Tag Info

Hot answers tagged

12

I thought that check_admin_referer checked the nonce (it does call wp_verify_nonce, and the referring url. After digging into the core code I realised that it did not do this. Thinking it was a bug I reported it, and Ryan Boren replied with the following: Actually, if the nonce is valid the referrer should not be checked. The unreliability of referrers ...


10

Nonces are unique to each logged-in user. You can't scrape a logged-in user's nonces unless you have their cookies. But if you have a user's cookies, you've already stolen their identity and can do whatever you want. Nonces are meant to protect against users being tricked into doing something they didn't mean to do, by clicking a link or submitting a form. ...


10

I would recommend so. You do (and should) have your own nonce with which to check the origin of the data and the intent of the user. If you have just one nonce for a metabox - then you run into problems if that metabox is removed (not the same as hidden). If removed the second metabox will (or at least should) never save since the nonce is longer sent. Of ...


8

In WordPress, nonces are specific to the user, the action being performed, and the time. With regards to time, a nonce is valid for 24 hours, and changes every 12 hours. This is considered an acceptable trade-off, since using a real number-used-once would involve adding a tracking system and having storage of the used nonces. Nonces are also hashed, and so ...


6

jQuery is a js library not a transport protocol, your data is sent via GET or POST, wether you use jquery or not. Think of it like this, sometimes it's the user in the first frame, sometimes it's javascript: Firstly nonces are not the same as sanitisation, they have different purposes Sanitisation is about verifying what the source says is in the ...


6

Yes, nonces are highly confusing. :) While the concept of nonce implies that it is only used once, WordPress does not enforce that and technically you can use nonce multiple times. However since nonce is used to verify intent (as in did you really mean to perform specific action) - different actions should have different nonces generated and checked.


6

TL;DR In short, wp_verify_nonce() uses that value because it expects that value as its first argument. wp_verify_nonce() arguments wp_verify_nonce() receives 2 arguments: $nonce $action The value in the hidden field ('cabfd9e42d' in your example) represent the $nonce. 1st argument is the nonce, and comes from the request In fact, wp_verify_nonce() ...


5

You need to pass the action to check your nonce against, wp_verify_nonce has two parameters. if($_POST && wp_verify_nonce($_REQUEST['test_slider_options_nonce'],'test_slider_action')) echo "TEST";


5

If you're going to add the nonce field to an HTML string, you have to specify that you don't want it echoed. That's the fourth parameter; see https://core.trac.wordpress.org/browser/tags/3.3.1/wp-includes/functions.php#L1952 $formDisplay .= wp_nonce_field( 'contact-form', '_wpnonce', true, false );


5

More context would be helpful. Is that all the code found in your plugin or functions file directly? Or are you hooking in to something via add_action. Anyway, what's probably wrong is that you're calling wp_localize_script and wp_enqueue_script outside of an action. wp_create_nonce, or, rather, the file in which it resides, has yet to be loaded. The ...


5

It's inlineeditnonce. Check line 1185 of admin-ajax.php for details.


4

Just use get_delete_post_link( $post_ID ) - it'll return the absolute URL with nonce and all! Just to be clear, this will get the link to trash posts (if trash supported). If you want to skip trash & get the perma-delete link, pass a second argument of true*. http://codex.wordpress.org/Function_Reference/get_delete_post_link Update: Having checked the ...


4

1, the nonce lifetime is about 24 hours by default actually. take a look at wp_verify_nonce function. To be more accurate, the lifetime is controlled by filter apply_filters( 'nonce_life', DAY_IN_SECONDS ); 2, if the lifetime value makes you doubt if it is "an implementation side-effect", you may want to add_filter('nonce_life',create_function('$v', ...


4

It should be action instead of "doaction", then it will work just fine. As for your request for some documentation, as far as I know there is no overview about parameters/actions available at edit.php. So lets do some source code inspection, as you said yourself, you have gotten the inpiration for your approach from the edit.php, so we start there. You have ...


4

These are your problem lines: if ( $_POST && !wp_verify_nonce($_POST['at_nonce'], __FILE__) ) { return; } You check to see that $_POST is set, but you don't check $_POST['at_nonce']. If $_POST is set but that key is not then you will get a Notice. It is a simple fix: if ( isset($_POST['at_nonce']) && ...


