1

I'm trying to pass a nonce at the links created from my plugin using add_menu_page and add_submenu_page. Of course this is invalid:

add_submenu_page(
 'my_dashboard',
 'Dashboard',
 'Dashboard',
 'manage_options',
 'my_dashboard&nonce-field=' . wp_create_nonce('my_action'),
 'show_dashboard'
);

as per the Codex, the slug should only include lowercase alphanumeric, dashes, and underscores characters.

So my question is, how could we pass nonce in the URL of the menu links a plugin creates?

Improve this question
6
  • Can you elaborate on what you're trying to achieve? Not clear on why you need a nonce here. There's probably a better way to do whatever it is you're doing.
    – Jacob Peattie
    May 24, 2018 at 14:59
  • Yes of course. I'm trying to verify nonce (either with check_admin_referer() or with wp_verify_nonce(), at the body of the show_dashboard function, but to do that, I must pass a nonce field at the initial URL.
    – L.Milo
    May 24, 2018 at 15:03
  • I use a $_GET variable inside the show_dashboard function, so if I don't have nonce verification, it would produce an error of the WordPress Code Standards.
    – L.Milo
    May 24, 2018 at 15:05
  • When are you using $_GET? After submitting a form? In that case you're supposed to use a nonce field in the form so that it gets added to the URL when you submit.
    – Jacob Peattie
    May 24, 2018 at 15:13
  • I'm not submitting a form unfortunately. I'm just checking for $_GET parameters inside the function to be called to output the content for this page, because this specific page is used for many stages at the plugin, so I have to check the $_GET parameters to check at what stage I'm currently at.
    – L.Milo
    May 24, 2018 at 15:20

1 Answer 1

Reset to default
1

WordPress do not accept nonce in the slug that you are trying to provide in the above code.

I mean in this line:

 'my_dashboard&nonce-field=' . wp_create_nonce('my_action'), 'show_dashboard'

I was facing the same issue like you are facing. As the admin menu already verified for specific users so we don't need to verify it again with nonce. Therefore, to skip that issue you can use that code at top of your file where you using $_GET or $_POST super global.

check_admin_referer(-1);

It will remove the warning for nonce verification.

Improve this answer
5
  • As of version 3.2 it throws a notice type of error if you don't provide the first (action) argument. But it does help to bypass the codesniffer warning.
    – Azamat
    Jun 16, 2022 at 7:44
  • 1
    Can you please let me know what is 3.2 version?
    – Saroar Hossain Limon
    Jun 16, 2022 at 9:12
  • * As of WordPress version 3.2
    – Azamat
    Jun 17, 2022 at 4:53
  • I don't know but why you are using very old version of WordPress. It has so many security issues. So I think you should update WordPress version to latest.
    – Saroar Hossain Limon
    Jun 19, 2022 at 9:18
  • In the above Saroar Hossain answer. There is still an error i.e. "Notice: Function check_admin_referer was called incorrectly. You should specify an action to be verified by using the first parameter." How to resolve this as I have an already updated verion of Wordpress i.e. 6.2.
    – Jwala Dubey
    Apr 2 at 18:34

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.