Nonce and widget

Question

I've been screening the code of several widget and haven't found any one of them handling nonce. I also took a look at the WP_Widget class and found nothing about it as well.

This is from the codex: (https://codex.wordpress.org/Widgets_API)

class Foo_Widget extends WP_Widget {
    function __construct() {
        //something
    }

    public function widget( $args, $instance ) {
        //something
    }

    public function form( $instance ) {
        $title = ! empty( $instance['title'] ) ? $instance['title'] : __( 'New title', 'text_domain' );
        ?>
        <p>
        <label for="<?php echo $this->get_field_id( 'title' ); ?>"><?php _e( 'Title:' ); ?></label> 
        <input class="widefat" id="<?php echo $this->get_field_id( 'title' ); ?>" name="<?php echo $this->get_field_name( 'title' ); ?>" type="text" value="<?php echo esc_attr( $title ); ?>">
        </p>
        <?php 

        /****************************************
        * why no nonce field created here?
        ****************************************/
    }

    public function update( $new_instance, $old_instance ) {
        //something
    }
}

I was expecting to have to create a nonce in the form function. Everywhere I looked nobody is handling nonce in the form function where data will be submitted. I wonder why?

Answer 1

You have to be more clear about your problem. It will be better to publish you code and anyone can check it a give their help.

I have created a contact form before with nonce and inside the form i added: <input type="hidden" name="nonce" value="<?php echo wp_create_nonce('send_email_nonce'); ?>"/>

and on the on the form handler i added:

$formNonce = $_POST['nonce'];

if (!wp_verify_nonce($formNonce, 'send_email_nonce')) {
  echo json_encode(array(
    'success' => false,
    'message' => __('Nonce was not verified!', 'shomtek')
  ));
  die;
}

But it depends on what is the purpose of your widget and form. I suggest you to be more specific and post your code.