dashboard widget form not submit mails

Question

I'm adding for the first time a wordpress dashboard widget. I'm creating a simple form to give the user the ability to send support request directly from wp dashboard. I'm not sure if all the code is working, during a test, I've noticed that the form will not submit the mail message. Can anyone help me?

function uptheme_support_dashboard_widgets()
  {
    global $wp_meta_boxes;
    wp_add_dashboard_widget('custom_help_widget', 'Premium Ticket System', 'custom_dashboard_help');
  }

  function custom_dashboard_help()
  {
    $current_theme = wp_get_theme( 'uptheme-panel' );
    ?>
      <p><?php _e('Hi! you are using the custom theme '. esc_html($current_theme) ); ?></p>
      <p><?php _e('Use the form to request support for your theme.'); ?></p>
      <form method="POST">
      <p><?php _e('Email'); ?></p>
        <input type="text" class="widefat" name="email" id="email" placeholder="" />
      <p><?php _e('Request type'); ?></p>
        <select name="support_ticket_type">
          <option value=""><?php _e('Support request'); ?></option>
          <option value=""><?php _e('Modification request'); ?></option>
        </select>
      <p><?php _e('Message'); ?></p>
        <textarea class="widefat" name="support_message"></textarea>
        <input type="hidden" name="action" value="submit_support_ticket">
        <?php wp_nonce_field( 'submit_support_ticket', 'support_ticket_hash' ); ?>
        <button class="btn-primary" type="submit" class=""><?php _e('Invia'); ?></button>
      </form>
      <small><?php _e('Theme powered by'); ?><a href="#"><?php _e('theme author'); ?></a></small>
    <?php
  }
  add_action('wp_dashboard_setup', 'uptheme_support_dashboard_widgets');


  function _submit_support_ticket()
  {
    if( isset($_POST['support_ticket_hash']) || ! wp_verify_nonce( $_POST['support_ticket_hash'], 'submit_support_ticket' ) ){
      //echo '';
      exit;
    }
    $email = $_POST['email'];
    $subject = $_POST['support_ticket_type'];
    $message = $_POST['support_message'];
    $to = '[email protected]';
    $headers[] = "From: <$email>";
    wp_mail( $to, $subject, $message, $headers );
  }
  add_action( 'admin_post_submit_support_ticket', '_submit_support_ticket' );

Answer 1

There are three issues I see in your code:

1. Your form doesn't have an action set. You should add it and set the value to admin-post.php.

   <form method="POST" action="<?php echo esc_url( admin_url( 'admin-post.php' ) ); ?>">
   

   Because the function which processes the form and then sends the email is hooked to admin_post_submit_support_ticket (i.e. admin_post_<action>) and that hook is fired only on wp-admin/admin-post.php.

2. In _submit_support_ticket(), the isset($_POST['support_ticket_hash']) should be ! isset($_POST['support_ticket_hash']) because if not, the page would exit even if there was actually a valid nonce.

   if( ! isset($_POST['support_ticket_hash']) || ! wp_verify_nonce( $_POST['support_ticket_hash'], 'submit_support_ticket' ) ){
     //echo '';
     exit;
   }
   

3. The email subject is actually empty and that will not send the email. So make sure that your "Request type" drop-down has valid options (currently, the option's value is empty).

   wp_mail( '[email protected]', '', 'Testing' );   // bad; subject is empty
   wp_mail( '[email protected]', 'Hi', 'Testing' ); // good; subject is good..
   

   In fact, if you look at wp_mail()'s docs, the subject is a required parameter. So once again, make sure the <option> has a good subject, although it might be preferred to compose the subject in your PHP and not sent as-is as coming from the form.

   <p><?php _e('Request type'); ?></p>
   <select name="support_ticket_type">
     <option value="Support request"><?php _e('Support request'); ?></option>
     <option value="Modification request"><?php _e('Modification request'); ?></option>
   </select>
   

And after the email is sent, you should send the user back to the dashboard page to prevent them from seeing a blank page. So after the wp_mail() call, you could do:

wp_redirect( admin_url() );
exit;

Also, you should always sanitize user-supplied data. Never trust their input even if you actually trust the person...