Hot answers tagged nonce
9
Nonces are unique to each logged-in user. You can't scrape a logged-in user's nonces unless you have their cookies. But if you have a user's cookies, you've already stolen their identity and can do whatever you want.
Nonces are meant to protect against users being tricked into doing something they didn't mean to do, by clicking a link or submitting a form. ...
8
In WordPress, nonces are specific to the user, the action being performed, and the time. With regards to time, a nonce is valid for 24 hours, and changes every 12 hours. This is considered an acceptable trade-off, since using a real number-used-once would involve adding a tracking system and having storage of the used nonces.
Nonces are also hashed, and so ...
6
I thought that check_admin_referer checked the nonce (it does call wp_verify_nonce, and the referring url. After digging into the core code I realised that it did not do this. Thinking it was a bug I reported it, and Ryan Boren replied with the following:
Actually, if the nonce is valid the referrer should not be checked.
The unreliability of referrers ...
5
Yes, nonces are highly confusing. :)
While the concept of nonce implies that it is only used once, WordPress does not enforce that and technically you can use nonce multiple times.
However since nonce is used to verify intent (as in did you really mean to perform specific action) - different actions should have different nonces generated and checked.
4
1, the nonce lifetime is about 24 hours by default actually. take a look at wp_verify_nonce function.
To be more accurate, the lifetime is controlled by filter
apply_filters( 'nonce_life', DAY_IN_SECONDS );
2, if the lifetime value makes you doubt if it is "an implementation side-effect", you may want to add_filter('nonce_life',create_function('$v', ...
3
I would recommend so.
You do (and should) have your own nonce with which to check the origin of the data and the intent of the user. If you have just one nonce for a metabox - then you run into problems if that metabox is removed (not the same as hidden). If removed the second metabox will (or at least should) never save since the nonce is longer sent.
Of ...
3
If you're going to add the nonce field to an HTML string, you have to specify that you don't want it echoed. That's the fourth parameter; see https://core.trac.wordpress.org/browser/tags/3.3.1/wp-includes/functions.php#L1952
$formDisplay .= wp_nonce_field( 'contact-form', '_wpnonce', true, false );
3
More context would be helpful. Is that all the code found in your plugin or functions file directly? Or are you hooking in to something via add_action.
Anyway, what's probably wrong is that you're calling wp_localize_script and wp_enqueue_script outside of an action. wp_create_nonce, or, rather, the file in which it resides, has yet to be loaded.
The ...
2
Rarst said it worked for him both logged in and logged out, i can also confirm the same, here's my ugly test code that works, very much just a hacked together version of your code(for testing).
function say_coucou(){
check_ajax_referer( 'hello', 'nonce' );
echo "Hello";
die;
}
add_action('wp_ajax_hello_hello', 'say_coucou');
...
2
The basic idea for debug here is that theme apparently influences something it totally should not. Either something is done in a wrong way or in a wrong place.
Check that theme is not running any functionality directly in functions.php.
Check that all of theme's functionality runs on appropriate hooks.
For hooks that are used both on front-end and back-end ...
2
The WordPress nonce creation function is to be called only on the init hook:
Use the init or any subsequent action to call this function. Calling
it outside of an action can lead to troubles. See #14024 for details.
Since the init hook "runs after WordPress has finished loading but before any headers are sent", nonces are created on every full-page ...
2
Nonces are not tied to the admin interface. This codex page explains them very well. Essentially, you add :
<?php wp_nonce_field('name_of_my_action', 'name_of_nonce_field'); ?>
in your form (this creates a hidden input field containing an one-time-use token). And where you're doing the form processing you just check if the nonce is correct
...
2
Just use get_delete_post_link( $post_ID ) - it'll return the absolute URL with nonce and all!
Just to be clear, this will get the link to trash posts (if trash supported). If you want to skip trash & get the perma-delete link, pass a second argument of true*.
http://codex.wordpress.org/Function_Reference/get_delete_post_link
Update: Having checked the ...
1
You can use one save function.
wp_nonce_field function creates hidden field with action.
You can use wp_nonce_field for two metaboxes if you want different actions for two metaboxes.
Please go throgh below link for more information
http://codex.wordpress.org/Function_Reference/wp_nonce_field
1
These are your problem lines:
if ( $_POST && !wp_verify_nonce($_POST['at_nonce'], __FILE__) ) {
return;
}
You check to see that $_POST is set, but you don't check $_POST['at_nonce']. If $_POST is set but that key is not then you will get a Notice. It is a simple fix:
if ( isset($_POST['at_nonce']) && ...
1
I don't see any is_admin conditional statement which is why you should include it in your snippet so we can properly assess what you are attempting to do outside of the obvious question.
Either way a nonce should be mandatory. That function that receives and processes your AJAX request/response should also verify your nonce to ensure the request is a valid ...
1
This is a very basic nonce setup for a plugin:
Create your nonce input in the form:
wp_nonce_field( basename(__FILE__), $nonce_key );
Then check your nonce once submitted:
if ( empty($_POST[$nonce_key]) || ! wp_verify_nonce( $_POST[$nonce_key], basename(__FILE__) ) ) return;
basename(FILE) just uses the current filename (eg: plugin_options.php) to ...
1
When using save_post you are usually add/updating user-inputted data from a metabox into the database. When do this you should check that your metabox's nonce is valid.
You should also check permissions as save_post is triggered inside wp_insert_post(), and not just when the you create/edit a post admin side.
1
The logic here is incorrect:
// Verify this came from the our screen and with proper authorization, because save_post can be triggered at other times
if ( !isset( $_POST['mrlpt_client_check'] ) && !wp_verify_nonce( $_POST['mrlpt_client_check'], 'mrlpt_submit_client' ) ) {
return;
}
This reads if the $_POST['mrlpt_client_check'] is not set ...
1
http://en.wikipedia.org/wiki/Cryptographic_nonce
"In security engineering, nonce is an arbitrary number used only once to sign a cryptographic communication. ... It is often a random ... authentication protocol to ensure that old communications cannot be reused in replay attacks. "
The idea is to stop the submitting of repeat data. You create a single-use ...
1
You need to pass the value of the nonce field as first argument to wp_verify_nonce. So, you need to modify the nonce verification part in your code.
Also you were using form fields names that conflicts with internal wordpress query vars, you should prefix them with something unique so they do not conflict with wordpress. See following example:
function ...
1
Don't know if it's best practice but i had a similar issue and I ended up checking by custom sql query to check if the title already exists in my post type
and filtered duplicate posts and i hooked that to wp_insert_post_data filter hook.
add_filter('wp_insert_post_data','prevente_duplicates');
function prevente_duplicates($data,$postarr){
$count = ...
Only top voted, non community-wiki answers of a minimum length are eligible
