The tag has no wiki summary.

learn more… | top users | synonyms

8
votes
2answers
4k views

How to get a unique nonce for each Ajax request?

I've seen a couple of discussions about getting Wordpress to regenerate a unique nonce for subsequent Ajax requests, but for the life of me I can't actually get Wordpress to do it-- every time I ...
3
votes
1answer
362 views

Nonces can be reused multiple times? Bug / Security issue?

I've read that nonces are meant to be for one time use only, and after an ajax request, you should issue a new nonce so with the next ajax request, a new nonce would be sent to the server. However, I ...
1
vote
0answers
702 views

Security - Ajax and Nonce use [closed]

I'm developing a site which posts a number of ajax calls from jquery to PHP and returns data from PhP to jquery. Everything is working, but i'd to know if my approach to handling the calls is ok, in ...
0
votes
1answer
598 views

Saving custom data via ajax with nonces

I'm trying to securely save custom data to database from plugin backend via ajax. JavaScript code that runs after clicking save button: $.ajax({ url: ajaxVars.ajaxurl, type: 'post', ...
2
votes
1answer
1k views

How to stop _wpnonce and _wp_http_referer from appearing in URL

I am trying to develop a plug-in that has a search field and uses WP_List_Table. The plug-in is strictly for the backend and searches the users in the database and returns them along with some other ...
2
votes
2answers
294 views

Nonce best practices: hidden input vs. wp_localize_script?

I noticed while looking at the HTML of an edit page that WordPress uses a lot of hidden input elements for storing nonces. Is there a significant advantage to using either this style of storing ...
1
vote
2answers
2k views

wp_verify_nonce not working

I'm working on an ajax request, I have several ajax requests on my functions.php. And all are working, but this: On my php I have this: add_action("wp_ajax_fb_points", "get_fb_points"); ...
2
votes
2answers
1k views

How to use nonce with front end submission form?

Thanks to a variety of posts on here I've managed to put together a front end submission form. After about 24 hours of tweaking I've finally got everything working including a redirect to a 'success' ...
0
votes
1answer
1k views

The Correct Way to Use Nonce Field without Settings API

I'm trying to create an admin option page without the Settings API for some reasons. Then if I do so, I've heard that I need to use nonces for security. I'd like to know the correct way to use them. ...
2
votes
1answer
2k views

How to use wp_nonce_url() in a link?

I am creating a plugin to display all posts from all custom post type. It is something like in edit.php, but instead of displaying single post type,I would like to display all posts in one page from ...
0
votes
1answer
200 views

Use of check_admin_referer with theme options and options.php

If I set up a theme options page in the way suggested by the codex (http://codex.wordpress.org/Creating_Options_Pages) then my form submits to 'option.php'. settings_fields creates a nonce, which if ...
1
vote
0answers
97 views

My custom write panels won't save data. What am I missing?

So far I've been reading some tutorials about ways to create Custom Write Panels. It seems that none of them will really work without some bug. I'd like to discuss one of those tuts here: ...
2
votes
2answers
586 views

How to verify nonce from Bulk/Quick Edit in save_post?

I need to do something specific in my save_post callback for bulk and/or quick edits, so how do I check the nonce for that? I can only find _wpnonce in the edit.php html source, but can't find an ...
1
vote
1answer
303 views

Custom post type: check permissions and validate nonce

I have a custom post type with the following capabilities: $capabilities = array( 'read_post' => 'administrator', 'read_private_posts' => 'administrator', 'publish_posts' => ...
8
votes
4answers
2k views

Do I need a nonce field for every meta box I add to my custom post type admin?

I'm currently working on the admin page of my custom post type, and I got stuck on deciding whether to add a nonce field again for the second metabox or not. I'm very new to custom post types, and ...
0
votes
1answer
1k views

Forms and WordPress Nonce

WordPress nonce is driving me nuts! I had this problem when I started my plugin and removed it but now I have come back to it and still don't know what to do. I have looked all over for a solution. ...
10
votes
1answer
3k views

wp_verify_nonce vs check_admin_referer

What is the difference, which one should I use? I know that wp_verify_nonce checks the time limit, and check_admin_referer I think calls wp_verify_nonce as well as checking for an admin url segment, ...
1
vote
2answers
778 views

wp_nonce_field displaying twice

I have wp_nonce_field in my code but it's creating two instances to the html code for some reason, one where I'd expect it and another at the start of the entry. Is this correct or am I doing ...
2
votes
1answer
453 views

Using nonce external of WP Admin

All, I've got two wordpress pages. One wordpress page displays a form to do some registration stuff for the website. The second wordpress page actually processes the data and inserts it into a custom ...
8
votes
2answers
1k views

Can I use the same nonce for multiple requests on the same page?

Or does this break the purpose of the nonce, which I admint I don't quite understand it? :) For example on two ajax requests that run on page load, or when something is clicked: $.ajax({ type: ...
8
votes
2answers
819 views

Are Nonces Useless?

This is probably a noob question BUT hear me out - isn't the point of using Nonce to protect from things like scrappers (phpcurl scrappers etc.)? But my Nonce prints out in the head of the document ...
3
votes
1answer
3k views

Fatal error: Call to undefined function wp_create_nonce()

I'm trying to add a nonce to my plugin's Ajax. I'm not sure why I'm getting this error: Fatal error: Call to undefined function wp_create_nonce() In my php file : ...
0
votes
1answer
855 views

Help with forms and nonces

I am trying to create a nonce to use with a (public-facing) form. Below is my code: function my_form() { if (isset($_POST['submit'])) { $name = $_POST['name']; $description = ...
0
votes
1answer
632 views

Public posts - preventing duplicate form submissions

I'm creating a public form on a page that allows non-registered (public) visitors to create posts of a custom post type. I'm using nonces, which I naiveley thought would expire once they were used. ...
0
votes
2answers
2k views

Ajax function returns -1

I have a question. I made a simply ajax function. When I'm logged in, it works perfectly. When I'm logged out, it returns me -1 (since Wordpress 3.1) Why ? I don't understand. Precisely, it returns ...
1
vote
2answers
194 views

my theme breaks WP export

I know this is a vague question, please just spend time on it if you are in the mood, I don't need to be flamed for not being more precise. I'm having a problem with a theme I'm developing, for some ...
5
votes
1answer
1k views

Multiple ajax nonce requests

I have a feature in my current project that will be allow multiple ajax requests - I've got a single nonce request worked out (via this tute), but am somewhat unsure how to figure in multiple nonce ...
3
votes
1answer
1k views

WordPress failure when logging out

I have came across the WordPress logout error several times but I really never figured out the cause of it. In earlier days, it was generally that I was missing a nonce but now even with logout link ...