Take the 2-minute tour ×
WordPress Development Stack Exchange is a question and answer site for WordPress developers and administrators. It's 100% free, no registration required.

WordPress nonce is driving me nuts! I had this problem when I started my plugin and removed it but now I have come back to it and still don't know what to do.

I have looked all over for a solution. My code is same/similar to other examples. I get an "undefined index 'mrlpt_client_check'" error.

I also get the same error for 'mrlpt_client' when checking for permissions based on user capabilities, but that is the custom post type that I have created so I'm not sure why that doesn't work either?

Here is the code where the nonce stuff is. The include just includes a short form with two input fields, one for an email address and one for a phone number, inside a custom meta box.

I have tried including the wp_nonce_field() in with the HTML form include, but that doesn't work either, same error.

Can anyone help? Thanks!!

function mrlpt_client_details( $client_post ) {

    // Retrieve saved metadata if it exists
    $mrlpt_clientEmail = get_post_meta( $client_post->ID, '_mrlpt_client_email', true );
    $mrlpt_clientPhoneNum = get_post_meta( $client_post->ID, '_mrlpt_client_phone_num', true );

    // Create a nonce field for verification
    wp_nonce_field( 'mrlpt_submit_client', 'mrlpt_client_check' );

    // Includes the form elements inside the meta box
    require_once( 'includes/mrlpt-client-form.php' );
}

// Update/Save client meta data
add_action( 'save_post', 'save_client_metadata' );

function save_client_metadata( $client_post_id ) {

    // Verify if this is an auto save routine.
    // If it is our form has not been submitted, so we dont want to do anything
    if ( defined( 'DOING_AUTOSAVE' ) && DOING_AUTOSAVE ) {
        return;
    }

    // Verify this came from the our screen and with proper authorization, because save_post can be triggered at other times
    if ( !isset( $_POST['mrlpt_client_check'] )  && !wp_verify_nonce( $_POST['mrlpt_client_check'], 'mrlpt_submit_client' ) ) {
        return;
    }

    // Check permissions - If the post type is mrlpt_client
    if ( 'post' == $_POST['mrlpt_client'] ) {
        // If the user cannot publish posts
        if ( !current_user_can_for_blog( $blog_id, 'publish-post' ) ) { // Checks by capability, not role
            wp_die( 'Insufficient privileges: Sorry, you do not have access to this page.' );
        }
    }

    // OK, we're authenticated: we need to find and save the data
    // Verify the meta data is set
    if ( isset( $_POST['mrlpt_client_email'] ) && isset( $_POST['mrlpt_client_phone_num'] ) ) {
        // Save meta data
        update_post_meta( $client_post_id, '_mrlpt_client_email', strip_tags( $_POST['mrlpt_client_email'] ) );
        update_post_meta( $client_post_id, '_mrlpt_client_phone_num', strip_tags( $_POST['mrlpt_client_phone_num'] ) );
    }
}
share|improve this question
add comment

1 Answer

up vote 1 down vote accepted

The logic here is incorrect:

// Verify this came from the our screen and with proper authorization, because save_post can be triggered at other times
if ( !isset( $_POST['mrlpt_client_check'] )  && !wp_verify_nonce( $_POST['mrlpt_client_check'], 'mrlpt_submit_client' ) ) {
    return;
}

This reads if the $_POST['mrlpt_client_check'] is not set and is invalid - return. You want it to read if $_POST['mrlpt_client_check'] is not set or it is invalid - return.

So when $_POST['mrlpt_client_check'] is not set it then checks

 wp_verify_nonce( $_POST['mrlpt_client_check'], 'mrlpt_submit_client' )

which throws an error because the first argument is referencing an key that doesn't exist. Your use of the nonce is correct:

wp_nonce_field( 'mrlpt_submit_client', 'mrlpt_client_check' );

So if the metabox is not saving you may want to check what is being posted

function save_client_metadata( $client_post_id ) {

  // Verify if this is an auto save routine.
  if ( defined( 'DOING_AUTOSAVE' ) && DOING_AUTOSAVE )
    return;

  wp_die(var_dump($_POST));
}

I'm not sure what would cause your mrlpt_client_check nonce to not be posted, but you may want to include what includes/mrlpt-client-form.php contains in your question.


Edit

To check permissions:

function save_client_metadata( $post_id ) {

    // Verify if this is an auto save routine.
    if ( defined( 'DOING_AUTOSAVE' ) && DOING_AUTOSAVE )
        return;

    //Check that this post is of type 'post'
    if( 'post' != get_post_type( $post->ID ) )
         return;

    //Check permissions
    if ( !current_user_can_for_blog( $blog_id, 'publish-post' ) )
         wp_die( 'Insufficient privileges: Sorry, you do not have access to this page.' )

    //Check nonce named mrlpt_client_check
    if ( !isset( $_POST['mrlpt_client_check'] )  || !wp_verify_nonce(  $_POST['mrlpt_client_check'], 'mrlpt_submit_client' ) ) 
        return

    //Validate data as necessary

  }
share|improve this answer
    
Ah thank you! Been staring at code for too long. Changed && to || and the error is gone. However now I get the same error with 'mrlpt_client'. –  CourtFantinato Apr 18 '12 at 16:02
    
I have fixed that by removing the check for the type of post and if I use a test user, I do get the message from wp_die. However, the post still goes through. Any ideas as to why? –  CourtFantinato Apr 18 '12 at 16:22
    
Because save_post is fired after the post has been saved, and is intended to allow plug-ins to update post meta as appropriate with the data from the post admin page. –  Stephen Harris Apr 18 '12 at 16:47
    
So, is there really any point in having a permissions check if it's not going to work? I can already control the lowest capability level of access I want through adding the plugin to the menu. –  CourtFantinato Apr 18 '12 at 17:07
    
See updated answer - that should work. Though I'm not sure if for current_user_can_for_blog you to need declare $blog_id global first - never worked in MS. –  Stephen Harris Apr 18 '12 at 17:24
show 2 more comments

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.