3

so today I updated to 4.0 (glad I had backup).

Everything was working fine until I tried to publish a post. There I got Are you sure you want to do this. Also had Cheatin' Uh under appearance->customize. Very informative messages indeed. I turned to google and after some googling and experiments with enabling/disabling plugins I found out which one was causing it.

It was WP phpBB Bridge. It's plugin which allows users to login into WP with accounts of phpBB. After some search through code of that plugin I found that problem is caused by load_session_id() function in wp_phpbb_bridge.php, specifically wp_set_auth_cookie($userid, true, false); line. If I comment that line out while logged in, problem will be solved alas it can hardly be called a solution. If I log out, I obviously won't be able to log in due not getting auth cookie.

And so, I'm stuck and have no clue how to solve this problem.

8
  • 2
    What did WP PHPBB Bridge support say?
    – Tom J Nowell
    Sep 4 '14 at 23:30
  • That plugin is quite dead for 2 years so there is no point to even ask support. Judging from last topics there, it won't get answered. Sep 5 '14 at 9:28
  • Whereas the level of WP PHPBB Bridge expertise is minimal to nonexistant save for pure luck. Eitherway I'm inclined to close this question as offtopic, as it requires specifically WP PHPBB Bridge expertise, rather than WordPress expertise. You should also post in the support forum anyway. Maybe you're not the only person with this issue, and someone else finds the solution?
    – Tom J Nowell
    Sep 5 '14 at 9:39
  • Well no, I'm pretty sure it's not only limited to this plugin due to the problem being caused by wp function, rather than WP PHPBB Bridge function. I'll write really small function to recreate problem outside of the plugin bit later and will let you know of the results. Sep 5 '14 at 9:44
  • UPD. Tested outside of plugin, wp_set_auth_cookie on init is causing this problem, so it's not just WP PHPBB Bridge problem. Sep 5 '14 at 14:48
1

Hopefully this is a temporary fix for you. The idea is to override the nonce.

Add the following in a functions.php file or in the plugin itself

function wp_verify_nonce($nonce, $action = -1) { return 1; }

For now, this works on the bridge I use on my site (A different bridge for a different forum software package). I'd love to figure out how to use WP_Session_Tokens to set this up so the nonce is verified.

Maybe this reference will be helpful.

http://developer.wordpress.org/reference/classes/wp_session_tokens/get_instance/

as well as this ticket:

https://core.trac.wordpress.org/ticket/20276

IMHO: I disagree that the question is off-topic. It is very much on topic because external authentication has been changed in WordPress 4.0 and may cause many people issues. After all, the developers added the session file and that is probably the root to the problem.

7
  • yes, but if the breakage is because of a core bug/change, there is no answer that can be given which do not include changing core, ie wordpress, without knowing the plugins code and that makes it a plugin issue which is off-topic. the number of people affected is of no importance as if it was the criteria all woocommerce questions would have been on-topic. Sep 7 '14 at 4:04
  • I understand that code may be specific to a plugin and off topic but the cookie external authentication code is all over this site. It's a simple wp_set_auth_cookie($user->ID, 0,0) shown in numerous posts as well as OP. Now that code will not work with publishing a post in WP 4.0 as discussed in the OP. Should the question be rewritten to discuss wp_verify_nonce ?
    – LPH
    Sep 7 '14 at 4:29
  • from 10 min looking at the 4.0 code it seems that another parameter was introduced in the coockies - token. The plugin probably doesn't handle it correctly. Sep 7 '14 at 5:54
  • Yeah, I figured that thing about nonces too but it doesn't seem idea to me tbh. I just rolled back to 3.9.2 till I find fix to the issue. @Mark Kaplun, I don't agree that this off topic either. It can be not a bug but change in a way it should be done now alas it was never explained how it should be done now. Sep 7 '14 at 9:05
  • Same issue, see trac ticket and wordpress-4-0-cookie-authentication-to-avoid-nonce-error-when-publishing-a-post . This post is entirely on topic as it relates to change in wordpress core.
    – here
    Nov 3 '14 at 19:46

Not the answer you're looking for? Browse other questions tagged or ask your own question.