0

The nonce is not working. Even if I leave out the title field, it will still submit the post. Any ideas? I just want to verify each field and if it is empty, you will get a message ("Please fill...") and back to the page, without posting anything.

function front_end_question_form() { ?>
<form id="usernotes" name="usernotes" method="post" action="">
    <div class="input-field">

    <input type="text" placeholder="Überschrift" class="fancy-input" id="title" value="<?php if ( isset( $_POST['title'] ) ) echo $_POST['title']; ?>" tabindex="1" size="40" name="title"  />       
    </div>

    <div class="input-field">

        <textarea id="description" placeholder="Notiz Inhalt" tabindex="2" name="description" cols="50" rows="6" class="fancy-input"><?php if ( isset( $_POST['description'] ) ) { if ( function_exists( 'stripslashes' ) ) { echo stripslashes( $_POST['description'] ); } else { echo $_POST['description']; } } ?></textarea>       
    </div>

    <input type="submit" value="Speichern und an meine E-Mail-Adresse senden" tabindex="6" id="submit" name="submit" class="btn btn-primary" />
    <input type="hidden" name="post-type" id="post-type" value="usernotes" />

<?php wp_nonce_field( 'notes_nonce_field' ); ?>

</form>
<?php

if($_POST){
    submit_notes_form();
}

}
add_shortcode('question','front_end_question_form');

function submit_notes_form() {

$nonce = $_REQUEST['_wpnonce'];
if ( ! wp_verify_nonce( $nonce, 'notes_nonce_field' ) ) {
  exit; // Get out of here, the nonce is rotten!
}

 else {

    // Do some minor form validation to make sure there is content
    if (isset ($_POST['title'])) {
        $title =  $_POST['title'];
    } else {
        echo 'Bitte, schreibe Überschrift';
        exit;
    }
    if (isset ($_POST['description'])) {
        $description = $_POST['description'];
    } else {
        echo 'Bitte, schreibe Notiz Inhalt ';
        exit;
    }
    // Add the content of the form to $post as an array
    $post = array(
    'post_title' => wp_strip_all_tags( $title ),
    'post_content' => $description,
    'post_status' => 'publish',         
    'post_type' => $_POST['post-type'] 
    );
    wp_insert_post($post);
$location = site_url()."/notizen/";
    echo "<meta http-equiv='refresh' content='0;url=$location' />"; exit;
} //
    }

?>

1 Answer 1

0

You missed the wp_nonce_field action name.


wp_nonce_field('submit-users-note''notes_nonce_field' );

$nonce = $_POST["notes_nonce_field"];

if ( ! isset($nonce) ! wp_verify_nonce( $nonce, 'submit-users-note' ) ) {

  exit; // Get out of here, the nonce is rotten!

}


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.