0
votes
0answers
14 views

Alternative ways to make ajax requests in wordpress [duplicate]

I'm currently having a problem with working with AJAX. Well not really a problem since I can pretty much do what I want to do. The only problem is my boss saying that the admin-ajax.php file is an ...
2
votes
1answer
166 views

Confusion on WP Nonce usage in my Plugin

I created a small plugin where users can set multiple featured image by clicking Add New link from the meta box and remove them as well. The user can use Set featured image link to select featured ...
3
votes
1answer
119 views

WordPress Capabilities: edit_user vs edit_users

The official documentation only mentions edit_users, but in the source I found many places are using edit_user, what is the difference? Are there any conventions for singular and plural capabilities? ...
1
vote
2answers
37 views

Secure Pages Best Practice

I am in process of writing a plugin that has front-end shortcodes that display a user's information/data. If the user is not logged in, I need to redirect to a front-end login page/form. What would ...
0
votes
2answers
173 views

WP Cron doesn't save <iframe> or <object> in post body

I am using wp_cron to auto grab posts from a remote website and save them in my wp db. NOTICE! I am executing my code from my plugin, not from my template functions.php or somewhere else. I have my ...
0
votes
1answer
116 views

Data Validation, dynamically generated fields (select for example)

Working to secure my plugin, I'm not sure what (if anything) to do about output such as dynamically generated select fields. For example, I have a country code select generated on the backend via PHP ...
2
votes
1answer
183 views

Nonces can be reused multiple times? Bug / Security issue?

I've read that nonces are meant to be for one time use only, and after an ajax request, you should issue a new nonce so with the next ajax request, a new nonce would be sent to the server. However, I ...
1
vote
3answers
768 views

How to properly validate data from $_GET or $_REQUEST using WordPress functions?

I am working on a plugin that requires on-the-fly manipulation of content output. This is solely dependent on the current $_GET variable or $_REQUEST variable. Depending on what the variable is set ...
14
votes
2answers
447 views

In Which Contexts are Plugins Responsible for Data Validation/Sanitization?

I want to make sure all of the data in my plugins/themes is handled securely before entering the database and before being output to the browser. My problem is that there are situations where the API ...
1
vote
2answers
467 views

wp_nonce_field displaying twice

I have wp_nonce_field in my code but it's creating two instances to the html code for some reason, one where I'd expect it and another at the start of the entry. Is this correct or am I doing ...
3
votes
1answer
746 views

What is the difference between strip_tags and wp_filter_nohtml_kses?

What is the difference between strip_tags and wp_filter_nohtml_kses. I tried to figure wp_filter_nohtml_kses from the source but it looks like it does something a bit more complex than strip all html ...
6
votes
1answer
578 views

What is the difference between esc_html and wp_filter_nohtml_kses?

What is the exact difference between esc_html and wp_filter_nohtml_kses. Everywhere I look says that both strip all the html, the only difference I can see is to do with exactly how they do this. Does ...
0
votes
2answers
166 views

How to prevent plugins from sniffing/stealing other plugins' options?

Many plugins require configuration with sensitive data such as API keys, passwords, etc. When implementing these plugins, this sensitive data is stored using functions such as update_option() and ...
2
votes
1answer
71 views

Where should my plugin POST to?

I'm creating a simple plugin to set a page as a homepage from the list pages (to appear next to edit, preview, trash actions etc), I was just wondering what that the most appropriate/secure place to ...
5
votes
2answers
2k views

How to store username and password to API in wordpress option DB?

I'm currently developing a plugin and the chances are that I will more than likely release it on the public plugin repository so others can use it. The plugin will be using an API and to use this API ...
0
votes
1answer
134 views

Using password protection to load different page elements?

I have a page that is password protected, and I wish to removed some parts of the theme, and add others. Can I do that? Is there a check I can do in the theme files to see if a user has entered the ...
13
votes
3answers
369 views

What are the common security flaws I need to look for? [closed]

As a wannabe WP plugin developper, what are the main security flaws/holes I should look for? I'm about to create a new plugin with a configuration panel (ie input fields and stuff). What should I be ...
1
vote
1answer
485 views

Is disabling test_form in wp_handle_upload a security concern?

I'm writing a plugin that modifies the default behavior when uploading a file for a post or to the media library. I'm setting $overrides in wp_handle_upload() with a custom $unique_filename_callback. ...
1
vote
3answers
1k views

Why do I need to check if wp_nonce_field() exists before using it

i dont really understand why the check if the nonce function exists before running it ... if ( function_exists('wp_nonce_field') ) wp_nonce_field('gmp_nonce_check'); i understand its for ...