Questions tagged [nonce]

The tag has no usage guidance.

47 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
3
votes
0answers
365 views

WordPress REST API call generates nonce twice on every call

I'm trying to login a user via the REST API, and then retrieve the current user on subsequent requests. As per the documentation, in my plugin, I am creating and retrieving a nonce after a successful ...
3
votes
0answers
862 views

WordPress “Link has expired” error on updating posts

I'm maintaining a WordPress site on GoDaddy for a client and they started to get the "this link has expired error" when they saved a post. It does not happen when I upload a file. However, I am ...
2
votes
1answer
718 views

Why does Wordpress Heartbeat login not refresh the nonces?

Here's an interesting experiment: Go to wordpress plugins listing page, notice the activate, deactivate links all have a nonce part in the request. In a second tab, log out of the site, and go back ...
1
vote
0answers
28 views

x-wp-nonce across domains

I've installed WPML with a multiple domain configuration (one domain per language). The wrong thing is that, when editing for example a post while using a different domain from the main, it just ...
1
vote
0answers
32 views

Is nonce in PHP form and Ajax both necessary?

I have a php form which is submitted through jQuery Ajax. Previously i had used nonce with Ajax and PHP form seperately. Here i am using wp_nonce_field() in PHP form. Is it necessary to use ...
1
vote
0answers
80 views

wp_create_nonce doesn't verify when using WP_List_Table

I've created an admin page where I'm displaying a list of a MySQL Table using WP_List_Table. In this table I need to be able to delete a record when I want to. And that's where I have a problem. To ...
1
vote
0answers
15 views

Why ajax doesn't work on certain wordpress hooks and reload the page instead?

I built an ajax function which works perfectly when i hook it to admin_head or admin_notices hooks but it doesn't work when i hook it to manage_posts_extra_tablenav hook, instead of doing the ajax ...
1
vote
0answers
26 views

Why ajax doesn't work on certain wordpress hooks?

I built an ajax function which works perfectly when i hook it to admin_head or admin_notices hooks but it doesn't work when i hook it to manage_posts_extra_tablenav hook, instead of doing the ajax ...
1
vote
1answer
271 views

“The link you followed has expired” when previewing a post

Recently, I believe after switching to WP 5, non admin users are randomly getting the following error when previewing a post: “The link you followed has expired” . Please try again I am suspecting ...
1
vote
0answers
92 views

Wordpress password reset - why post rp_key?

I'm developing a plugin and after reading through wp-login.php, I can't seem to work out why some things are done the way they are. Why does WordPress hide the reset password key from the URL? After ...
1
vote
0answers
416 views

Full page NGINX (or Cloudflare) caching and WordPress nonces

Goal: I want to cache the full WordPress response via NGINX and exclusively use the REST API for the user specific parts. Issue: I can't get an authenticated nonce to use against the API. My plan ...
1
vote
1answer
848 views

wp_create_nonce() in REST API makes user->ID zero

I have trouble with wp_create_nonce() and wp_verify_nonce(). The root of my problem is both the way nonces are created and the place where I generate nonces. Looking at the codes of wp_create_nonce()...
1
vote
0answers
379 views

Encountering “Wrong nonce. Action prohibitied.” when trying to alter User Role and unable to Post via WP Admin

The plugin in question that I believe is displaying this message is the User Role Editor, although I do not believe it is causing the issue as users who should have permissions to make posts on the ...
1
vote
0answers
60 views

Is there value in using a wp_nonce for POST requests?

All of the examples I see using wp_create_nonce are in the context of a GET request. You embed a nonce in URLs to ensure malicious links or scripts can't trick a user into, say, deleting a post. ...
1
vote
1answer
976 views

Maximum lifetime for nonce

In our project we allow users to buy a coupon ( WooCommerce product ) for some service. We save every coupon as a custom post type with all the customer data inserted during purchase. We then via ...
1
vote
0answers
40 views

Nonce fails on ajax save

I have made options page with 2 forms and two separate nonce fields, and other input fields that I save with AJAX. The issue is that every time I save and call my function to save options via AJAX I ...
1
vote
1answer
540 views

Can you have more than one nonce on a page?

I have a site with a page where there's one form in the sidebar, and one in the main body of the page. The sidebar comes first in the HTML. Both forms have their own nonces (generated with ...
1
vote
0answers
457 views

Bypass nonce value while trashing a post

I want to move a post in trash but the condition is that simultaneously I need to delete some more posts. Sample Code: jQuery(function($) { $('#delete-action a').unbind(); $('#delete-action a'...
1
vote
0answers
103 views

My custom write panels won't save data. What am I missing?

So far I've been reading some tutorials about ways to create Custom Write Panels. It seems that none of them will really work without some bug. I'd like to discuss one of those tuts here: http://www....
0
votes
0answers
15 views

Is a global nonce a bad idea?

I'm trying to build a central system that will delegate certain functionality and serve me some nice things when dealing with AJAX calls. Basically, I want to dumb the whole charade of checking ...
0
votes
0answers
25 views

Nonce timing out when cache is in use

I have implemented a plugin that allows an individual to search data that is available from the plugin and receive a list of results back from that search. Searching is the only act that can be ...
0
votes
0answers
18 views

whether a nonce is required for get type and get_query_var?

I have a front form that allows filtering. I think I need a nonce but I am not sure to use it or not. I use the get_query_var method to modify the main query. It uses a get method. whether a nonce is ...
0
votes
0answers
26 views

Unable to update plugins or log out

The server my site was hosted on recently went down and someone else was able to fix it for me. I am unclear on what exactly the issues with the server were, but since the site came back up, my cron ...
0
votes
0answers
20 views

Does it make sense to check a nonce on user log in?

