0

I'm developing a Wordpress-Plugin where I add some forms to the wordpress admin. Usually when I'm testing the processing of form data, I fill in the form once and then just reload the page to send the same form data again and again for testing. When I reload the page after submitting a form with post-data, the browser pops a dialog "Confirm Form Resubmission" and if I confirm it sends the same post-data again.

But for some reason I don't get this dialog any more and the page is just being reloaded without the post-data being sent.

Has somebody an idea about the reason for this changed behaviour? It works just as usual when I test it with a from outside wordpress. I've also tested with multiple browsers and they all gave me the same result. So I guess it might be a change inside Wordpress?

UPDATE: I tried disabling javascript and immediately got back the "Confirm Form Resubmission" dialog. So it seems to be a wordpress javascript feature? I didn't even know that could be done. Can somebody point me in the right direction on how to disable that without disabling all javascript?

Improve this question

1 Answer 1

Reset to default
0

If you're refering to WP internal forms:

Wordpress has an built in security mechanism called "wp nonces" (https://codex.wordpress.org/WordPress_Nonces) - that's an unique hash generated for every WP-form. Every Backend code should check for the according nonce to make sure that

  1. The form submission wasn't done from outside (usually attacks or bots)
  2. The form submission was done only once (usually unwanted reloads by users, bots or multiple submission cheating)

To check, have a look into the source code and search for a hidden field called wp_nonce or similar.

BR from Salzburg!

Improve this answer
2
  • Thank you for your answer, I didn't know that. But that doesn't seem to be the issue because it also concerns forms that belong to my plugin and I wrote that code from scratch and didn't use wp nonces. And I just found out, it must be a javascript "feature".
    – Dave
    Commented May 18, 2015 at 18:41
  • WordPress nonces aren't restricted to a single use: They help protect against several types of attacks including CSRF, but do not protect against replay attacks because they aren't checked for one-time use.. Using a nonce shouldn't prevent form resubmission.
    – Mathew Tinsley
    Commented May 18, 2015 at 19:05

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.