Permission error on plugin save

Question

When I pass a quote to the input field and save it I get this error message in wordpress - I'm using the latest installation version.

Error "You do not have sufficient permissions to access this page."

The code I'm getting the error in is for a plugin that I'm developing its my first attempt at something like this.

   <?php

/*idea to develop further would be, add a text box that the user can input the quote in
this then gets added to the DB and passed to the $quotes array. From here the results get
output the same way*/
/*
Plugin Name: Random Quotes
Plugin URI: xxx
Description: This Plugin randomly generates Quotes input by the user.
Version: 0.0.1
Author: xxx
Author URI: xxx
License: GPL2
*/

/*

Function Reference 
is_numeric() - Finds whether a variable is a number or a numeric string
unserialize() - takes a single serialized variable and converts it back into a PHP value.
isset() - tests to see if a variable isset
array_values($array) - Return all the values of an array input



*/

add_action('admin_menu', 'dw_quotes_create_menu');

function dw_quotes_create_menu() {
    //create custom top-level menu
    add_menu_page('Quotes Settings', 'Quotes Styling', 'manage_options', __FILE__, 'dw_styling_quotes_settings');
}

    //generating the random quote
function dw_get_random_quote() {
    $quotes = get_option('dw_quotes', null); 
    $quotes = unserialize($quotes);
    $rand_quotes = array_rand($quotes);
    $result_quote = $quotes[$rand_quotes]; // assigns $result_quote the random quote

    return $result_quote; //output


}
    //styling the admin menu
function dw_styling_quotes_settings() {

    // load quotes
    $quotes = get_option('dw_quotes', null);
    $quotes = unserialize($quotes); // unserialize the data from the $quotes array

    if (is_null($quotes)) {
        $quotes = array();
    }

    if (isset($_GET['delete']) && is_numeric($_GET['delete'])) { // $variable is set and its numeric
        unset($quotes[$_GET['delete']]); // remove that quote from the array
        $quotes = array_values($quotes); // reorder the keys
        update_option('dw_quotes', serialize($quotes)); // store results
        echo '<p style="font-size:110%;color:green;"><strong>Quote Deleted</strong></p>';
    }

    if ($_POST && isset($_POST['random_quote']) && $_POST['random_quote'] !== '') { //???
        array_push($quotes, $_POST['random_quote']);
        update_option('dw_quotes', serialize($quotes));
        echo '<p style="font-size:110%;color:green;"><strong>Quote Added</strong></p>';
    }

    ?>

    <div class="wrap">
        <?php global $wp_version;
            if ($wp_version < 3.1 ) {
                screen_icon( 'plugins' );
        } ?>
        <h2>Quotes Page</h2>


        <form action="admin.php?page=wse140202.php" method="post">
            Add Quote:  <input style="width:600px;" type="textarea" name="random_quote" value="" />
            <br/><input type="submit" />
        </form>
    </div>

    <h3>Current Quotes</h3>
    <ul>
        <?php
        if ($quotes !== null) { // checks if $quotes is not set to 0
            $index = 0; //counter
            if (is_array($quotes)) { // checks if $quotes is an array to prevent error
            foreach ($quotes as $quote) {
                echo '<li><strong>[ <a href="admin.php?page=wse140202.php&delete=' . $index . '">Delete</a> ]</strong>&nbsp;&nbsp;' . $quote . '</li>';
                $index++; //increment counter
                }
            }
        }?>
    </ul>

    <h3>A Random Quote</h3>

   <?php // echo dw_get_random_quote();
}

?>

it seems to be this page causing the permission error admin.php?page=wse140202.php

Answer 1

Its stored in a single file called quote.php

Assuming that means that your plugin is stored in wp-content/plugins/quote.php, then the problem is that your code is hard-coded to submit to wse140202.php-- presumably you cribbed some code from another question here.

In other words, this line:

add_menu_page('Quotes Settings', 'Quotes Styling', 'manage_options', __FILE__, 'dw_styling_quotes_settings');

Registers a page based on the file name-- quote.php, not wse140202.php. Meaning that the page you registered is at admin.php?page=quote.php and not at admin.php?page=wse140202.php. Correct the addresses and it should work.

For the record, registering these pages by file name makes no sense to me. It creates a strange looking, messy URL, it reveals filesystem data potentially useful to hackers, and it isn't necessary. Register you page with a simple string name instead.

add_menu_page('Quotes Settings', 'Quotes Styling', 'manage_options', 'dw_quotes', 'dw_styling_quotes_settings');

And use admin.php?page=dw_quotes to access the page.

Then tackle those other problems :)