I've been screening the code of several widget and haven't found any one of them handling nonce. I also took a look at the WP_Widget class and found nothing about it as well.
This is from the codex: (https://codex.wordpress.org/Widgets_API)
class Foo_Widget extends WP_Widget {
function __construct() {
//something
}
public function widget( $args, $instance ) {
//something
}
public function form( $instance ) {
$title = ! empty( $instance['title'] ) ? $instance['title'] : __( 'New title', 'text_domain' );
?>
<p>
<label for="<?php echo $this->get_field_id( 'title' ); ?>"><?php _e( 'Title:' ); ?></label>
<input class="widefat" id="<?php echo $this->get_field_id( 'title' ); ?>" name="<?php echo $this->get_field_name( 'title' ); ?>" type="text" value="<?php echo esc_attr( $title ); ?>">
</p>
<?php
/****************************************
* why no nonce field created here?
****************************************/
}
public function update( $new_instance, $old_instance ) {
//something
}
}
I was expecting to have to create a nonce in the form function. Everywhere I looked nobody is handling nonce in the form function where data will be submitted. I wonder why?