The tag has no usage guidance.

learn more… | top users | synonyms

0
votes
1answer
26 views

Nonce and widget

I've been screening the code of several widget and haven't found any one of them handling nonce. I also took a look at the WP_Widget class and found nothing about it as well. This is from the codex: ...
0
votes
1answer
6 views

Nonce for Trashing Item

I have a custom admin page. On it, I have created a filtered list of the custom post type based on postmeta data. I have to create a link to delete that post. I am trying to figure out how to ...
0
votes
0answers
40 views

External request to Wordpress WP-API - Basic Authentication

I'm trying to hit my Wordpress API using Basic Auth with Guzzle (http tool) from my middleware (Laravel). $username = 'myAdminUserName'; $password = 'myAdminPassword'; $uri = ...
0
votes
0answers
15 views

Using wp_nonces in email links?

I would love to be able to use nonces in email links (sent out to a list of people via email to subscribe to comment notifications) My idea was to use: $Link = get_site_url() . $url_endpoint . ...
1
vote
1answer
63 views

How can I trash multiple posts at once from the front end?

I took a peek at the code in edit.php and am now generating links with this code: wp_nonce_url("/wp-admin/edit.php?doaction=trash&post_type=post&ids=postIds", "bulk-posts") The ...
0
votes
1answer
33 views

Nonce fail after second submit attempt

I am refactoring my plugin that resets the WordPress database tables back to their defaults and came across an issue. The form submission itself works fine. However, after the first submit, and if ...
7
votes
1answer
218 views

How does nonce verification work?

I can see that wp_nonce_field generates a value in the hidden field. <input type="hidden" id="message-send" name="message-send" value="cabfd9e42d" /> But wp_verify_nonce isn't using that ...
0
votes
0answers
17 views

Is it possible to use nonce server side?

I would like to create a security hash and pass it to an url as a parameter: http://example.com/somefolder/dostuff.php?nonce=hash In dostuff.php, validate the nonce hash. I can do this for logged ...
0
votes
1answer
36 views

custom metabox nonce verification fails

I'm adding a metabox on a custom post type and my nonce-verification fails. I'm not really where to look for why it's going wrong. Can anyone point me in the right direction? Here's my code: function ...
0
votes
0answers
90 views

How to use nonces for frontend AJAX voting if the page gets cached?

I'm building a custom voting solution for my site that would allow public AJAX voting on multiple posts per page. Votes can be added/changed/revoked. Values are stored in custom post meta. I ...
0
votes
0answers
30 views

One nonce for multiple forms that use the same PHP file

Here's the form that appears in multiple places with differing fields... <form method="post" action="save-settings.php"> FORM FIELDS HERE <?php wp_nonce_field( 'mynonce' ); ?> ...
0
votes
1answer
30 views

Nonce doesn't validate in nopriv call

I have a function which uses Ajax calls: function bs_reserve_gift() { if (!wp_verify_nonce($_POST['_wpnonce'], 'reserve_gift')) { $response['status'] = 'error'; ...
2
votes
0answers
87 views

AJAX requests broken due to HTTPS for wp-admin

I have my wp-admin section forced to HTTPS via a plugin. I also have specific pages that are using https on the frontend (login, billing, etc.) I seem to be having an issue with HTTP pages using AJAX ...
1
vote
1answer
139 views

How to check an ajax nonce in PHP

I'm modifying the media modal adding a new menu item to add external attachments to the media library. From the JS code I'm calling a PHP function that touches the database and accepts three ...
4
votes
1answer
184 views

Extend Wordpress (4.x) session and nonce

We've got a small web application that allows users to log in (via WordPress) and remain logged in for a max 15 min session for security purposes. Because most sessions will last longer, I have a ...
0
votes
1answer
21 views

How to insert wp_nonce field within echoed string

I can't find a way to properly insert wp_nonce field, without braking the code. The code below is from a class function that sends back string, which will be echoed. $end_data .= '<input ...
1
vote
1answer
53 views

Can you have more than one nonce on a page?

