The tag has no wiki summary.

learn more… | top users | synonyms

1
vote
0answers
33 views

wp_mail ajax form - nonce not working [closed]

I have a working form in Wordpress using ajax to pass the info to php and wp_mail to send the email. My final problem is getting the nonce to work. The js $atj(function(){ ...
0
votes
1answer
28 views

wp_create_nonce function doesn't work inside a plugin?

I am writing a WordPress plugin which is creating a form in one of its functions. It looks like this (very simplyfied): class MyPlugin { public function createForm() { $nonce = ...
0
votes
1answer
37 views

Should I use wp_nonce_field on my contact form?

I have created a self submitting contact form template and it works nicely, however when I was browsing the web in search for tutorials (for creating contact forms) I have noticed that some people ...
0
votes
0answers
16 views

WP Meta Box Not Saving

I've been trying to get this custom meta box to save but it is not working. I've browsed around but still haven't found a solution that works. function add_link_box() { add_meta_box( ...
0
votes
0answers
50 views

Processing form post data using database queries to construct custom query string

I have a form on my wordpress site. On form submission I want to: 1) Capture the form data 2) Run database queries using these data 3) Process the results and use these to construct a query string 4) ...
1
vote
1answer
46 views

Why does Wordpress Heartbeat login not refresh the nonces?

Here's an interesting experiment: Go to wordpress plugins listing page, notice the activate, deactivate links all have a nonce part in the request. In a second tab, log out of the site, and go back ...
2
votes
1answer
92 views

Security around save_post hook

There are a lot of examples using the save_post hook, that include adding and verifying a nonce, and checking the user has appropriate permissions before you continue. Is this necessary? When ...
0
votes
0answers
18 views

Enable Media Replace Plugin - Add additional link to replace attachment page

I am trying to Add the to the attachments uploaded to this post screen when viewing attachments. I've been playing around with this in my themes functions.php, the below adds the text on the screen ...
0
votes
1answer
35 views

How can I create a plugin installation link?

Currently, my code is generating the wrong nonce, I guess. Here is the code: $action = 'install-plugin'; $plugin = 'akismet'; wp_nonce_url( add_query_arg( array( 'action' ...
0
votes
0answers
33 views

Delete Categories and Tags from frontend

There is a function to generate post delete link from frontend: get_delete_post_link( $id ); Are there any functions to generate categories and tags delete link on frontend? I have been looking for ...
2
votes
1answer
349 views

Is wp_nonce_field vulnerable if you know the action name?

Is wp_nonce_field vulnerable if you know the action name? I am actually adding a hidden field with name = the name of the action name in my form so that my plugin can identify it. I want to know if ...
0
votes
1answer
48 views

Nonce keeps failing

I have a plugin that works for 99% of the users, but one user is having problems. The plugin opens a thickbox modal window and pushes content via the load-edit.php hook. The links are displayed in a ...
0
votes
0answers
181 views

Create nonce in frontend page to edit profile

I am trying to create a frontend edit profile form that mimics the wp-admin backend edit profile. I created the form as HTML directly in a WordPress page (I'm a PHP/WordPress beginner, so I don't know ...
0
votes
0answers
13 views

WP Nonce with Ajax- is it always neccessary? [duplicate]

I read, well, everywhere, that it is necessary to use the built in WP_Nonce feature when submitting AJAX requests. as such: wp_enqueue_script('my-ajax-request', plugin_dir_url(__FILE__) . ...
0
votes
1answer
32 views

Is it necessary to use a WordPress nonce when allowing users to download public data?

I am using jQuery .load() to load the next page of WordPress posts after a button is clicked. The next page of posts is public data (no access restrictions on it whatsoever). Should I use a WordPress ...
0
votes
1answer
95 views

Verify Nonce returns false - Request Nonce returns correct value

I'm trying to verify that the nonce I created exists but for some reason it keeps returning false, why is this happening? Creating my nonce: <?php ...
0
votes
0answers
200 views

Nonces and Cache

It's clear that form submissions and AJAX requests, especially sensible ones, need "nonces" to avoid certain exploits. However, with heavy use of caching systems it becomes harder to generate them ...
0
votes
1answer
926 views

How to get the wpnonce value?

