Wordpress custom admin functions security

Question

i have a case in my admin panel where i need to call my own function that resides in my own php file, with a GET request. This function is actually removing entries from the database.

So, i would like to make sure that this cannot be invoked from anybody else than the admin user. What is the best way of doing that ? Notice that my 'example.php?filename=..' script is executed directly and should return with refreshing the page on the admin panel.

How do i secure that properly ? Is there a better way of doing that while being controlled by Wordpress default security measures ?

It would be also great to be able to execute things like get_option in the context of my php code.

Answer 1

Read about "Nonces".

Create one and append it to your URL:

$url = 'example.php?filename=whatever&nonce=' . wp_create_nonce('my_sensitive_action');

When your request is fulfilled check for it:

// here verify if the nonce was used before
if(wp_verify_nonce($_GET['nonce'], 'my_sensitive_action')){
  // it's ok, it wasn't used before
}

Also the validity of these nonces has a time limit, like one day or so. If the nonce is not used within this period, it will expire...