I have a site with a page where there's one form in the sidebar, and one in the main body of the page. The sidebar comes first in the HTML. Both forms have their own nonces (generated with ...
0
votes
0answers
61 views

Are nonce really needed in frontent AJAX?

While doing some Wordpress development, I found that many frontend plugins, like contact forms, are using nonce values. Are they really needed? From security point they don't do much, as scraper can ...
0
votes
1answer
214 views

“Notice: Undefined index:” error when adding new content?

I'm getting the following error... Notice: Undefined index: album_tracks_metabox_nonce in /Applications/MAMP/htdocs/TheToasters/wp-content/themes/Toasters/discography-post-type.php on line 124 ...
0
votes
0answers
29 views

Is it good practice to use WordPress nonce values to restrict page access?

I'm working with a colleague on a WordPress plugin. Part of the plugin functionality is showing dynamic lists with links which allow you to open a new page. Depending on the user's role, they may or ...
1
vote
0answers
146 views

wp_mail ajax form - nonce not working [closed]

I have a working form in Wordpress using ajax to pass the info to php and wp_mail to send the email. My final problem is getting the nonce to work. The js $atj(function(){ ...
0
votes
1answer
109 views

wp_create_nonce function doesn't work inside a plugin?

I am writing a WordPress plugin which is creating a form in one of its functions. It looks like this (very simplyfied): class MyPlugin { public function createForm() { $nonce = ...
0
votes
1answer
190 views

Should I use wp_nonce_field on my contact form?

I have created a self submitting contact form template and it works nicely, however when I was browsing the web in search for tutorials (for creating contact forms) I have noticed that some people ...
0
votes
0answers
24 views

WP Meta Box Not Saving

I've been trying to get this custom meta box to save but it is not working. I've browsed around but still haven't found a solution that works. function add_link_box() { add_meta_box( ...
1
vote
1answer
127 views

Why does Wordpress Heartbeat login not refresh the nonces?

Here's an interesting experiment: Go to wordpress plugins listing page, notice the activate, deactivate links all have a nonce part in the request. In a second tab, log out of the site, and go back ...
2
votes
1answer
161 views

Security around save_post hook

There are a lot of examples using the save_post hook, that include adding and verifying a nonce, and checking the user has appropriate permissions before you continue. Is this necessary? When ...
0
votes
1answer
149 views

How can I create a plugin installation link?

Currently, my code is generating the wrong nonce, I guess. Here is the code: $action = 'install-plugin'; $plugin = 'akismet'; wp_nonce_url( add_query_arg( array( 'action' ...
2
votes
1answer
962 views

Is wp_nonce_field vulnerable if you know the action name?

Is wp_nonce_field vulnerable if you know the action name? I am actually adding a hidden field with name = the name of the action name in my form so that my plugin can identify it. I want to know if ...
0
votes
1answer
63 views

Nonce keeps failing

I have a plugin that works for 99% of the users, but one user is having problems. The plugin opens a thickbox modal window and pushes content via the load-edit.php hook. The links are displayed in a ...
0
votes
0answers
258 views

Create nonce in frontend page to edit profile

I am trying to create a frontend edit profile form that mimics the wp-admin backend edit profile. I created the form as HTML directly in a WordPress page (I'm a PHP/WordPress beginner, so I don't know ...
0
votes
1answer
42 views

Is it necessary to use a WordPress nonce when allowing users to download public data?

I am using jQuery .load() to load the next page of WordPress posts after a button is clicked. The next page of posts is public data (no access restrictions on it whatsoever). Should I use a WordPress ...
0
votes
1answer
137 views

Verify Nonce returns false - Request Nonce returns correct value

I'm trying to verify that the nonce I created exists but for some reason it keeps returning false, why is this happening? Creating my nonce: <?php ...
0
votes
0answers
363 views

Nonces and Cache

It's clear that form submissions and AJAX requests, especially sensible ones, need "nonces" to avoid certain exploits. However, with heavy use of caching systems it becomes harder to generate them ...
0
votes
1answer
2k views

How to get the wpnonce value?