I read the following blog post about implementing custom user log in: http://natko.com/wordpress-ajax-login-without-a-plugin-the-right-way/ In the post, the author walks through some PHP code for ...
0
votes
1answer
31 views

Custom Meta Boxes - Nonce Issue - Move to trash issue

Recently after updating Wordpress from 4.9.2 to 5.2, I have had to change a good bit of code to get my custom post type listings(or posts) to function and save data correctly. Specifically, with the ...
0
votes
0answers
26 views

expired link error on front end

I have a custom form which I am using to save post meta but upon submission it is displaying this error. I have a form like this <form action="<?= site_url() ?>/?action=edit&job=<?...
0
votes
0answers
28 views

wp_verfy_nonce keeps giving false

i have a form somthing like this <form id="sample_docs" method="post" action="<?php echo admin_url('admin-ajax.php'); ?>"> <?php wp_nonce_field('nonce_action_sample_docs', '...
0
votes
0answers
19 views

Nonce - reissue with ajax poll

I have a plugin which displays a map with markers. Using SetInterval I am refreshing the markers at a pre-determined interval using an ajax call. It is only reading data, no updates. I am using a ...
0
votes
2answers
224 views

Serving nonces through AJAX is not refreshing nonce, returning 403 error

I have run into an issue with nonces becoming invalid, and being unable to refresh to a new nonce. In my example I have a Facebook Connect button, and a Facebook Disconnect button, each with their own ...
0
votes
1answer
63 views

How to check nonce lifetime value of plugins?

Dear StackExchange users, I currently use the premium version of WP Fastest Cache Premium. My website loads very fast, but I always get a 403 error for wp-admin/ajax. I believe there is a plugin ...
0
votes
0answers
97 views

wp_nonce_url generating invalid links

My goal is to allow users to delete posts they own from the front end. I have an API that returns some JSON along with a link to delete their post. $delLink = wp_nonce_url( site_url() . "/wp-admin/...
0
votes
1answer
79 views

Override plugin function to show invoices even if not logged in

I am using WooCommerce Print Invoice plugin to print invoices. Now I am working on a Cordova app for my website and I need to be able to see invoices from wordpress. Plugin has a function to hide or ...
0
votes
0answers
49 views

How can I verify WordPress nonce from the following code?

<?php /** * Template Name: Manage Days */ if ( isset($_GET['remove_date']) && isset($_GET['_wpnonce']) ) { $delete_date = $_GET['remove_date']; $delete_nonce = $_GET['_wpnonce']; ...
0
votes
0answers
1k views

AJAX form not working, still reloads on submit

I've built a like and unlike system for users, and it works amazingly. The only problem is the page reloads, therefore, I've tried to set up AJAX to submit the form without a page refresh. However, it'...
0
votes
0answers
91 views

Passing nonce at admin menu link

I'm trying to pass a nonce at the links created from my plugin using add_menu_page and add_submenu_page. Of course this is invalid: add_submenu_page( 'my_dashboard', 'Dashboard', 'Dashboard', '...
0
votes
0answers
530 views

Are nonces in WP REST API optional by default?

I'm switching my code from using wp-ajax to the REST API and got puzzled regarding the nonces. First of all, I find it weird that you have to use wp_rest only, since API has many different methods and ...
0
votes
0answers
316 views

CSRF attack to create USER

I'm looking for to fix the issue below : The following scenario show a successful CSRF attack resulting in the creation of a new user on wordpress: The attacker sends malicious html page to an ...
0
votes
1answer
334 views

Register rest field authentication with REST API

I'm trying to add some user meta information to the existing wp/v2/users REST endpoint. However, it looks like additional authentication is required, i.e. I get this (output in comments): ...
0
votes
0answers
881 views

wp_verify_nonce fails always

I have created nonce fro my plugin and trying to verify it with another plugin pages. it fails always. both we are creating nonce with same parameter. why it fails. Plugin name : Wordfence it creates ...
0
votes
1answer
141 views

Nonce and widget

I've been screening the code of several widget and haven't found any one of them handling nonce. I also took a look at the WP_Widget class and found nothing about it as well. This is from the codex: (...
0
votes
1answer
346 views

Nonce fail after second submit attempt

I am refactoring my plugin that resets the WordPress database tables back to their defaults and came across an issue. The form submission itself works fine. However, after the first submit, and if ...
0
votes
1answer
453 views

custom metabox nonce verification fails

I'm adding a metabox on a custom post type and my nonce-verification fails. I'm not really where to look for why it's going wrong. Can anyone point me in the right direction? Here's my code: function ...
0
votes
0answers
827 views

How to use nonces for frontend AJAX voting if the page gets cached?

I'm building a custom voting solution for my site that would allow public AJAX voting on multiple posts per page. Votes can be added/changed/revoked. Values are stored in custom post meta. I ...
0
votes
0answers
535 views

Create nonce in frontend page to edit profile

I am trying to create a frontend edit profile form that mimics the wp-admin backend edit profile. I created the form as HTML directly in a WordPress page (I'm a PHP/WordPress beginner, so I don't know ...
0
votes
0answers
226 views

when saveing $meta_box i get Undefined index error

I need help to fix these Notices: PHP Notice: Undefined index: person-name in testimonials.php on line 112 PHP Notice: Undefined index: position in testimonials.php on line 112 PHP Notice: Undefined ...
0
votes
1answer
309 views

Using Nonce for my Form

Essentially I need to verify my data using a nonce, but I'm not sure that I'm doing it right. What I'm trying to do is remove a menu option for a user that isn't an admin. If a checkbox is checked and ...
-1
votes
0answers
16 views

Easy Digital Downloads Purchase Link not working

I am using Easy Digital Downloads plugin to sell some digital products. However, I am facing an issue when I use the Purchase Link on ajax. If I use ajax filter and filter the products then the ...