Tag Info

Hot answers tagged

10

Nonces are unique to each logged-in user. You can't scrape a logged-in user's nonces unless you have their cookies. But if you have a user's cookies, you've already stolen their identity and can do whatever you want. Nonces are meant to protect against users being tricked into doing something they didn't mean to do, by clicking a link or submitting a form. ...


9

I thought that check_admin_referer checked the nonce (it does call wp_verify_nonce, and the referring url. After digging into the core code I realised that it did not do this. Thinking it was a bug I reported it, and Ryan Boren replied with the following: Actually, if the nonce is valid the referrer should not be checked. The unreliability of referrers ...


8

In WordPress, nonces are specific to the user, the action being performed, and the time. With regards to time, a nonce is valid for 24 hours, and changes every 12 hours. This is considered an acceptable trade-off, since using a real number-used-once would involve adding a tracking system and having storage of the used nonces. Nonces are also hashed, and so ...


6

jQuery is a js library not a transport protocol, your data is sent via GET or POST, wether you use jquery or not. Think of it like this, sometimes it's the user in the first frame, sometimes it's javascript: Firstly nonces are not the same as sanitisation, they have different purposes Sanitisation is about verifying what the source says is in the ...


6

I would recommend so. You do (and should) have your own nonce with which to check the origin of the data and the intent of the user. If you have just one nonce for a metabox - then you run into problems if that metabox is removed (not the same as hidden). If removed the second metabox will (or at least should) never save since the nonce is longer sent. Of ...


5

You need to pass the action to check your nonce against, wp_verify_nonce has two parameters. if($_POST && wp_verify_nonce($_REQUEST['test_slider_options_nonce'],'test_slider_action')) echo "TEST";


5

Yes, nonces are highly confusing. :) While the concept of nonce implies that it is only used once, WordPress does not enforce that and technically you can use nonce multiple times. However since nonce is used to verify intent (as in did you really mean to perform specific action) - different actions should have different nonces generated and checked.


5

If you're going to add the nonce field to an HTML string, you have to specify that you don't want it echoed. That's the fourth parameter; see https://core.trac.wordpress.org/browser/tags/3.3.1/wp-includes/functions.php#L1952 $formDisplay .= wp_nonce_field( 'contact-form', '_wpnonce', true, false );


4

More context would be helpful. Is that all the code found in your plugin or functions file directly? Or are you hooking in to something via add_action. Anyway, what's probably wrong is that you're calling wp_localize_script and wp_enqueue_script outside of an action. wp_create_nonce, or, rather, the file in which it resides, has yet to be loaded. The ...


4

1, the nonce lifetime is about 24 hours by default actually. take a look at wp_verify_nonce function. To be more accurate, the lifetime is controlled by filter apply_filters( 'nonce_life', DAY_IN_SECONDS ); 2, if the lifetime value makes you doubt if it is "an implementation side-effect", you may want to add_filter('nonce_life',create_function('$v', ...


4

It's inlineeditnonce. Check line 1185 of admin-ajax.php for details.


4

No, not really. You're assuming the function that called wp_insert_post() has already performed those checks. But wp_insert_post() may be used in other pages too, not just the edit page, by plugins, or even themes (many of them with security holes). That's why you should ensure that your code runs only where you want to by using the nonce. Ok I'm editing ...


4

You are not inserting the nonce field in your form, so your script won't recieve the nonce field and this code: if ( !isset($_POST['nonce_name'])) Will be validated becasue $_POST['nonce_name'] is not set. In your code, remove this line: <input type='hidden' value='".wp_nonce_field('nonce_action','nonce_name')."'/> And, where it said //TODO: ...


3

Nonces are one time use limited life unique numbers. You can clone them but the problem you'll see is that once sent back to the server and validated, the other clones will become invalid. You have a few ways to handle this. Generate all your boxes on the server and discard the Javascript. Use Ajax to request a new nonce for each cloned box. My preferred ...


3

Short answer: No. You can use normal strings for actions, md5'ing them doesn't change anything. The nonce is built from three main pieces of information: Time: The current time() divided by 43200 is worked into the nonce. This is what lets the nonce be changed every 12 hours (43200 seconds in 12 hours). The action string you provide. More on this below. ...


