0

In short, this is a question about whether or not nonce verification is required for custom bulk user actions?

Their guidance (albeit old) on how to implement custom bulk actions does not include or mention nonce verification.

Additionally, WordPress Core itself removes the _wpnonce query arg before processing custom bulk user actions (see here) prior to triggering the handle_bulk_actions-users filter (see here).

You can see here and in the subsequent case statements in that file that nonce verification is being performed for the other cases in users.php using check_admin_referer( 'bulk-users' ); for the promote resetpassword delete and remove actions as well as the custom nonce verification for the dodelete and doremove actions.

However, for the default case, the nonce is removed if the _wp_http_referer query string parameter is not empty. It then redirects to the same uri without the _wp_http_referer and _wpnonce query string parameters and falls through that block where it eventually runs the handle_bulk_actions-{$screen} filter (see here) which is the hook custom bulk actions hook into for processing.

Just to try it out, I tried and confirmed that a custom bulk action will simply fail if it runs check_admin_referer( 'bulk-users' ); because the _wpnonce parameter is no longer present in the query string.

Can anyone answer definitively if nonce verification is required for customer bulk user actions and, if so, provide an example of a plugin that is doing this using the built-in hooks and handle_bulk_actions-{$screen} filter?

1 Answer 1

1

In WordPress, nonces (number used once) are security tokens that help protect against CSRF (Cross-Site Request Forgery) attacks. Nonce verification is generally recommended for actions that involve user interactions to ensure that the request is legitimate and not forged by a malicious party.

When it comes to custom bulk user actions in WordPress, nonce verification is indeed a good practice to enhance the security of your application. The nonce should be included in the form or request to validate that the action is intended by the user.

Looking at the WordPress core, you've correctly noted that nonce verification is performed for various bulk user actions using check_admin_referer('bulk-users'). This helps ensure that the request is legitimate. However, you've observed that in some cases, the _wpnonce parameter is removed before reaching the custom bulk actions.

If nonce verification is not performed as part of the custom bulk user actions, it might be a potential security vulnerability. It's possible that the WordPress Core handles certain cases differently due to historical reasons or specific use cases.

Here's a basic example of how you can add nonce verification for a custom bulk user action using the handle_bulk_actions-{$screen} filter:

// Hook into the bulk action for users
add_filter('handle_bulk_actions-users', 'custom_bulk_user_action', 10, 3);

function custom_bulk_user_action($redirect_to, $doaction, $user_ids) {
    // Verify nonce
    $nonce = isset($_REQUEST['_wpnonce']) ? $_REQUEST['_wpnonce'] : '';

    if (!wp_verify_nonce($nonce, 'bulk-users')) {
        // Nonce verification failed, handle accordingly (e.g., show an error)
        wp_die('Security check failed!');
    }

    // Perform your custom bulk action logic here

    // Redirect back to the users page after the action is completed
    return add_query_arg('bulk_action_completed', 1, $redirect_to);
}

In this example, the wp_verify_nonce function is used to check the nonce's validity. If the verification fails, it displays an error message using wp_die. Adjust the code according to your specific use case and error handling requirements.

Please note that the specifics might vary based on the context and WordPress version, so always refer to the latest WordPress documentation and best practices.

1
  • Thanks, but I've already tried this with both check_admin_referer('bulk-users') and I also tried your example. The problem is that the _wpnonce parameter is removed from the query string (see here) prior to the custom_bulk_user_action firing, and so this always fails. So, in short, there is indeed a nonce included on form, but it gets removed prior to the wp_redirect and then it's no longer available to the custom bulk action by the time the handle_bulk_actions-{$screen} filter fires.
    – anderly
    Jan 12 at 20:49

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.