Tag Info

Hot answers tagged

10

Nonces are unique to each logged-in user. You can't scrape a logged-in user's nonces unless you have their cookies. But if you have a user's cookies, you've already stolen their identity and can do whatever you want. Nonces are meant to protect against users being tricked into doing something they didn't mean to do, by clicking a link or submitting a form. ...


8

I thought that check_admin_referer checked the nonce (it does call wp_verify_nonce, and the referring url. After digging into the core code I realised that it did not do this. Thinking it was a bug I reported it, and Ryan Boren replied with the following: Actually, if the nonce is valid the referrer should not be checked. The unreliability of referrers ...


8

In WordPress, nonces are specific to the user, the action being performed, and the time. With regards to time, a nonce is valid for 24 hours, and changes every 12 hours. This is considered an acceptable trade-off, since using a real number-used-once would involve adding a tracking system and having storage of the used nonces. Nonces are also hashed, and so ...


6

jQuery is a js library not a transport protocol, your data is sent via GET or POST, wether you use jquery or not. Think of it like this, sometimes it's the user in the first frame, sometimes it's javascript: Firstly nonces are not the same as sanitisation, they have different purposes Sanitisation is about verifying what the source says is in the ...


5

I would recommend so. You do (and should) have your own nonce with which to check the origin of the data and the intent of the user. If you have just one nonce for a metabox - then you run into problems if that metabox is removed (not the same as hidden). If removed the second metabox will (or at least should) never save since the nonce is longer sent. Of ...


5

You need to pass the action to check your nonce against, wp_verify_nonce has two parameters. if($_POST && wp_verify_nonce($_REQUEST['test_slider_options_nonce'],'test_slider_action')) echo "TEST";


5

If you're going to add the nonce field to an HTML string, you have to specify that you don't want it echoed. That's the fourth parameter; see https://core.trac.wordpress.org/browser/tags/3.3.1/wp-includes/functions.php#L1952 $formDisplay .= wp_nonce_field( 'contact-form', '_wpnonce', true, false );


5

Yes, nonces are highly confusing. :) While the concept of nonce implies that it is only used once, WordPress does not enforce that and technically you can use nonce multiple times. However since nonce is used to verify intent (as in did you really mean to perform specific action) - different actions should have different nonces generated and checked.


4

More context would be helpful. Is that all the code found in your plugin or functions file directly? Or are you hooking in to something via add_action. Anyway, what's probably wrong is that you're calling wp_localize_script and wp_enqueue_script outside of an action. wp_create_nonce, or, rather, the file in which it resides, has yet to be loaded. The ...


4

1, the nonce lifetime is about 24 hours by default actually. take a look at wp_verify_nonce function. To be more accurate, the lifetime is controlled by filter apply_filters( 'nonce_life', DAY_IN_SECONDS ); 2, if the lifetime value makes you doubt if it is "an implementation side-effect", you may want to add_filter('nonce_life',create_function('$v', ...


4

No, not really. You're assuming the function that called wp_insert_post() has already performed those checks. But wp_insert_post() may be used in other pages too, not just the edit page, by plugins, or even themes (many of them with security holes). That's why you should ensure that your code runs only where you want to by using the nonce. Ok I'm editing ...


4

You are not inserting the nonce field in your form, so your script won't recieve the nonce field and this code: if ( !isset($_POST['nonce_name'])) Will be validated becasue $_POST['nonce_name'] is not set. In your code, remove this line: <input type='hidden' value='".wp_nonce_field('nonce_action','nonce_name')."'/> And, where it said //TODO: ...


3

Nonces are one time use limited life unique numbers. You can clone them but the problem you'll see is that once sent back to the server and validated, the other clones will become invalid. You have a few ways to handle this. Generate all your boxes on the server and discard the Javascript. Use Ajax to request a new nonce for each cloned box. My preferred ...


3

Just use get_delete_post_link( $post_ID ) - it'll return the absolute URL with nonce and all! Just to be clear, this will get the link to trash posts (if trash supported). If you want to skip trash & get the perma-delete link, pass a second argument of true*. http://codex.wordpress.org/Function_Reference/get_delete_post_link Update: Having checked the ...


2

The WordPress nonce creation function is to be called only on the init hook: Use the init or any subsequent action to call this function. Calling it outside of an action can lead to troubles. See #14024 for details. Since the init hook "runs after WordPress has finished loading but before any headers are sent", nonces are created on every full-page ...


