The tag has no wiki summary.

learn more… | top users | synonyms

10
votes
1answer
1k views

wp_verify_nonce vs check_admin_referer

What is the difference, which one should I use? I know that wp_verify_nonce checks the time limit, and check_admin_referer I think calls wp_verify_nonce as well as checking for an admin url segment, ...
8
votes
2answers
621 views

Are Nonces Useless?

This is probably a noob question BUT hear me out - isn't the point of using Nonce to protect from things like scrappers (phpcurl scrappers etc.)? But my Nonce prints out in the head of the document ...
8
votes
2answers
2k views

How to get a unique nonce for each Ajax request?

I've seen a couple of discussions about getting Wordpress to regenerate a unique nonce for subsequent Ajax requests, but for the life of me I can't actually get Wordpress to do it-- every time I ...
6
votes
2answers
679 views

Can I use the same nonce for multiple requests on the same page?

Or does this break the purpose of the nonce, which I admint I don't quite understand it? :) For example on two ajax requests that run on page load, or when something is clicked: $.ajax({ type: ...
4
votes
1answer
904 views

Multiple ajax nonce requests

I have a feature in my current project that will be allow multiple ajax requests - I've got a single nonce request worked out (via this tute), but am somewhat unsure how to figure in multiple nonce ...
3
votes
4answers
1k views

Do I need a nonce field for every meta box I add to my custom post type admin?

I'm currently working on the admin page of my custom post type, and I got stuck on deciding whether to add a nonce field again for the second metabox or not. I'm very new to custom post types, and ...
3
votes
2answers
91 views

Is it safe to assume that a nonce may be validated more than once?

From what I have gathered, once a nonce is generated it is valid for reuse for the next 48 hours. Is it safe to code with this in mind? I'm writing a plugin that does a bit of toing and froing with ...
2
votes
1answer
180 views

Nonces can be reused multiple times? Bug / Security issue?

I've read that nonces are meant to be for one time use only, and after an ajax request, you should issue a new nonce so with the next ajax request, a new nonce would be sent to the server. However, I ...
2
votes
2answers
416 views

How to verify nonce from Bulk/Quick Edit in save_post?

I need to do something specific in my save_post callback for bulk and/or quick edits, so how do I check the nonce for that? I can only find _wpnonce in the edit.php html source, but can't find an ...
2
votes
1answer
1k views

Fatal error: Call to undefined function wp_create_nonce()

I'm trying to add a nonce to my plugin's Ajax. I'm not sure why I'm getting this error: Fatal error: Call to undefined function wp_create_nonce() In my php file : ...
2
votes
1answer
164 views

Confusion on WP Nonce usage in my Plugin

I created a small plugin where users can set multiple featured image by clicking Add New link from the meta box and remove them as well. The user can use Set featured image link to select featured ...
2
votes
1answer
73 views

How to save multiple metaboxes?

I read a tutorial about metaboxes, most of things are clear but I have a question about multiple metaboxes. My question is about saving, in the tutorial: <?php add_action( 'save_post', ...
2
votes
2answers
226 views

Nonce best practices: hidden input vs. wp_localize_script?

I noticed while looking at the HTML of an edit page that WordPress uses a lot of hidden input elements for storing nonces. Is there a significant advantage to using either this style of storing ...
2
votes
1answer
369 views

Using nonce external of WP Admin

All, I've got two wordpress pages. One wordpress page displays a form to do some registration stuff for the website. The second wordpress page actually processes the data and inserts it into a custom ...
2
votes
2answers
575 views

How to use nonce with front end submission form?

