1

This question comes from an absolute non-coder - and has been asked in various forms several times befor (e.g. here).

To logout properly the URL that triggers it needs a nonce as e.g.:

http://xyz/wp-login.php?action=logout&redirect_to=http%3A%2F%2Fwww.spiegel.de&_wpnonce=d9d1a28ef2

We can get the nonce as described in the codex. BUT: what if I have to trigger a logout is by using a URL. More precisely: my CiviCRM plugin has forms that people can fill out and once completed let the user redirect somewhere else -> e.g. log out and go to another page. I can copy/paste the redirct URL in a form such as

http://xyz/wp-login.php?action=logout&redirect_to=http%3A%2F%2Fwww.spiegel.de

-> how do I get the nonce where it is supposed to go - or are there alternatives???

Cheers!

  • Nonces are time-based per-user - the only way to get them is through WordPress. You'd either have to "hook" into the CiviCRM and work out how you can dynamically pass it the redirect URL (as opposed to copy/pasting it in a setting), or remove nonce checking from the logout process (not recommended) – TheDeadMedic Oct 26 '16 at 14:08
  • Thought so - thanks (will close the question then). Just out of interest - even though it's not recommended - how would I go about removing nonce-checking? Cheers! – Abteilung Gerontopsychiatrie Oct 26 '16 at 15:21
  • I'll post an answer. – TheDeadMedic Oct 26 '16 at 15:30
1

This will disable nonce checking for logging out - on your head be it:

add_action( 'login_form_logout', function () {
    $user = wp_get_current_user();

    wp_logout();

    if ( ! empty( $_REQUEST['redirect_to'] ) ) {
        $redirect_to = $requested_redirect_to = $_REQUEST['redirect_to'];
    } else {
        $redirect_to = 'wp-login.php?loggedout=true';
        $requested_redirect_to = '';
    }

    /**
     * Filters the log out redirect URL.
     *
     * @since 4.2.0
     *
     * @param string  $redirect_to           The redirect destination URL.
     * @param string  $requested_redirect_to The requested redirect destination URL passed as a parameter.
     * @param WP_User $user                  The WP_User object for the user that's logging out.
     */
    $redirect_to = apply_filters( 'logout_redirect', $redirect_to, $requested_redirect_to, $user );
    wp_safe_redirect( $redirect_to );
    exit;
});

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.