Logout using link (without nonce)

Question

This question comes from an absolute non-coder - and has been asked in various forms several times befor (e.g. here).

To logout properly the URL that triggers it needs a nonce as e.g.:

http://xyz/wp-login.php?action=logout&redirect_to=http%3A%2F%2Fwww.spiegel.de&_wpnonce=d9d1a28ef2

We can get the nonce as described in the codex. BUT: what if I have to trigger a logout is by using a URL. More precisely: my CiviCRM plugin has forms that people can fill out and once completed let the user redirect somewhere else -> e.g. log out and go to another page. I can copy/paste the redirct URL in a form such as

http://xyz/wp-login.php?action=logout&redirect_to=http%3A%2F%2Fwww.spiegel.de

-> how do I get the nonce where it is supposed to go - or are there alternatives???

Cheers!

Answer 1

This will disable nonce checking for logging out - on your head be it:

add_action( 'login_form_logout', function () {
    $user = wp_get_current_user();

    wp_logout();

    if ( ! empty( $_REQUEST['redirect_to'] ) ) {
        $redirect_to = $requested_redirect_to = $_REQUEST['redirect_to'];
    } else {
        $redirect_to = 'wp-login.php?loggedout=true';
        $requested_redirect_to = '';
    }

    /**
     * Filters the log out redirect URL.
     *
     * @since 4.2.0
     *
     * @param string  $redirect_to           The redirect destination URL.
     * @param string  $requested_redirect_to The requested redirect destination URL passed as a parameter.
     * @param WP_User $user                  The WP_User object for the user that's logging out.
     */
    $redirect_to = apply_filters( 'logout_redirect', $redirect_to, $requested_redirect_to, $user );
    wp_safe_redirect( $redirect_to );
    exit;
});