1

I have made options page with 2 forms and two separate nonce fields, and other input fields that I save with AJAX.

The issue is that every time I save and call my function to save options via AJAX I get the 'Busted' value that happens if nonce fails.

The layout part looks like this:

<?php 

$form_html = json_decode( get_option('form_html', '') );

$out = '';
    $out .= '<form id="page_layout_options" class="page_layout_options" method="post" action="#">';
        if (isset($form_html) && $form_html != '') {
            $out .= $form_html;
        } else{
            $out .= '
            <table class="form-table">
                <tbody>
                    <tr>
                        <td class="title">
                            <h4>'.esc_html__('Front page layout', 'mytheme').'</h4>
                        </td>
                        <td class="module_select">
                            <select name="page_element_module" id="page_element">
                                <option value="posts3_left">'.esc_html__('3 posts 2 left', 'mytheme').'</option>
                                <option value="posts3_right">'.esc_html__('3 posts 2 right', 'mytheme').'</option>
                                <option value="posts2">'.esc_html__('2 posts', 'mytheme').'</option>
                                <option value="single_post">'.esc_html__('Single post', 'mytheme').'</option>
                                <option value="gallery">'.esc_html__('Gallery', 'mytheme').'</option>
                                <option value="poll">'.esc_html__('Poll', 'mytheme').'</option>
                                <option value="image">'.esc_html__('Image', 'mytheme').'</option>
                            </select>
                            <div id="add_layout" class="add_layout button">'.esc_html__('Add module', 'mytheme').'</div>
                            <div class="layout_draggable"></div>
                            <div class="button save_layout hidden">'.esc_html__('Save layout', 'mytheme').'</div>
                            <div class="button clear_layout hidden">'.esc_html__('Clear layout', 'mytheme').'</div>
                        </td>
                        <td class="page_select">
                        </td>
                    </tr>
                </tbody>
            </table>
            <input type="submit" class="submit button button-primary disabled" value="'.esc_html__('Save', 'mytheme').'"><span class="spinner"></span><span class="saved_options"></span>
            '.wp_nonce_field( 'page_layout_nonce', 'ajaxnonce', true, false ).'
            <input type="hidden" name="layout" value="" class="hidden_layout_input">
            <input type="hidden" name="offset" value="" class="hidden_offset_input">
            <input type="hidden" name="gallery_no" value="" class="gallery_no">
            <input type="hidden" name="image_no" value="" class="image_no">
            <input type="hidden" name="poll_no" value="" class="poll_no">
            <input type="hidden" name="form_html" value="" class="form_html">';
        }
    $out .= '</form>
        </div>';

    echo $out;
    echo '<div id="tab_2" class="hidden"><p>'.esc_html__('Choose page layout for category page.', 'mytheme').'</p>';

    $cat_form_html = json_decode( get_option('cat_form_html', '') );

    $cat_out = '';
    $cat_out .= '<form id="cat_page_layout_options" class="cat_page_layout_options" method="post" action="#">';
        if (isset($cat_form_html) && $cat_form_html != '') {
            $cat_out .= $cat_form_html;
        } else{
            $cat_out .= '
            <table class="form-table">
                <tbody>
                    <tr>
                        <td class="title">
                            <h4>'.esc_html__('Category page layout', 'mytheme').'</h4>
                        </td>
                        <td class="module_select">
                            <select name="page_element_module" id="cat_page_element">
                                <option value="posts3_left">'.esc_html__('3 posts 2 left', 'mytheme').'</option>
                                <option value="posts3_right">'.esc_html__('3 posts 2 right', 'mytheme').'</option>
                                <option value="posts2">'.esc_html__('2 posts', 'mytheme').'</option>
                                <option value="single_post">'.esc_html__('Single post', 'mytheme').'</option>
                            </select>
                            <div id="add_cat_layout" class="add_cat_layout button">'.esc_html__('Add module', 'mytheme').'</div>
                            <div class="cat_layout_draggable"></div>
                            <div class="button save_cat_layout hidden">'.esc_html__('Save layout', 'mytheme').'</div>
                            <div class="button clear_cat_layout hidden">'.esc_html__('Clear layout', 'mytheme').'</div>
                        </td>
                    </tr>
                </tbody>
            </table>
            <input type="submit" class="submit button button-primary disabled" value="'.esc_html__('Save', 'mytheme').'"><span class="spinner"></span><span class="saved_options"></span>
            '.wp_nonce_field( 'cat_page_layout_nonce', 'cat_ajaxnonce', true, false ).'
            <input type="hidden" name="cat_layout" value="" class="hidden_cat_layout_input">
            <input type="hidden" name="cat_offset" value="" class="hidden_cat_offset_input">
            <input type="hidden" name="cat_form_html" value="" class="cat_form_html">';
        }
    $cat_out .= '</form>
        </div>';

