PHP Notice: Undefined index: mytheme_meta_box_nonce

Question

There is a bug about my metaboxes in debug.log:

[12-Mar-2020 13:00:05 UTC] PHP Notice:  Undefined index: mytheme_meta_box_nonce in /home/deniztas/migrate666.deniz-tasarim.site/wp-content/themes/html5blank-stable/functions.php on line 330

330.line:

if (!wp_verify_nonce($_POST['mytheme_meta_box_nonce'], basename(__FILE__))) {

in functions.php, metabox snippet:

/*
 * Plugin Name: Metabox
 * Author: Burak Şahin
 * Author URI: https://buraksah.in/
 */

$prefix = 'ozellikler_';

$meta_box = array(
    'id' => 'my-meta-box',
    'title' => 'Custom meta box',
    'page' => 'post',
    'context' => 'normal',
    'priority' => 'high',
    'fields' => array(
        array(
            'name' => 'Text box',
            'desc' => 'Enter something here',
            'id' => $prefix . 'text',
            'type' => 'text',
            'std' => 'Default value 1'
        ),
        array(
            'name' => 'Text box',
            'desc' => 'Enter something here',
            'id' => $prefix . 'text-ruby',
            'type' => 'text',
            'std' => 'Default value 1'
        ),
        array(
            'name' => 'Textarea',
            'desc' => 'Enter big text here',
            'id' => $prefix . 'textarea',
            'type' => 'textarea',
            'std' => 'Default value 2'
        ),
        array(
            'name' => 'image',
            'desc' => 'Enter big text here',
            'id' => $prefix . 'image',
            'type' => 'image',
            'std' => 'Default value 2'
        ),



        array(
            'name' => 'Checkbox',
            'id' => $prefix . 'checkbox',
            'type' => 'checkbox'
        )
    )
);

add_action('admin_menu', 'mytheme_add_box');

// Add meta box
function mytheme_add_box() {
    global $meta_box;

    add_meta_box($meta_box['id'], $meta_box['title'], 'mytheme_show_box', $meta_box['page'], $meta_box['context'], $meta_box['priority']);
}

// Callback function to show fields in meta box
function mytheme_show_box() {
    global $meta_box, $post;

    // Use nonce for verification
    echo '<input type="hidden" name="mytheme_meta_box_nonce" value="', wp_create_nonce(basename(__FILE__)), '" />';

    echo '<table class="form-table">';

    foreach ($meta_box['fields'] as $field) {
        // get current post meta data
        $meta = get_post_meta($post->ID, $field['id'], true);

        echo '<tr>',
        '<th style="width:20%"><label for="', $field['id'], '">', $field['name'], '</label></th>',
        '<td>';
        switch ($field['type']) {
            case 'text':
                echo '<input type="text" name="', $field['id'], '" id="', $field['id'], '" value="', $meta ? $meta : $field['std'], '" size="30" style="width:97%" />',
                '<br />', $field['desc'];
                break;
            case 'textarea':
                echo '<textarea name="', $field['id'], '" id="', $field['id'], '" cols="60" rows="4" style="width:97%">', $meta ? $meta : $field['std'], '</textarea>',
                '<br />', $field['desc'];
                break;
            case 'checkbox':
                echo '<input type="checkbox" name="', $field['id'], '" id="', $field['id'], '"', $meta ? ' checked="checked"' : '', ' />';
                break;
        }
        echo '<td>',
        '</tr>';
    }

    echo '</table>';
}

add_action('save_post', 'mytheme_save_data');

// Save data from meta box
function mytheme_save_data($post_id) {
    global $meta_box;

    // verify nonce
    if (!wp_verify_nonce($_POST['mytheme_meta_box_nonce'], basename(__FILE__))) {
        return $post_id;
    }

    // check autosave
    if (defined('DOING_AUTOSAVE') && DOING_AUTOSAVE) {
        return $post_id;
    }

    // check permissions
    if ('page' == $_POST['post_type']) {
        if (!current_user_can('edit_page', $post_id)) {
            return $post_id;
        }
    } elseif (!current_user_can('edit_post', $post_id)) {
        return $post_id;
    }

    foreach ($meta_box['fields'] as $field) {
        $old = get_post_meta($post_id, $field['id'], true);
        $new = $_POST[$field['id']];

        if ($new && $new != $old) {
            update_post_meta($post_id, $field['id'], $new);
        } elseif ('' == $new && $old) {
            delete_post_meta($post_id, $field['id'], $old);
        }
    }
}

Answer 1

You should always check if a POST variable (or an item/key in an array like the superglobal $_POST variable) exists before attempting to use it. And you could use isset() like so:

if (
    // Check if the variable is set.
    isset( $_POST['mytheme_meta_box_nonce'] ) &&
    // .. before accessing the value.
    ! wp_verify_nonce( $_POST['mytheme_meta_box_nonce'], basename( __FILE__ ) )
)

And you should know that your mytheme_save_data() function would be called every time the save_post hook is fired, regardless the origin of the request (e.g. a different metabox without the mytheme_meta_box_nonce input), hence you should check if the input was actually submitted.

Additionally, it might be better to use empty() like so:

if (
    // Bail if the nonce is empty.
    empty( $_POST['mytheme_meta_box_nonce'] ) ||
    // .. or that it has expired.
    ! wp_verify_nonce( $_POST['mytheme_meta_box_nonce'], basename( __FILE__ ) )
)