1

I am developing a wordpress theme for themeforest so its for commercial use and adding a custom input field of social media to the user menu in the WordPress dashboard gives error after i click Update Profile. The front-end appears correctly but when i submit it by clicking Update Profile button it takes me to a next page where it says

The link you followed has expired.Please try again.

it works when i remove my custom input fields. Following are its screenshots

Wordpress Dashboard user menu with custom fields of social

Error Thrown when i submit the user profile with my custom fields

Following is my code (written in a extra-user-fields.php file which i include in functions.php):

<?php

add_action( 'show_user_profile', '_themename_extra_user_profile_fields' );
add_action( 'edit_user_profile', '_themename_extra_user_profile_fields' );
add_action('user_new_form', '_themename_extra_user_profile_fields');

function _themename_extra_user_profile_fields( $user ) { ?>
    <h3><?php _e("Extra profile information", "_themename"); ?></h3>

    <table class="form-table">

    <?php wp_nonce_field( '_themename_user_extra_fields_verify' ); ?>

    <tr>
        <th><label for="facebook"><?php _e("Facebook Profile Link","_themename"); ?></label></th>
        <td>
            <input type="text" name="facebook" id="facebook" value="<?php echo esc_url( get_the_author_meta( 'facebook', $user->ID ) ); ?>" class="regular-text"/><br />
            <span class="description"><?php _e("Please enter your facebook profile link."); ?></span>
        </td>
    </tr>
    <tr>
        <th><label for="twitter"><?php _e("Twitter Profile Link","_themename"); ?></label></th>
        <td>
            <input type="text" name="twitter" id="twitter" value="<?php echo esc_url( get_the_author_meta( 'twitter', $user->ID ) ); ?>" class="regular-text"/><br />
            <span class="description"><?php _e("Please enter your twitter profile link."); ?></span>
        </td>
    </tr>
    </table>
<?php }

    function _themename_save_extra_user_profile_fields( $user_id ) {

        if ( !current_user_can( 'edit_user', $user_id ) ) {
            wp_die( __( 'You are not allowed to be on this page.', '_themename' ) );
        }
        check_admin_referer( '_themename_user_extra_fields_verify' );

        $escaped_facebook_url   = esc_url($_POST['facebook']);
        $escaped_twitter_url    = esc_url($_POST['twitter']);
        update_user_meta( $user_id, 'facebook', $escaped_facebook_url);
        update_user_meta( $user_id, 'twitter', $escaped_twitter_url);
    }
    
    add_action( 'personal_options_update', '_themename_save_extra_user_profile_fields' );
    add_action( 'edit_user_profile_update', '_themename_save_extra_user_profile_fields' );
    add_action('user_register', '_themename_save_extra_user_profile_fields');
?>

The error only gets removed when i completely remove the _themename_save_extra_user_profile_fields() function and its add_action and completely empties the _themename_extra_user_profile_fields() function too.

Also i researched online and to fix this error i need to increase the limit size of uploading of WordPress through htaccess file etc. But as i said i am making a theme for themeforest so it will be for commercial use and i can't just fix this error here and then ask users of my theme to do the same to change the limit size of uploading etc. so that fix doesn't work for me

3
  • Thank you it worked. i didn't know that that the form itself has a nonce which obviously it should have. anyhow thank you very much i got my answer. please write an answer to this question so it could be marked as a proper answer Oct 20 '20 at 22:49
  • Note that you incorrectly placed the wp_nonce_field() call - (and although you no longer use it,) it should've been placed outside the <table>. And for saving an URL to the database, you wouldn't use esc_url(); instead, you can use esc_url_raw() or sanitize_text_field().
    – Sally CJ
    Oct 21 '20 at 0:50
  • 1
    yeah i forgot about the esc_url_raw() thanks for the note and info Oct 21 '20 at 12:26
0

That error messages means a failed admin nonce validation (check_admin_referer, which calls wp_nonce_ays). And you don't actually need an extra nonce here: these are extra fields to be added to existing forms that already have their own nonces, and the one you've added just clashes with them. (If you were adding a new form you would need these, yes.)

So I think the fix is to remove

<?php wp_nonce_field( '_themename_user_extra_fields_verify' ); ?>

and

check_admin_referer( '_themename_user_extra_fields_verify' );

and the forms will still be secure. I don't think you need the user edit permissions check either.


That all said, you could implement Facebook and Twitter as extra contact info fields instead:

function wpse_376873_add_contactmethods( $contactmethods ) {
    $contactmethods['facebook'] = __( "Facebook Profile Link", "_themename" );
    $contactmethods['twitter'] = __( "Twitter Profile Link","_themename" );

    return $contactmethods;
}
add_filter( 'user_contactmethods', 'wpse_376873_add_contactmethods', 10, 1 );

and most of this should just work automatically without having to write HTML for the fields. I don't think you can set extra field descriptions though as you have for your own fields.

3
  • Thank you very much Oct 20 '20 at 22:50
  • I hadn't noticed this was Facebook and Twitter. I've seen those done as contact fields instead, so I've added a snippet for that, but I don't know if the values will end up escaped in the same way though.
    – Rup
    Oct 20 '20 at 22:57
  • Thank you so much for the information, appreciate it but i can't risk my theme getting a soft rejection because of this being wrongly escaped. still thank u for the information now i know it could be done this way too :) Oct 20 '20 at 23:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.