the definition lacks information. –  Charles Clarkson Aug 7 '13 at 17:00
2  
@Howdy_McGee Yes, but nonces are meant to prevent an attacker from sending arbitrary POST data to, say, example.com/wp-admin/post.php?post=5&action=edit and having WordPress merrily execute it. (Or are you arguing that there's already a nonce on that page for the post_content, so why the second one? I'm not sure of the answer to that.) –  Pat J Aug 7 '13 at 17:08

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.