Hot answers tagged

14

I thought that check_admin_referer checked the nonce (it does call wp_verify_nonce, and the referring url. After digging into the core code I realised that it did not do this. Thinking it was a bug I reported it, and Ryan Boren replied with the following: Actually, if the nonce is valid the referrer should not be checked. The unreliability of referrers ...


11

Nonces are unique to each logged-in user. You can't scrape a logged-in user's nonces unless you have their cookies. But if you have a user's cookies, you've already stolen their identity and can do whatever you want. Nonces are meant to protect against users being tricked into doing something they didn't mean to do, by clicking a link or submitting a form. ...


11

I would recommend so. You do (and should) have your own nonce with which to check the origin of the data and the intent of the user. If you have just one nonce for a metabox - then you run into problems if that metabox is removed (not the same as hidden). If removed the second metabox will (or at least should) never save since the nonce is longer sent. Of ...


10

In WordPress, nonces are specific to the user, the action being performed, and the time. With regards to time, a nonce is valid for 24 hours, and changes every 12 hours. This is considered an acceptable trade-off, since using a real number-used-once would involve adding a tracking system and having storage of the used nonces. Nonces are also hashed, and so ...


8

TL;DR In short, wp_verify_nonce() uses that value because it expects that value as its first argument. wp_verify_nonce() arguments wp_verify_nonce() receives 2 arguments: $nonce $action The value in the hidden field ('cabfd9e42d' in your example) represent the $nonce. 1st argument is the nonce, and comes from the request In fact, wp_verify_nonce() ...


7

Yes, nonces are highly confusing. :) While the concept of nonce implies that it is only used once, WordPress does not enforce that and technically you can use nonce multiple times. However since nonce is used to verify intent (as in did you really mean to perform specific action) - different actions should have different nonces generated and checked.


6

It's inlineeditnonce. Check line 1185 of admin-ajax.php for details.


6

More context would be helpful. Is that all the code found in your plugin or functions file directly? Or are you hooking in to something via add_action. Anyway, what's probably wrong is that you're calling wp_localize_script and wp_enqueue_script outside of an action. wp_create_nonce, or, rather, the file in which it resides, has yet to be loaded. The ...


6

jQuery is a js library not a transport protocol, your data is sent via GET or POST, wether you use jquery or not. Think of it like this, sometimes it's the user in the first frame, sometimes it's javascript: Firstly nonces are not the same as sanitisation, they have different purposes Sanitisation is about verifying what the source says is in the ...


6

Short answer: No. You can use normal strings for actions, md5'ing them doesn't change anything. The nonce is built from three main pieces of information: Time: The current time() divided by 43200 is worked into the nonce. This is what lets the nonce be changed every 12 hours (43200 seconds in 12 hours). The action string you provide. More on this below. ...


5

If you're going to add the nonce field to an HTML string, you have to specify that you don't want it echoed. That's the fourth parameter; see https://core.trac.wordpress.org/browser/tags/3.3.1/wp-includes/functions.php#L1952 $formDisplay .= wp_nonce_field( 'contact-form', '_wpnonce', true, false );


5

1, the nonce lifetime is about 24 hours by default actually. take a look at wp_verify_nonce function. To be more accurate, the lifetime is controlled by filter apply_filters( 'nonce_life', DAY_IN_SECONDS ); 2, if the lifetime value makes you doubt if it is "an implementation side-effect", you may want to add_filter('nonce_life',create_function('$v', ...


5

You need to pass the action to check your nonce against, wp_verify_nonce has two parameters. if($_POST && wp_verify_nonce($_REQUEST['test_slider_options_nonce'],'test_slider_action')) echo "TEST";


5

You might be a little confused as to the purpose and function of nonces in WordPress. Recommended reading: WordPress Nonces An Introduction to WordPress Nonces with Examples Protect_Queries_Against_SQL_Injection_Attacks A nonce is a "number used once" to help protect URLs and forms from certain types of misuse, malicious or otherwise. Nonces help ...


4

Just use get_delete_post_link( $post_ID ) - it'll return the absolute URL with nonce and all! Just to be clear, this will get the link to trash posts (if trash supported). If you want to skip trash & get the perma-delete link, pass a second argument of true*. http://codex.wordpress.org/Function_Reference/get_delete_post_link Update: Having checked the ...