On using inspect element to check the 'href' attribute of 'Deactivate' links for the plugins listed on plugins.php page, I found that the url contains a wpnonce field with a certain value. I need to ...
2
votes
1answer
372 views

Confusion on WP Nonce usage in my Plugin

I created a small plugin where users can set multiple featured image by clicking Add New link from the meta box and remove them as well. The user can use Set featured image link to select featured ...
0
votes
1answer
135 views

Do I require the use of nonce?

Im creating a visit/page views counter with ajax,jquery and php, I have been reading a few articles that recommend the use of nonces for data manipulation through ajax, however i am not sure if i need ...
0
votes
0answers
101 views

when saveing $meta_box i get Undefined index error

I need help to fix these Notices: PHP Notice: Undefined index: person-name in testimonials.php on line 112 PHP Notice: Undefined index: position in testimonials.php on line 112 PHP Notice: Undefined ...
0
votes
2answers
2k views

wp_verify_nonce keeps failing

I needed to assign categories to post from frontend so I am making use of the solution suggested in this thread , in form of a plugin. It is working as expected. I just wanted to add a nonce field in ...
0
votes
1answer
220 views

Using Nonce for my Form

Essentially I need to verify my data using a nonce, but I'm not sure that I'm doing it right. What I'm trying to do is remove a menu option for a user that isn't an admin. If a checkbox is checked and ...
0
votes
1answer
45 views

Why do Metabox use Nonces?

Why is it advised for admin panel metaboxes to use nonces? Every example I see of creation and saving metabox data there are nonces involved but aren't nonces a bit unnecessary in this case?
1
vote
1answer
67 views

Security checking in meta_box save is reluctant?

For example, in this tutorial, the code suggested when saving meta box data is /* Verify the nonce before proceeding. */ if ( !isset( $_POST['smashing_post_class_nonce'] ) || !wp_verify_nonce( ...
0
votes
1answer
151 views

Metabox nonce not allowing update

I'm having a problem correcting saving metabox data on a custom post type. I thought I fixed it by applying the advice on this post: Metabox nonce PHP notice which does get rid of the warning but ...
0
votes
1answer
90 views

Nonce failing with second argument

The plugin Plugin Maker pastebin is not working and I've narrowed it down to its nonce-mechanism failing. At one point it checks for check_admin_referer('$pluginmaker_nonce', $pluginmaker_nonce); ...
1
vote
1answer
49 views

// Nonce generated 0-12 hours ago

[x-post: SO] In wordpress there's a nonce generating-verifying mechanism, and I'm having trouble understanding why it's not working correctly... At a point it checks for whether the nonce was ...
0
votes
1answer
345 views

Form Security: nonce vs. jQuery

I am trying to create a methodology for submitting forms on my WordPress site. In the past, I have used WordPress nonces in order to secure form submission, but I like the idea of using jQuery to ...
1
vote
0answers
167 views

Bypass nonce value while trashing a post

I want to move a post in trash but the condition is that simultaneously I need to delete some more posts. Sample Code: jQuery(function($) { $('#delete-action a').unbind(); $('#delete-action ...
3
votes
2answers
170 views

Is it safe to assume that a nonce may be validated more than once?

From what I have gathered, once a nonce is generated it is valid for reuse for the next 48 hours. Is it safe to code with this in mind? I'm writing a plugin that does a bit of toing and froing with ...
1
vote
1answer
137 views

wp_verify_nonce doesn't return true on server when it matches the nonce

$.ajax({ type: "POST", dataType: "text", url: ajaxurl, data: { action: "more_news", nonce: nonce, offset: offset }, success : function(data, ...
2
votes
1answer
73 views

Using Nonces for AJAX that only retrieves data

Does it make sense to use a nonce on an AJAX action that only returns data and doesn't alter data on the server side? I understand they are important if you are saving data or changing something on ...
2
votes
1answer
101 views

How to save multiple metaboxes?

I read a tutorial about metaboxes, most of things are clear but I have a question about multiple metaboxes. My question is about saving, in the tutorial: <?php add_action( 'save_post', ...