On using inspect element to check the 'href' attribute of 'Deactivate' links for the plugins listed on plugins.php page, I found that the url contains a wpnonce field with a certain value. I need to ...
2
votes
1answer
282 views

Confusion on WP Nonce usage in my Plugin

I created a small plugin where users can set multiple featured image by clicking Add New link from the meta box and remove them as well. The user can use Set featured image link to select featured ...
0
votes
1answer
114 views

Do I require the use of nonce?

Im creating a visit/page views counter with ajax,jquery and php, I have been reading a few articles that recommend the use of nonces for data manipulation through ajax, however i am not sure if i need ...
0
votes
0answers
84 views

when saveing $meta_box i get Undefined index error

I need help to fix these Notices: PHP Notice: Undefined index: person-name in testimonials.php on line 112 PHP Notice: Undefined index: position in testimonials.php on line 112 PHP Notice: Undefined ...
0
votes
2answers
1k views

wp_verify_nonce keeps failing

I needed to assign categories to post from frontend so I am making use of the solution suggested in this thread , in form of a plugin. It is working as expected. I just wanted to add a nonce field in ...
0
votes
1answer
159 views

Using Nonce for my Form

Essentially I need to verify my data using a nonce, but I'm not sure that I'm doing it right. What I'm trying to do is remove a menu option for a user that isn't an admin. If a checkbox is checked and ...
0
votes
1answer
44 views

Why do Metabox use Nonces?

Why is it advised for admin panel metaboxes to use nonces? Every example I see of creation and saving metabox data there are nonces involved but aren't nonces a bit unnecessary in this case?
1
vote
1answer
61 views

Security checking in meta_box save is reluctant?

For example, in this tutorial, the code suggested when saving meta box data is /* Verify the nonce before proceeding. */ if ( !isset( $_POST['smashing_post_class_nonce'] ) || !wp_verify_nonce( ...
0
votes
1answer
105 views

Metabox nonce not allowing update

I'm having a problem correcting saving metabox data on a custom post type. I thought I fixed it by applying the advice on this post: Metabox nonce PHP notice which does get rid of the warning but ...
0
votes
1answer
67 views

Nonce failing with second argument

The plugin Plugin Maker pastebin is not working and I've narrowed it down to its nonce-mechanism failing. At one point it checks for check_admin_referer('$pluginmaker_nonce', $pluginmaker_nonce); ...
1
vote
1answer
42 views

// Nonce generated 0-12 hours ago

[x-post: SO] In wordpress there's a nonce generating-verifying mechanism, and I'm having trouble understanding why it's not working correctly... At a point it checks for whether the nonce was ...
0
votes
1answer
270 views

Form Security: nonce vs. jQuery

I am trying to create a methodology for submitting forms on my WordPress site. In the past, I have used WordPress nonces in order to secure form submission, but I like the idea of using jQuery to ...
1
vote
0answers
107 views

Bypass nonce value while trashing a post

I want to move a post in trash but the condition is that simultaneously I need to delete some more posts. Sample Code: jQuery(function($) { $('#delete-action a').unbind(); $('#delete-action ...
3
votes
2answers
116 views

Is it safe to assume that a nonce may be validated more than once?

From what I have gathered, once a nonce is generated it is valid for reuse for the next 48 hours. Is it safe to code with this in mind? I'm writing a plugin that does a bit of toing and froing with ...
1
vote
1answer
94 views

wp_verify_nonce doesn't return true on server when it matches the nonce

$.ajax({ type: "POST", dataType: "text", url: ajaxurl, data: { action: "more_news", nonce: nonce, offset: offset }, success : function(data, ...
2
votes
1answer
58 views

Using Nonces for AJAX that only retrieves data

Does it make sense to use a nonce on an AJAX action that only returns data and doesn't alter data on the server side? I understand they are important if you are saving data or changing something on ...
2
votes
1answer
88 views

How to save multiple metaboxes?

