Hot answers tagged nonce
8
In WordPress, nonces are specific to the user, the action being performed, and the time. With regards to time, a nonce is valid for 24 hours, and changes every 12 hours. This is considered an acceptable trade-off, since using a real number-used-once would involve adding a tracking system and having storage of the used nonces.
Nonces are also hashed, and so ...
4
1, the nonce lifetime is about 24 hours by default actually. take a look at wp_verify_nonce function.
To be more accurate, the lifetime is controlled by filter
apply_filters( 'nonce_life', DAY_IN_SECONDS );
2, if the lifetime value makes you doubt if it is "an implementation side-effect", you may want to add_filter('nonce_life',create_function('$v', ...
2
Just use get_delete_post_link( $post_ID ) - it'll return the absolute URL with nonce and all!
Just to be clear, this will get the link to trash posts (if trash supported). If you want to skip trash & get the perma-delete link, pass a second argument of true*.
http://codex.wordpress.org/Function_Reference/get_delete_post_link
Update: Having checked the ...
1
You can use one save function.
wp_nonce_field function creates hidden field with action.
You can use wp_nonce_field for two metaboxes if you want different actions for two metaboxes.
Please go throgh below link for more information
http://codex.wordpress.org/Function_Reference/wp_nonce_field
1
These are your problem lines:
if ( $_POST && !wp_verify_nonce($_POST['at_nonce'], __FILE__) ) {
return;
}
You check to see that $_POST is set, but you don't check $_POST['at_nonce']. If $_POST is set but that key is not then you will get a Notice. It is a simple fix:
if ( isset($_POST['at_nonce']) && ...
1
I don't see any is_admin conditional statement which is why you should include it in your snippet so we can properly assess what you are attempting to do outside of the obvious question.
Either way a nonce should be mandatory. That function that receives and processes your AJAX request/response should also verify your nonce to ensure the request is a valid ...
1
This is a very basic nonce setup for a plugin:
Create your nonce input in the form:
wp_nonce_field( basename(__FILE__), $nonce_key );
Then check your nonce once submitted:
if ( empty($_POST[$nonce_key]) || ! wp_verify_nonce( $_POST[$nonce_key], basename(__FILE__) ) ) return;
basename(FILE) just uses the current filename (eg: plugin_options.php) to ...
1
When using save_post you are usually add/updating user-inputted data from a metabox into the database. When do this you should check that your metabox's nonce is valid.
You should also check permissions as save_post is triggered inside wp_insert_post(), and not just when the you create/edit a post admin side.
Only top voted, non community-wiki answers of a minimum length are eligible
