Meta Boxes causing Header errors

Question

I'm attempting to move some meta boxes and custom post types to a plugin file (to survive future theme updates). One issue is that now, all my wp_nonce values are returning an "undefined index" notice (I realize that this isn't a huge issue, but I'd like my code to be working in the cleanest possible manner). The main issue, however, is that the $_POST in the save function causes a warning error of "headers already sent" with conflict from the pluggables.php file (line 876). Here's the code that I'm attempting to use:

// Add and Save Meta Boxes for Congregation Post Type
add_action( 'add_meta_boxes', 'add_congregation_metaboxes', 1 );
add_action('save_post', 'save_address_meta', 1, 2); // save the Address field

function add_congregation_metaboxes() {
    add_meta_box('congregation_address', 'Congregation Address', 'congregation_address', 'congregation', 'side', 'default');
}

// The Congregation Address Metabox 
function congregation_address() {
    global $post;
    // Noncename field
     wp_nonce_field( plugin_basename( __FILE__ ), 'address_noncename' );
    // Get the first line of the address
    $address_line1 = get_post_meta($post->ID, '_address_line1', true);
    // Get second line of the address
    $address_line2 = get_post_meta($post->ID, '_address_line2', true);
    echo '<p>Address</p>';
    echo '<input type="text" name="_address_line1" value="' . $address_line1  . '" class="widefat" />';
    echo '<input type="text" name="_address_line2" value="' . $address_line2  . '" class="widefat" />';
    }

// Save the Metabox Data !! The error is in the wp_verify_nonce
function save_address_meta($post_id, $post) {
    // Verify Nonce
      if ( !wp_verify_nonce( $_POST['address_noncename'], plugin_basename(__FILE__) )) {
      return $post->ID;
      }
    // Check permissions
    if ( !current_user_can( 'edit_post', $post->ID ))
        return $post->ID;
    // Cycle through array
    $address_meta['_address_line1'] = $_POST['_address_line1']; //This is the line that explodes
    $address_meta['_address_line2'] = $_POST['_address_line2'];
    // Add values of custom fields
    foreach ($address_meta as $key => $value) { // Cycle array!
        if( $post->post_type == 'revision' ) return; 
        $value = implode(',', (array)$value); 
        if(get_post_meta($post->ID, $key, FALSE)) { 
            update_post_meta($post->ID, $key, $value);
        } else { 
            add_post_meta($post->ID, $key, $value);
        }
        if(!$value) delete_post_meta($post->ID, $key); 
    }
}

Any help is appreciated!

Answer 1

It is probably here:

if ( !wp_verify_nonce( $_POST['address_noncename'], plugin_basename(__FILE__) )) {
  return $post->ID;
}

You are using $_POST['address_noncename'] but aren't checking to see if it exists before you do. That is going to trigger the warning you mentioned about an "undefined index". If that warning prints to the screen before the headers are sent, you get the header error. Try:

if ( !isset($_POST['address_noncename']) || !wp_verify_nonce( $_POST['address_noncename'], plugin_basename(__FILE__) )) {
  return $post->ID;
}

That will return $post->ID; if the nonce field is not set or if the nonce is invalid. That may not be the exact logic you want but that is the kind of check you need to avoid that avoid the warning and the header error.