Forms and WordPress Nonce

Question

WordPress nonce is driving me nuts! I had this problem when I started my plugin and removed it but now I have come back to it and still don't know what to do.

I have looked all over for a solution. My code is same/similar to other examples. I get an "undefined index 'mrlpt_client_check'" error.

I also get the same error for 'mrlpt_client' when checking for permissions based on user capabilities, but that is the custom post type that I have created so I'm not sure why that doesn't work either?

Here is the code where the nonce stuff is. The include just includes a short form with two input fields, one for an email address and one for a phone number, inside a custom meta box.

I have tried including the wp_nonce_field() in with the HTML form include, but that doesn't work either, same error.

Can anyone help? Thanks!!

function mrlpt_client_details( $client_post ) {

    // Retrieve saved metadata if it exists
    $mrlpt_clientEmail = get_post_meta( $client_post->ID, '_mrlpt_client_email', true );
    $mrlpt_clientPhoneNum = get_post_meta( $client_post->ID, '_mrlpt_client_phone_num', true );

    // Create a nonce field for verification
    wp_nonce_field( 'mrlpt_submit_client', 'mrlpt_client_check' );

    // Includes the form elements inside the meta box
    require_once( 'includes/mrlpt-client-form.php' );
}

// Update/Save client meta data
add_action( 'save_post', 'save_client_metadata' );

function save_client_metadata( $client_post_id ) {

    // Verify if this is an auto save routine.
    // If it is our form has not been submitted, so we dont want to do anything
    if ( defined( 'DOING_AUTOSAVE' ) && DOING_AUTOSAVE ) {
        return;
    }

    // Verify this came from the our screen and with proper authorization, because save_post can be triggered at other times
    if ( !isset( $_POST['mrlpt_client_check'] )  && !wp_verify_nonce( $_POST['mrlpt_client_check'], 'mrlpt_submit_client' ) ) {
        return;
    }

    // Check permissions - If the post type is mrlpt_client
    if ( 'post' == $_POST['mrlpt_client'] ) {
        // If the user cannot publish posts
        if ( !current_user_can_for_blog( $blog_id, 'publish-post' ) ) { // Checks by capability, not role
            wp_die( 'Insufficient privileges: Sorry, you do not have access to this page.' );
        }
    }

    // OK, we're authenticated: we need to find and save the data
    // Verify the meta data is set
    if ( isset( $_POST['mrlpt_client_email'] ) && isset( $_POST['mrlpt_client_phone_num'] ) ) {
        // Save meta data
        update_post_meta( $client_post_id, '_mrlpt_client_email', strip_tags( $_POST['mrlpt_client_email'] ) );
        update_post_meta( $client_post_id, '_mrlpt_client_phone_num', strip_tags( $_POST['mrlpt_client_phone_num'] ) );
    }
}

Answer 1

The logic here is incorrect:

// Verify this came from the our screen and with proper authorization, because save_post can be triggered at other times
if ( !isset( $_POST['mrlpt_client_check'] )  && !wp_verify_nonce( $_POST['mrlpt_client_check'], 'mrlpt_submit_client' ) ) {
    return;
}

This reads if the $_POST['mrlpt_client_check'] is not set and is invalid - return. You want it to read if $_POST['mrlpt_client_check'] is not set or it is invalid - return.

So when $_POST['mrlpt_client_check'] is not set it then checks

 wp_verify_nonce( $_POST['mrlpt_client_check'], 'mrlpt_submit_client' )

which throws an error because the first argument is referencing an key that doesn't exist. Your use of the nonce is correct:

wp_nonce_field( 'mrlpt_submit_client', 'mrlpt_client_check' );

So if the metabox is not saving you may want to check what is being posted

function save_client_metadata( $client_post_id ) {

  // Verify if this is an auto save routine.
  if ( defined( 'DOING_AUTOSAVE' ) && DOING_AUTOSAVE )
    return;

  wp_die(var_dump($_POST));
}

I'm not sure what would cause your mrlpt_client_check nonce to not be posted, but you may want to include what includes/mrlpt-client-form.php contains in your question.

---

Edit

To check permissions:

function save_client_metadata( $post_id ) {

    // Verify if this is an auto save routine.
    if ( defined( 'DOING_AUTOSAVE' ) && DOING_AUTOSAVE )
        return;

    //Check that this post is of type 'post'
    if( 'post' != get_post_type( $post->ID ) )
         return;

    //Check permissions
    if ( !current_user_can_for_blog( $blog_id, 'publish-post' ) )
         wp_die( 'Insufficient privileges: Sorry, you do not have access to this page.' )

    //Check nonce named mrlpt_client_check
    if ( !isset( $_POST['mrlpt_client_check'] )  || !wp_verify_nonce(  $_POST['mrlpt_client_check'], 'mrlpt_submit_client' ) ) 
        return

    //Validate data as necessary

  }