Take the 2-minute tour ×
WordPress Development Stack Exchange is a question and answer site for WordPress developers and administrators. It's 100% free, no registration required.

i have a case in my admin panel where i need to call my own function that resides in my own php file, with a GET request. This function is actually removing entries from the database.

So, i would like to make sure that this cannot be invoked from anybody else than the admin user. What is the best way of doing that ? Notice that my 'example.php?filename=..' script is executed directly and should return with refreshing the page on the admin panel.

How do i secure that properly ? Is there a better way of doing that while being controlled by Wordpress default security measures ?

It would be also great to be able to execute things like get_option in the context of my php code.

share|improve this question
add comment

1 Answer 1

Read about "Nonces".

Create one and append it to your URL:

$url = 'example.php?filename=whatever&nonce=' . wp_create_nonce('my_sensitive_action');

When your request is fulfilled check for it:

// here verify if the nonce was used before
if(wp_verify_nonce($_GET['nonce'], 'my_sensitive_action')){
  // it's ok, it wasn't used before
}

Also the validity of these nonces has a time limit, like one day or so. If the nonce is not used within this period, it will expire...

share|improve this answer
    
yes, i know about nonces, but these are mainly used for csrf types of attacks. An admin check should still happen to avoid privilege escalations. I was thinking of maybe somehow including my code in a more proper way. I was reading a few things just now about wordpress custom actions. It feels like this is the way to go, probably along with an is_admin() check, do you think that's correct ? +1 for your answer, thanx ! –  SpyrosP Oct 1 '12 at 1:26
1  
well, you can always do extra checks, see current_user_can for example. is_admin() is probably not necessary, as you most likely hooked your function to an action available only within the administration pages, right? –  onetrickpony Oct 1 '12 at 1:28
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.