4

No, not really. You're assuming the function that called wp_insert_post() has already performed those checks. But wp_insert_post() may be used in other pages too, not just the edit page, by plugins, or even themes (many of them with security holes). That's why you should ensure that your code runs only where you want to by using the nonce. Ok I'm editing ...


4

You are not inserting the nonce field in your form, so your script won't recieve the nonce field and this code: if ( !isset($_POST['nonce_name'])) Will be validated becasue $_POST['nonce_name'] is not set. In your code, remove this line: <input type='hidden' value='".wp_nonce_field('nonce_action','nonce_name')."'/> And, where it said //TODO: ...


4

Short answer: No. You can use normal strings for actions, md5'ing them doesn't change anything. The nonce is built from three main pieces of information: Time: The current time() divided by 43200 is worked into the nonce. This is what lets the nonce be changed every 12 hours (43200 seconds in 12 hours). The action string you provide. More on this below. ...


3

As of 4.1.1, the nonce is defined in wp-includes/media.php, line 2883: $settings['post'] = array( 'id' => $post->ID, 'nonce' => wp_create_nonce( 'update-post_' . $post->ID ), ); So to verify the nonce: wp_verify_nonce( $nonce, "update-post_$post_ID" );


3

Nonces are one time use limited life unique numbers. You can clone them but the problem you'll see is that once sent back to the server and validated, the other clones will become invalid. You have a few ways to handle this. Generate all your boxes on the server and discard the Javascript. Use Ajax to request a new nonce for each cloned box. My preferred ...


3

The problem was that I had this code in one of my theme admin pages: if (isset($_GET['download'])) check_admin_referer('mytheme_options_storage'); which got triggered by the export request since that also sets $_GET['download'] var. The solution I came up with was to make sure my check only ran when the relevant page was requested, and also I ...


3

The WordPress nonce creation function is to be called only on the init hook: Use the init or any subsequent action to call this function. Calling it outside of an action can lead to troubles. See #14024 for details. Since the init hook "runs after WordPress has finished loading but before any headers are sent", nonces are created on every full-page ...


3

Here's a very lengthy answer of my own question that goes beyond just addressing the question of generating unique nonces for subsequent Ajax requests. This is an "add to favorites" feature that was made generic for the purposes of the answer (my feature lets users add the post IDs of photo attachments to a list of favorites, but this could apply to a ...


2

I don't know I just submitted the ticket on track. I was using get_current_user_id() and it modifies the wp_create_nonce behavior. Sinces wp_create_nonce uses wp_get_current_user() I think there is the problem.


2

The logic here is incorrect: // Verify this came from the our screen and with proper authorization, because save_post can be triggered at other times if ( !isset( $_POST['mrlpt_client_check'] ) && !wp_verify_nonce( $_POST['mrlpt_client_check'], 'mrlpt_submit_client' ) ) { return; } This reads if the $_POST['mrlpt_client_check'] is not set ...


2

Nonces are not tied to the admin interface. This codex page explains them very well. Essentially, you add : <?php wp_nonce_field('name_of_my_action', 'name_of_nonce_field'); ?> in your form (this creates a hidden input field containing an one-time-use token). And where you're doing the form processing you just check if the nonce is correct ...


2

You need to pass the value of the nonce field as first argument to wp_verify_nonce. So, you need to modify the nonce verification part in your code. Also you were using form fields names that conflicts with internal wordpress query vars, you should prefix them with something unique so they do not conflict with wordpress. See following example: function ...


2

You can use one save function. wp_nonce_field function creates hidden field with action. You can use wp_nonce_field for two metaboxes if you want different actions for two metaboxes. Please go throgh below link for more information http://codex.wordpress.org/Function_Reference/wp_nonce_field


2

That is basically the way WordPress does it and pretty much the only way to do it, simply have your receiving PHP function create a new nonce add send it back with your response, then just update the value on your JS before the next round.


2

The basic idea for debug here is that theme apparently influences something it totally should not. Either something is done in a wrong way or in a wrong place. Check that theme is not running any functionality directly in functions.php. Check that all of theme's functionality runs on appropriate hooks. For hooks that are used both on front-end and back-end ...



Only top voted, non community-wiki answers of a minimum length are eligible