Take the 2-minute tour ×
WordPress Development Stack Exchange is a question and answer site for WordPress developers and administrators. It's 100% free, no registration required.

I looking at the docs for add_meta_box. They used a nonce.

wp_nonce_field( plugin_basename( __FILE__ ), 'myplugin_noncename' );

I am wondering, probably the save post form itself should already have a nonce so this is redundant?

share|improve this question
add comment

1 Answer

up vote 2 down vote accepted

Yes, the save action has a nonce already. But you don’t know it – so you cannot validate it. Besides that, you may want to fill a meta box from other places like a user profile or the dashboard, and then you need your own nonce anyway.

An example from my current work: There is a custom post type domicile with a booking schedule meta box. My client is the agent or broker (English is not my native language …) for the domicile and fills the schedule from the editor for the CPT. But the owners of the domiciles can fill the schedule too – from their dashboard. I just load all booking schedules they are assigned to and they edit them without ever seeing the complete data of the domicile. Without separate nonces this would be very awkward.

share|improve this answer
    
So assuming I cant validate it, and I only need to use the meta box in the add/edit post page. I world think that WP will validate the nonce, do its processing and call my function? My function wont be called in any other way that bypasses the nonce? –  JM at Work Jun 14 '11 at 2:03
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.