Take the 2-minute tour ×
WordPress Development Stack Exchange is a question and answer site for WordPress developers and administrators. It's 100% free, no registration required.

This is an odd case I've run into. A site I've had for years started throwing this "error" when i try to make certain backend changes. It seems pervasive - If i try to install, update, activate or deactivate any plugin. I can still look at the list of plugins and view their settings, generally.

Any thoughts on where to start looking?

share|improve this question
    
do you have sufficient permissions to edit? –  peteroak Aug 6 '12 at 6:25
    
I had this error last week but mine was caused by the database I was running reaching the maximum size. –  Vince Pettit Aug 6 '12 at 9:33
    
Yes on the permissions. –  Geoff Maddock Aug 7 '12 at 2:41

3 Answers 3

This particular message happens when a nonce check fails.

I'd say the likely cause is a conflict with the referer (as part of nonce security, WP checks to see if the referer was an admin page on the same domain & path).

You can rule this out by defining a custom function in wp-config.php:

function check_admin_referer($action = -1, $query_arg = '_wpnonce') {
    if ( -1 == $action )
        _doing_it_wrong( __FUNCTION__, __( 'You should specify a nonce action to be verified by using the first parameter.' ), '3.2' );

    $adminurl = strtolower(admin_url());
    $referer = strtolower(wp_get_referer());
    $result = isset($_REQUEST[$query_arg]) ? wp_verify_nonce($_REQUEST[$query_arg], $action) : false;
    if ( !$result && !(-1 == $action /* skip this: && strpos($referer, $adminurl) === 0 */) ) {
        wp_nonce_ays($action);
        die();
    }
    do_action('check_admin_referer', $action, $result);
    return $result;
}

This implements the standard nonce check, but skips the referer part. If it cures the error message, we've isolated the problem and can work towards a permanent fix.

Further reading on the two primary types of errors (this, and insufficient permissions).

share|improve this answer

I ran into this problem when implementing 'on_activation' code and needed to see my output mid-development. Well, this is a big no-no and even with an 'exit' statement, wordpress (4) was showing "Are you sure you want to do this?" instead of my dump. @TheDeadMedic's suggestion got pointed in the right direction, but didn't work in my particular case. I put the following into my wp-config.php

 // =============== FOR DEVELOPMENT ONLY -BEGIN- ================
/* Stop Checking NONCE
Motivation: when trying to see the output in _deactivation, it would show.
*/
function check_admin_referer($action = -1, $query_arg = '_wpnonce') { //http://wordpress.stackexchange.com/a/60977/8972
    return true;  // honey badger don't care (if I'm in development)   
}
// =============== FOR DEVELOPMENT ONLY -END- ================

This will basically kill a bunch of otherwise useful security stuff.

BTW - I was following this sample (http://wordpress.stackexchange.com/a/25979/8972) by @kaiser for activating a plugin.

share|improve this answer

I've discovered this can also happen if a check_admin_referer() function is being called with invalid arguments somewhere in your site. If you're getting this error and cant find the problem, check your use of check_admin_referer() throughout your theme and plugins.

I started getting this error right after I created a new admin options page for my theme. I had added a check_admin_referer() inside a new class, and accidentally swapped the 1st and 2nd parameters. I didn't get any error messages from the class itself, but it mysteriously started affecting the saving of options and profiles in pages that didn't even load or call the class I had created. Fixing my call to check_admin_referer() immediately solved the proble.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.