4

These are your problem lines: if ( $_POST && !wp_verify_nonce($_POST['at_nonce'], __FILE__) ) { return; } You check to see that $_POST is set, but you don't check $_POST['at_nonce']. If $_POST is set but that key is not then you will get a Notice. It is a simple fix: if ( isset($_POST['at_nonce']) && ...


4

No, not really. You're assuming the function that called wp_insert_post() has already performed those checks. But wp_insert_post() may be used in other pages too, not just the edit page, by plugins, or even themes (many of them with security holes). That's why you should ensure that your code runs only where you want to by using the nonce. Ok I'm editing ...


4

You are not inserting the nonce field in your form, so your script won't recieve the nonce field and this code: if ( !isset($_POST['nonce_name'])) Will be validated becasue $_POST['nonce_name'] is not set. In your code, remove this line: <input type='hidden' value='".wp_nonce_field('nonce_action','nonce_name')."'/> And, where it said //TODO: ...


4

It should be action instead of "doaction", then it will work just fine. As for your request for some documentation, as far as I know there is no overview about parameters/actions available at edit.php. So lets do some source code inspection, as you said yourself, you have gotten the inpiration for your approach from the edit.php, so we start there. You have ...


3

Here's a very lengthy answer of my own question that goes beyond just addressing the question of generating unique nonces for subsequent Ajax requests. This is an "add to favorites" feature that was made generic for the purposes of the answer (my feature lets users add the post IDs of photo attachments to a list of favorites, but this could apply to a ...


3

The WordPress nonce creation function is to be called only on the init hook: Use the init or any subsequent action to call this function. Calling it outside of an action can lead to troubles. See #14024 for details. Since the init hook "runs after WordPress has finished loading but before any headers are sent", nonces are created on every full-page ...


3

The problem was that I had this code in one of my theme admin pages: if (isset($_GET['download'])) check_admin_referer('mytheme_options_storage'); which got triggered by the export request since that also sets $_GET['download'] var. The solution I came up with was to make sure my check only ran when the relevant page was requested, and also I ...


3

WordPress nonces are not your usually ('use only once') nonce. For a given $action, a new nonce is generated at every 12 hours and a nonces are valid for 24 hours, so at any given point there are two nonces valid for a given $action. The nonce is (a substring of) a hash of $action - the action $uid - the user ID $i - incrementor. The increments ...


3

Nonces are one time use limited life unique numbers. You can clone them but the problem you'll see is that once sent back to the server and validated, the other clones will become invalid. You have a few ways to handle this. Generate all your boxes on the server and discard the Javascript. Use Ajax to request a new nonce for each cloned box. My preferred ...


3

As of 4.1.1, the nonce is defined in wp-includes/media.php, line 2883: $settings['post'] = array( 'id' => $post->ID, 'nonce' => wp_create_nonce( 'update-post_' . $post->ID ), ); So to verify the nonce: wp_verify_nonce( $nonce, "update-post_$post_ID" );


2

The basic idea for debug here is that theme apparently influences something it totally should not. Either something is done in a wrong way or in a wrong place. Check that theme is not running any functionality directly in functions.php. Check that all of theme's functionality runs on appropriate hooks. For hooks that are used both on front-end and back-end ...


2

That is basically the way WordPress does it and pretty much the only way to do it, simply have your receiving PHP function create a new nonce add send it back with your response, then just update the value on your JS before the next round.


2

You need to pass the value of the nonce field as first argument to wp_verify_nonce. So, you need to modify the nonce verification part in your code. Also you were using form fields names that conflicts with internal wordpress query vars, you should prefix them with something unique so they do not conflict with wordpress. See following example: function ...


2

You could also hook the submit box that never dissapears adding the nonce field to it add_action( 'post_submitbox_start', 'theme_submitdiv_extra' ); function theme_submitdiv_extra() { wp_nonce_field( 'theme_meta_box_nonce', 'meta_box_nonce' ); } Then, in your save_post action: if( !isset( $_POST['meta_box_nonce'] ) || !wp_verify_nonce( ...


2

Rarst said it worked for him both logged in and logged out, i can also confirm the same, here's my ugly test code that works, very much just a hacked together version of your code(for testing). function say_coucou(){ check_ajax_referer( 'hello', 'nonce' ); echo "Hello"; die; } add_action('wp_ajax_hello_hello', 'say_coucou'); ...



Only top voted, non community-wiki answers of a minimum length are eligible