Thanks to a variety of posts on here I've managed to put together a front end submission form. After about 24 hours of tweaking I've finally got everything working including a redirect to a 'success' ...
2
votes
1answer
623 views

WordPress failure when logging out

I have came across the WordPress logout error several times but I really never figured out the cause of it. In earlier days, it was generally that I was missing a nonce but now even with logout link ...
2
votes
0answers
726 views

How to stop _wpnonce and _wp_http_referer from appearing in URL

I am trying to develop a plug-in that has a search field and uses WP_List_Table. The plug-in is strictly for the backend and searches the users in the database and returns them along with some other ...
1
vote
2answers
462 views

wp_nonce_field displaying twice

I have wp_nonce_field in my code but it's creating two instances to the html code for some reason, one where I'd expect it and another at the start of the entry. Is this correct or am I doing ...
1
vote
2answers
174 views

my theme breaks WP export

I know this is a vague question, please just spend time on it if you are in the mood, I don't need to be flamed for not being more precise. I'm having a problem with a theme I'm developing, for some ...
1
vote
1answer
56 views

Security checking in meta_box save is reluctant?

For example, in this tutorial, the code suggested when saving meta box data is /* Verify the nonce before proceeding. */ if ( !isset( $_POST['smashing_post_class_nonce'] ) || !wp_verify_nonce( ...
1
vote
1answer
1k views

How to use wp_nonce_url() in a link?

I am creating a plugin to display all posts from all custom post type. It is something like in edit.php, but instead of displaying single post type,I would like to display all posts in one page from ...
1
vote
2answers
429 views

Undefined index: at_nonce in custom post metabox

I'm getting this error with my custom post metabox. The custom post and metabox works fine, but if i have debug on and when i try to save any other page or post, i will get an error: Notice: ...
1
vote
2answers
895 views

wp_verify_nonce not working

I'm working on an ajax request, I have several ajax requests on my functions.php. And all are working, but this: On my php I have this: add_action("wp_ajax_fb_points", "get_fb_points"); ...
1
vote
1answer
37 views

// Nonce generated 0-12 hours ago

[x-post: SO] In wordpress there's a nonce generating-verifying mechanism, and I'm having trouble understanding why it's not working correctly... At a point it checks for whether the nonce was ...
1
vote
1answer
48 views

Using Nonces for AJAX that only retrieves data

Does it make sense to use a nonce on an AJAX action that only returns data and doesn't alter data on the server side? I understand they are important if you are saving data or changing something on ...
1
vote
1answer
252 views

Custom post type: check permissions and validate nonce

I have a custom post type with the following capabilities: $capabilities = array( 'read_post' => 'administrator', 'read_private_posts' => 'administrator', 'publish_posts' => ...
1
vote
0answers
26 views

Voting comparison plugin gets stuck in a loop, stops generating new votes

Edit: cut down the text drastically, sorry about that! For some users, at some point it will suddenly stop loading new votes for them, either looping the same one over and over or the same set of ...
1
vote
0answers
67 views

Bypass nonce value while trashing a post

I want to move a post in trash but the condition is that simultaneously I need to delete some more posts. Sample Code: jQuery(function($) { $('#delete-action a').unbind(); $('#delete-action ...
1
vote
1answer
74 views

wp_verify_nonce doesn't return true on server when it matches the nonce

$.ajax({ type: "POST", dataType: "text", url: ajaxurl, data: { action: "more_news", nonce: nonce, offset: offset }, success : function(data, ...
1
vote
0answers
358 views

Security - Ajax and Nonce use [closed]

I'm developing a site which posts a number of ajax calls from jquery to PHP and returns data from PhP to jquery. Everything is working, but i'd to know if my approach to handling the calls is ok, in ...
1
vote
0answers
93 views

My custom write panels won't save data. What am I missing?

So far I've been reading some tutorials about ways to create Custom Write Panels. It seems that none of them will really work without some bug. I'd like to discuss one of those tuts here: ...
0
votes
1answer
194 views

Form Security: nonce vs. jQuery

I am trying to create a methodology for submitting forms on my WordPress site. In the past, I have used WordPress nonces in order to secure form submission, but I like the idea of using jQuery to ...
0
votes
1answer
54 views

Verify Nonce returns false - Request Nonce returns correct value

I'm trying to verify that the nonce I created exists but for some reason it keeps returning false, why is this happening? Creating my nonce: <?php ...
0
votes
2answers
476 views

wp_verify_nonce keeps failing

I needed to assign categories to post from frontend so I am making use of the solution suggested in this thread , in form of a plugin. It is working as expected. I just wanted to add a nonce field in ...
0
votes
2answers
1k views

Ajax function returns -1

I have a question. I made a simply ajax function. When I'm logged in, it works perfectly. When I'm logged out, it returns me -1 (since Wordpress 3.1) Why ? I don't understand. Precisely, it returns ...
0
votes
1answer
43 views

Why do Metabox use Nonces?