3

Just use get_delete_post_link( $post_ID ) - it'll return the absolute URL with nonce and all! Just to be clear, this will get the link to trash posts (if trash supported). If you want to skip trash & get the perma-delete link, pass a second argument of true*. http://codex.wordpress.org/Function_Reference/get_delete_post_link Update: Having checked the ...


3

The problem was that I had this code in one of my theme admin pages: if (isset($_GET['download'])) check_admin_referer('mytheme_options_storage'); which got triggered by the export request since that also sets $_GET['download'] var. The solution I came up with was to make sure my check only ran when the relevant page was requested, and also I ...


2

You need to pass the value of the nonce field as first argument to wp_verify_nonce. So, you need to modify the nonce verification part in your code. Also you were using form fields names that conflicts with internal wordpress query vars, you should prefix them with something unique so they do not conflict with wordpress. See following example: function ...


2

You can use one save function. wp_nonce_field function creates hidden field with action. You can use wp_nonce_field for two metaboxes if you want different actions for two metaboxes. Please go throgh below link for more information http://codex.wordpress.org/Function_Reference/wp_nonce_field


2

That is basically the way WordPress does it and pretty much the only way to do it, simply have your receiving PHP function create a new nonce add send it back with your response, then just update the value on your JS before the next round.


2

The basic idea for debug here is that theme apparently influences something it totally should not. Either something is done in a wrong way or in a wrong place. Check that theme is not running any functionality directly in functions.php. Check that all of theme's functionality runs on appropriate hooks. For hooks that are used both on front-end and back-end ...


2

Rarst said it worked for him both logged in and logged out, i can also confirm the same, here's my ugly test code that works, very much just a hacked together version of your code(for testing). function say_coucou(){ check_ajax_referer( 'hello', 'nonce' ); echo "Hello"; die; } add_action('wp_ajax_hello_hello', 'say_coucou'); ...


2

The WordPress nonce creation function is to be called only on the init hook: Use the init or any subsequent action to call this function. Calling it outside of an action can lead to troubles. See #14024 for details. Since the init hook "runs after WordPress has finished loading but before any headers are sent", nonces are created on every full-page ...


2

The logic here is incorrect: // Verify this came from the our screen and with proper authorization, because save_post can be triggered at other times if ( !isset( $_POST['mrlpt_client_check'] ) && !wp_verify_nonce( $_POST['mrlpt_client_check'], 'mrlpt_submit_client' ) ) { return; } This reads if the $_POST['mrlpt_client_check'] is not set ...


2

Nonces are not tied to the admin interface. This codex page explains them very well. Essentially, you add : <?php wp_nonce_field('name_of_my_action', 'name_of_nonce_field'); ?> in your form (this creates a hidden input field containing an one-time-use token). And where you're doing the form processing you just check if the nonce is correct ...


2

Here's a very lengthy answer of my own question that goes beyond just addressing the question of generating unique nonces for subsequent Ajax requests. This is an "add to favorites" feature that was made generic for the purposes of the answer (my feature lets users add the post IDs of photo attachments to a list of favorites, but this could apply to a ...


2

These are your problem lines: if ( $_POST && !wp_verify_nonce($_POST['at_nonce'], __FILE__) ) { return; } You check to see that $_POST is set, but you don't check $_POST['at_nonce']. If $_POST is set but that key is not then you will get a Notice. It is a simple fix: if ( isset($_POST['at_nonce']) && ...


2

I don't know I just submitted the ticket on track. I was using get_current_user_id() and it modifies the wp_create_nonce behavior. Sinces wp_create_nonce uses wp_get_current_user() I think there is the problem.


2

The save_post hook is called every time someone calls the function wp_insert_post(). Plugins do that, unfortunately some themes too, and WordPress itself on several places when … someone uses post per email or XML RPC an auto-draft is created the Quick Draft feature on the dashboard is used a navigation menu item is added a revision is created You really ...


2

WordPress nonces are meant to prevent unauthorized execution of code. In the case of meta boxes, they are protecting you against malicious users potentially adding unauthorized meta-information to your posts and pages by forging POST requests. Why wouldn't you want to use nonces?



Only top voted, non community-wiki answers of a minimum length are eligible