I read a tutorial about metaboxes, most of things are clear but I have a question about multiple metaboxes. My question is about saving, in the tutorial: <?php add_action( 'save_post', ...
1
vote
2answers
775 views

Undefined index: at_nonce in custom post metabox

I'm getting this error with my custom post metabox. The custom post and metabox works fine, but if i have debug on and when i try to save any other page or post, i will get an error: Notice: ...
0
votes
1answer
262 views

Nonce check causing issues when creating new post

I have created a new custom post type and some custom fields for it. My function for saving the custom meta fields fires on the 'save_post' hook. The problem is that I am getting a warning when I go ...
8
votes
2answers
3k views

How to get a unique nonce for each Ajax request?

I've seen a couple of discussions about getting Wordpress to regenerate a unique nonce for subsequent Ajax requests, but for the life of me I can't actually get Wordpress to do it-- every time I ...
3
votes
1answer
262 views

Nonces can be reused multiple times? Bug / Security issue?

I've read that nonces are meant to be for one time use only, and after an ajax request, you should issue a new nonce so with the next ajax request, a new nonce would be sent to the server. However, I ...
1
vote
0answers
491 views

Security - Ajax and Nonce use [closed]

I'm developing a site which posts a number of ajax calls from jquery to PHP and returns data from PhP to jquery. Everything is working, but i'd to know if my approach to handling the calls is ok, in ...
0
votes
1answer
448 views

Saving custom data via ajax with nonces

I'm trying to securely save custom data to database from plugin backend via ajax. JavaScript code that runs after clicking save button: $.ajax({ url: ajaxVars.ajaxurl, type: 'post', ...
2
votes
0answers
1k views

How to stop _wpnonce and _wp_http_referer from appearing in URL

I am trying to develop a plug-in that has a search field and uses WP_List_Table. The plug-in is strictly for the backend and searches the users in the database and returns them along with some other ...
2
votes
2answers
257 views

Nonce best practices: hidden input vs. wp_localize_script?

I noticed while looking at the HTML of an edit page that WordPress uses a lot of hidden input elements for storing nonces. Is there a significant advantage to using either this style of storing ...
1
vote
2answers
1k views

wp_verify_nonce not working

I'm working on an ajax request, I have several ajax requests on my functions.php. And all are working, but this: On my php I have this: add_action("wp_ajax_fb_points", "get_fb_points"); ...
2
votes
2answers
905 views

How to use nonce with front end submission form?

Thanks to a variety of posts on here I've managed to put together a front end submission form. After about 24 hours of tweaking I've finally got everything working including a redirect to a 'success' ...
0
votes
1answer
785 views

The Correct Way to Use Nonce Field without Settings API

I'm trying to create an admin option page without the Settings API for some reasons. Then if I do so, I've heard that I need to use nonces for security. I'd like to know the correct way to use them. ...
1
vote
1answer
1k views

How to use wp_nonce_url() in a link?

I am creating a plugin to display all posts from all custom post type. It is something like in edit.php, but instead of displaying single post type,I would like to display all posts in one page from ...
0
votes
1answer
180 views

Use of check_admin_referer with theme options and options.php

If I set up a theme options page in the way suggested by the codex (http://codex.wordpress.org/Creating_Options_Pages) then my form submits to 'option.php'. settings_fields creates a nonce, which if ...
1
vote
0answers
94 views

My custom write panels won't save data. What am I missing?

So far I've been reading some tutorials about ways to create Custom Write Panels. It seems that none of them will really work without some bug. I'd like to discuss one of those tuts here: ...
2
votes
2answers
498 views

How to verify nonce from Bulk/Quick Edit in save_post?

I need to do something specific in my save_post callback for bulk and/or quick edits, so how do I check the nonce for that? I can only find _wpnonce in the edit.php html source, but can't find an ...
1
vote
1answer
282 views

Custom post type: check permissions and validate nonce

I have a custom post type with the following capabilities: $capabilities = array( 'read_post' => 'administrator', 'read_private_posts' => 'administrator', 'publish_posts' => ...