0

There is a bug about my metaboxes in debug.log:

[12-Mar-2020 13:00:05 UTC] PHP Notice:  Undefined index: mytheme_meta_box_nonce in /home/deniztas/migrate666.deniz-tasarim.site/wp-content/themes/html5blank-stable/functions.php on line 330

330.line:

if (!wp_verify_nonce($_POST['mytheme_meta_box_nonce'], basename(__FILE__))) {

in functions.php, metabox snippet:

/*
 * Plugin Name: Metabox
 * Author: Burak Şahin
 * Author URI: https://buraksah.in/
 */

$prefix = 'ozellikler_';

$meta_box = array(
    'id' => 'my-meta-box',
    'title' => 'Custom meta box',
    'page' => 'post',
    'context' => 'normal',
    'priority' => 'high',
    'fields' => array(
        array(
            'name' => 'Text box',
            'desc' => 'Enter something here',
            'id' => $prefix . 'text',
            'type' => 'text',
            'std' => 'Default value 1'
        ),
        array(
            'name' => 'Text box',
            'desc' => 'Enter something here',
            'id' => $prefix . 'text-ruby',
            'type' => 'text',
            'std' => 'Default value 1'
        ),
        array(
            'name' => 'Textarea',
            'desc' => 'Enter big text here',
            'id' => $prefix . 'textarea',
            'type' => 'textarea',
            'std' => 'Default value 2'
        ),
        array(
            'name' => 'image',
            'desc' => 'Enter big text here',
            'id' => $prefix . 'image',
            'type' => 'image',
            'std' => 'Default value 2'
        ),



        array(
            'name' => 'Checkbox',
            'id' => $prefix . 'checkbox',
            'type' => 'checkbox'
        )
    )
);

add_action('admin_menu', 'mytheme_add_box');

// Add meta box
function mytheme_add_box() {
    global $meta_box;

    add_meta_box($meta_box['id'], $meta_box['title'], 'mytheme_show_box', $meta_box['page'], $meta_box['context'], $meta_box['priority']);
}

// Callback function to show fields in meta box
function mytheme_show_box() {
    global $meta_box, $post;

    // Use nonce for verification
    echo '<input type="hidden" name="mytheme_meta_box_nonce" value="', wp_create_nonce(basename(__FILE__)), '" />';

    echo '<table class="form-table">';

    foreach ($meta_box['fields'] as $field) {
        // get current post meta data
        $meta = get_post_meta($post->ID, $field['id'], true);

        echo '<tr>',
        '<th style="width:20%"><label for="', $field['id'], '">', $field['name'], '</label></th>',
        '<td>';
        switch ($field['type']) {
            case 'text':
                echo '<input type="text" name="', $field['id'], '" id="', $field['id'], '" value="', $meta ? $meta : $field['std'], '" size="30" style="width:97%" />',
                '<br />', $field['desc'];
                break;
            case 'textarea':
                echo '<textarea name="', $field['id'], '" id="', $field['id'], '" cols="60" rows="4" style="width:97%">', $meta ? $meta : $field['std'], '</textarea>',
                '<br />', $field['desc'];
                break;
            case 'checkbox':
                echo '<input type="checkbox" name="', $field['id'], '" id="', $field['id'], '"', $meta ? ' checked="checked"' : '', ' />';
                break;
        }
        echo '<td>',
        '</tr>';
    }

    echo '</table>';
}

add_action('save_post', 'mytheme_save_data');

// Save data from meta box
function mytheme_save_data($post_id) {
    global $meta_box;

    // verify nonce
    if (!wp_verify_nonce($_POST['mytheme_meta_box_nonce'], basename(__FILE__))) {
        return $post_id;
    }

    // check autosave
    if (defined('DOING_AUTOSAVE') && DOING_AUTOSAVE) {
        return $post_id;
    }

    // check permissions
    if ('page' == $_POST['post_type']) {
        if (!current_user_can('edit_page', $post_id)) {
            return $post_id;
        }
    } elseif (!current_user_can('edit_post', $post_id)) {
        return $post_id;
    }

    foreach ($meta_box['fields'] as $field) {
        $old = get_post_meta($post_id, $field['id'], true);
        $new = $_POST[$field['id']];

        if ($new && $new != $old) {
            update_post_meta($post_id, $field['id'], $new);
        } elseif ('' == $new && $old) {
            delete_post_meta($post_id, $field['id'], $old);
        }
    }
}
  • For the sake of protecting yourself when you add features in the future, try renaming your functions and not using mytheme_ or myplugin_ as prefixes - I see a lot of tutorials using that and over the years have come across tons of code conflicts because other developers failed to change the prefixes. – Tony Djukic Mar 13 at 0:33
  • @TonyDjukic thanks for your notice – ahmet kaya Mar 13 at 11:12
4

You should always check if a POST variable (or an item/key in an array like the superglobal $_POST variable) exists before attempting to use it. And you could use isset() like so:

if (
    // Check if the variable is set.
    isset( $_POST['mytheme_meta_box_nonce'] ) &&
    // .. before accessing the value.
    ! wp_verify_nonce( $_POST['mytheme_meta_box_nonce'], basename( __FILE__ ) )
)

And you should know that your mytheme_save_data() function would be called every time the save_post hook is fired, regardless the origin of the request (e.g. a different metabox without the mytheme_meta_box_nonce input), hence you should check if the input was actually submitted.

Additionally, it might be better to use empty() like so:

if (
    // Bail if the nonce is empty.
    empty( $_POST['mytheme_meta_box_nonce'] ) ||
    // .. or that it has expired.
    ! wp_verify_nonce( $_POST['mytheme_meta_box_nonce'], basename( __FILE__ ) )
)
| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.