1

Currently, my code is generating the wrong nonce, I guess. Here is the code:

$action = 'install-plugin';
$plugin = 'akismet';
wp_nonce_url(
    add_query_arg(
        array(
            'action' => $action,
            'plugin' => $plugin
        ),
        admin_url( 'update.php' )
    ),
    $action
);

Which generates the following url:

http://www.example.com/wp-admin/update.php?action=install-plugin&plugin=akismet&_wpnonce=27ac98eeeb

When it should generate (notice the different nonce):

http://localhost/WordpressEN/wp-admin/update.php?action=install-plugin&plugin=akismet&_wpnonce=a625535dd6

clicking on the first link causes WordPress to throw a 403 forbidden error with the message:

Are you sure you want to do this?
3

Well, looks like I have found the answer. The action should be changed like so:

$action = 'install-plugin';
$slug = 'akismet';
wp_nonce_url(
    add_query_arg(
        array(
            'action' => $action,
            'plugin' => $slug
        ),
        admin_url( 'update.php' )
    ),
    $action.'_'.$slug
);

The answer was found in line 275 in the source code: https://core.trac.wordpress.org/browser/tags/3.9.1/src/wp-admin/includes/plugin-install.php

|improve this answer|||||

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.