2

You need to pass the value of the nonce field as first argument to wp_verify_nonce. So, you need to modify the nonce verification part in your code. Also you were using form fields names that conflicts with internal wordpress query vars, you should prefix them with something unique so they do not conflict with wordpress. See following example: function ...


2

The basic idea for debug here is that theme apparently influences something it totally should not. Either something is done in a wrong way or in a wrong place. Check that theme is not running any functionality directly in functions.php. Check that all of theme's functionality runs on appropriate hooks. For hooks that are used both on front-end and back-end ...


2

Rarst said it worked for him both logged in and logged out, i can also confirm the same, here's my ugly test code that works, very much just a hacked together version of your code(for testing). function say_coucou(){ check_ajax_referer( 'hello', 'nonce' ); echo "Hello"; die; } add_action('wp_ajax_hello_hello', 'say_coucou'); ...


2

Nonces are not tied to the admin interface. This codex page explains them very well. Essentially, you add : <?php wp_nonce_field('name_of_my_action', 'name_of_nonce_field'); ?> in your form (this creates a hidden input field containing an one-time-use token). And where you're doing the form processing you just check if the nonce is correct ...


2

WordPress nonces are meant to prevent unauthorized execution of code. In the case of meta boxes, they are protecting you against malicious users potentially adding unauthorized meta-information to your posts and pages by forging POST requests. Why wouldn't you want to use nonces?


2

Here's a very lengthy answer of my own question that goes beyond just addressing the question of generating unique nonces for subsequent Ajax requests. This is an "add to favorites" feature that was made generic for the purposes of the answer (my feature lets users add the post IDs of photo attachments to a list of favorites, but this could apply to a ...


2

These are your problem lines: if ( $_POST && !wp_verify_nonce($_POST['at_nonce'], __FILE__) ) { return; } You check to see that $_POST is set, but you don't check $_POST['at_nonce']. If $_POST is set but that key is not then you will get a Notice. It is a simple fix: if ( isset($_POST['at_nonce']) && ...


2

You can use one save function. wp_nonce_field function creates hidden field with action. You can use wp_nonce_field for two metaboxes if you want different actions for two metaboxes. Please go throgh below link for more information http://codex.wordpress.org/Function_Reference/wp_nonce_field


1

WordPress nonces are not your usually ('use only once') nonce. For a given $action, a new nonce is generated at every 12 hours and a nonces are valid for 24 hours, so at any given point there are two nonces valid for a given $action. The nonce is (a substring of) a hash of $action - the action $uid - the user ID $i - incrementor. The increments ...


1

PHP variables inside single quotes -- ' -- won't be expanded. So in your first code snippet, unless you literally mean to pass the string $pluginmaker_nonce to the check_admin_referer() function as the action, you should probably rewrite your code as check_admin_referer( 'action_name', $pluginmaker_nonce );.


1

I really have to question the reasoning behind getting a new nonce for each ajax request. The original nonce will expire, but it can be used more than once until it does. Having the javascript receive it through ajax defeats the purpose, especially providing it on an error case. (The purpose of nonces being a little security for associating an action with a ...


1

You could also hook the submit box that never dissapears adding the nonce field to it add_action( 'post_submitbox_start', 'theme_submitdiv_extra' ); function theme_submitdiv_extra() { wp_nonce_field( 'theme_meta_box_nonce', 'meta_box_nonce' ); } Then, in your save_post action: if( !isset( $_POST['meta_box_nonce'] ) || !wp_verify_nonce( ...


1

When using save_post you are usually add/updating user-inputted data from a metabox into the database. When do this you should check that your metabox's nonce is valid. You should also check permissions as save_post is triggered inside wp_insert_post(), and not just when the you create/edit a post admin side.


1

I think required would mean that "it doesn't work without it". It will work, but the question is of security and best practices. Even if it doesn't seem necessary, it's better to play in the safe side and do it always. You have to enqueue your JavaScript like bellow, passing PHP values (like the admin Ajax URL and the nonce) with wp_localize_script. ...


1

Why are you using the edit.php page for this export link? The edit.php code appears to be checking on the "bulk-posts" nonce, which is probably where your failure is, since you're not using that nonce. You should probably be using post.php instead, or a more general hook with your action.



Only top voted, non community-wiki answers of a minimum length are eligible