Why is it advised for admin panel metaboxes to use nonces? Every example I see of creation and saving metabox data there are nonces involved but aren't nonces a bit unnecessary in this case?
0
votes
1answer
569 views

Help with forms and nonces

I am trying to create a nonce to use with a (public-facing) form. Below is my code: function my_form() { if (isset($_POST['submit'])) { $name = $_POST['name']; $description = ...
0
votes
1answer
27 views

Nonce keeps failing

I have a plugin that works for 99% of the users, but one user is having problems. The plugin opens a thickbox modal window and pushes content via the load-edit.php hook. The links are displayed in a ...
0
votes
1answer
85 views

Do I require the use of nonce?

Im creating a visit/page views counter with ajax,jquery and php, I have been reading a few articles that recommend the use of nonces for data manipulation through ajax, however i am not sure if i need ...
0
votes
1answer
54 views

Nonce failing with second argument

The plugin Plugin Maker pastebin is not working and I've narrowed it down to its nonce-mechanism failing. At one point it checks for check_admin_referer('$pluginmaker_nonce', $pluginmaker_nonce); ...
0
votes
1answer
334 views

Saving custom data via ajax with nonces

I'm trying to securely save custom data to database from plugin backend via ajax. JavaScript code that runs after clicking save button: $.ajax({ url: ajaxVars.ajaxurl, type: 'post', ...
0
votes
1answer
648 views

The Correct Way to Use Nonce Field without Settings API

I'm trying to create an admin option page without the Settings API for some reasons. Then if I do so, I've heard that I need to use nonces for security. I'd like to know the correct way to use them. ...
0
votes
1answer
1k views

Forms and WordPress Nonce

WordPress nonce is driving me nuts! I had this problem when I started my plugin and removed it but now I have come back to it and still don't know what to do. I have looked all over for a solution. ...
0
votes
1answer
423 views

Public posts - preventing duplicate form submissions

I'm creating a public form on a page that allows non-registered (public) visitors to create posts of a custom post type. I'm using nonces, which I naiveley thought would expire once they were used. ...
0
votes
0answers
74 views

Create nonce in frontend page to edit profile

I am trying to create a frontend edit profile form that mimics the wp-admin backend edit profile. I created the form as HTML directly in a WordPress page (I'm a PHP/WordPress beginner, so I don't know ...
0
votes
0answers
13 views

WP Nonce with Ajax- is it always neccessary? [duplicate]

I read, well, everywhere, that it is necessary to use the built in WP_Nonce feature when submitting AJAX requests. as such: wp_enqueue_script('my-ajax-request', plugin_dir_url(__FILE__) . ...
0
votes
1answer
21 views

Is it necessary to use a WordPress nonce when allowing users to download public data?

I am using jQuery .load() to load the next page of WordPress posts after a button is clicked. The next page of posts is public data (no access restrictions on it whatsoever). Should I use a WordPress ...
0
votes
0answers
61 views

Nonces and Cache

It's clear that form submissions and AJAX requests, especially sensible ones, need "nonces" to avoid certain exploits. However, with heavy use of caching systems it becomes harder to generate them ...
0
votes
1answer
410 views

How to get the wpnonce value?

On using inspect element to check the 'href' attribute of 'Deactivate' links for the plugins listed on plugins.php page, I found that the url contains a wpnonce field with a certain value. I need to ...
0
votes
0answers
61 views

when saveing $meta_box i get Undefined index error

I need help to fix these Notices: PHP Notice: Undefined index: person-name in testimonials.php on line 112 PHP Notice: Undefined index: position in testimonials.php on line 112 PHP Notice: Undefined ...