    echo $cat_out;

It's basically a dropdown of layouts, I can set them up and save them to my options. This works only when I set is up first time. It saves and all is fine. But if I want to modify it my nonce fails. The save function (for the first form) looks like this:

<?php 


add_action( 'wp_ajax_mytheme_page_layout_options', 'mytheme_page_layout_options' );
add_action( 'wp_ajax_nopriv_mytheme_page_layout_options', 'mytheme_page_layout_options' );

if (!function_exists('mytheme_page_layout_options')) {
    function mytheme_page_layout_options() {

        if (!current_user_can('manage_options')){
            die ('You can\'t change this!');
        }

        if ( !isset( $_POST['ajaxnonce'] ) || /*check_admin_referer( 'page_layout_nonce' )*/ !wp_verify_nonce( $_POST['ajaxnonce'], 'page_layout_nonce' ) ){
            die ($_POST['ajaxnonce']);
        }

        if ( isset($_POST['layout']) ) {
            update_option('layout', stripslashes( $_POST['layout'] ) );
            $layout = stripslashes( $_POST['layout'] );
        }

        if ( isset($_POST['offset']) ) {
            update_option('offset', stripslashes( $_POST['offset'] ) );
            $offset = stripslashes( $_POST['offset'] );
        }

        if ( isset($_POST['gallery_no']) ) {
            update_option('gallery_no', $_POST['gallery_no'] );
            $gallery_no = $_POST['gallery_no'];
        } else{
            $gallery_no = 0;
        }

        if ( isset($_POST['image_no']) ) {
            update_option('image_no', $_POST['image_no'] );
            $image_no = $_POST['image_no'];
        } else{
            $image_no = 0;
        }

        if ( isset($_POST['poll_no']) ) {
            update_option('poll_no', $_POST['poll_no'] );
            $poll_no = $_POST['poll_no'];
        } else{
            $poll_no = 0;
        }

        if ( isset($_POST['form_html']) ) {
            update_option('form_html', stripslashes( $_POST['form_html'] ) );
            $form_html = stripslashes( $_POST['layout'] );
        }

        for ($i=$gallery_no; $i > 0; $i--) {
            if ( isset($_POST["gallery_$i"]) ) {
                update_option("gallery_$i", $_POST["gallery_$i"]);
            }
        }

        for ($j=$image_no; $j > 0; $j--) {
            if ( isset($_POST["image_$j"]) ) {
                update_option("image_$j", $_POST["image_$j"]);
            }
        }

        for ($k=$poll_no; $k > 0; $k--) {
            if ( isset($_POST["poll_$k"]) ) {
                update_option("poll_$k", $_POST["poll_$k"]);
            }
        }

        die();

    }
}

Now in my network tab, on admin-ajax.php I can see all the $_POST values correctly

enter image description here enter image description here

I know that it fails because in my Preview I get the ajaxnonce value from the $_POST (which you can see I put in my die()).

But why does it fail?

The second form has a different name, different nonce name, everything. The ajax works, but the nonce fails and I have no idea why :\

Any help is appreciated.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.