Hot answers tagged

19

Now I got it! WordPress is just awesome. Also Thank you knif3r, your suggestions help me lot. I am trying to explain it in my words. Please correct me, if I am wrong. What is nonce? Nonce is something like security hash to prevent attacks and mistakes. It creates unique identifiers to check if the ajax request is coming from website or not. In WordPress ...


15

TL;DR In short, wp_verify_nonce() uses that value because it expects that value as its first argument. wp_verify_nonce() arguments wp_verify_nonce() receives 2 arguments: $nonce $action The value in the hidden field ('cabfd9e42d' in your example) represent the $nonce. 1st argument is the nonce, and comes from the request In fact, wp_verify_nonce() ...


11

Short answer: No. You can use normal strings for actions, md5'ing them doesn't change anything. The nonce is built from three main pieces of information: Time: The current time() divided by 43200 is worked into the nonce. This is what lets the nonce be changed every 12 hours (43200 seconds in 12 hours). The action string you provide. More on this below. ...


9

Use the following code inside just before tag on your front end code. wp_nonce_field('name_of_your_action', 'name_of_your_nonce_field'); The above code will generate two hidden inputs inside your form tag. Now you can verify your nonce in the backend where you will process your form. Use the following code to verify the nonce you just created above. if(...


8

If you are an advanced user, check if you forgot to pass the wp_rest nonce that, ultimately, makes the global $current_user be the user that sent the request. If you are an intermediate user who wants to know how to use the REST class, continue reading: You should pass the special wp_rest nonce as part of the request. Without it, the global $current_user ...


7

Your problem is that you call wp_logout_url immediately after wp_set_auth_cookie. wp_set_auth_cookie() does some setcookie() calls. Unfortunately setcookie doesn't make the new value available instantly in the PHP global $_COOKIE. It must be set through a new HTTP Request first. wp_logout_url() (via wp_nonce_url > wp_create_nonce > wp_get_session_token > ...


7

You need to pass the action to check your nonce against, wp_verify_nonce has two parameters. if($_POST && wp_verify_nonce($_REQUEST['test_slider_options_nonce'],'test_slider_action')) echo "TEST";


7

I think required would mean that "it doesn't work without it". It will work, but the question is of security and best practices. Even if it doesn't seem necessary, it's better to play in the safe side and do it always. You have to enqueue your JavaScript like bellow, passing PHP values (like the admin Ajax URL and the nonce) with wp_localize_script. ...


7

Difficult to say for sure where the mistake is as you have not mentioned about your add_action('wp_ajax_my_function','whatever_callback');which I think you missed out on that. But your question is missing info in this respect. This is how I would get on about this: In your functions.php file or similar: add_action(wp_ajax_handle_login, 'handle_login_ajax')...


7

The problem with expiring a nonce is that in WordPress, nonces aren't nonces in the purest sense of the term: "number used once." Rather, a WP nonce is a (substring of a) hash of a string involving a time signature at the moment it was generated, among other things: user ID, the action name and your php session token. As such, once generated, it is what it ...


7

I think the problem was that I manually deleted my cookies a few times while testing. Among them was a cookie called "wordpress_logged_in_{token}" where {token} is an unique identifier. My best guess is that lack of this cookie caused issues with nonce creation or/and verification. It was hard to notice because I was still able to browse the admin panel (it ...


7

The REST API included in WordPress doesn't actually have authentication built into it. If you do normal authentication in WordPress by logging in, then your browser will receive a set of cookies. If you send those cookies along with your request, then that will authenticate you to perform the actions in question. If you need to add authentication for an ...


6

You are not inserting the nonce field in your form, so your script won't recieve the nonce field and this code: if ( !isset($_POST['nonce_name'])) Will be validated becasue $_POST['nonce_name'] is not set. In your code, remove this line: <input type='hidden' value='".wp_nonce_field('nonce_action','nonce_name')."'/> And, where it said //TODO: set ...


6

jQuery is a js library not a transport protocol, your data is sent via GET or POST, wether you use jquery or not. Think of it like this, sometimes it's the user in the first frame, sometimes it's javascript: Firstly nonces are not the same as sanitisation, they have different purposes Sanitisation is about verifying what the source says is in the correct ...


6

To add a nonce to a form you can use the following function: wp_nonce_field($action, $name, $referer, $echo) $action = (optional) this is a string which represents the action name $name = (optional) this is a string which represents the name of the nonce. If you leave this field blank WordPress will default to “_wpnonce” Example: Frontend: <form ...


6

If you read Wordpress Nonces in Codex, they have explained it pretty fairly. some of the key points are: always assume Nonces can be compromised. Nonces are a hash made up of numbers and letters. Wordpress Verifies any https request with both nonces and user cookies. I believe point #3 is, in short, is how it works with WordPress. They have mentioned that ...


5

You could also hook the submit box that never dissapears adding the nonce field to it add_action( 'post_submitbox_start', 'theme_submitdiv_extra' ); function theme_submitdiv_extra() { wp_nonce_field( 'theme_meta_box_nonce', 'meta_box_nonce' ); } Then, in your save_post action: if( !isset( $_POST['meta_box_nonce'] ) || !wp_verify_nonce( $_POST['...


5

NO! BEWARE !!! Don't count on check_admin_referer() without correct parameters! Because, in some cases it may not die() (as opposed to your expectations), instead it will just return the false response. Look through the outlined behavior of source code logic: function check_admin_referer( $action = -1, $query_arg = '_wpnonce' ) { $result = isset( $...


5

After some fiddling and sparring with @t-todua I found the issue: With the Fetch API fetch call you must manually set to send cookies with a request. After setting the credentials option properly the cookies were sent and the AJAX endpoint recognized the current user. So the JS becomes: var msg = ''; // I'm using the whatwg-fetch polyfill and a polyfill ...


5

Sanitizing is required when you are inserting user input into Database or outputting it in HTML etc. Here, you are simply doing a String comparison. wp_verify_nonce function checks $nonce value like this: if ( hash_equals( $expected, $nonce ) ) { return 1; } For this you don't need sanitizing. So the following is fine: wp_verify_nonce( $_GET['...


5

In order to ‘Register User’ or ‘Retrieve Password’, the authentication for a user with ‘Administrator’ role is required. While this is a delibrately done for security reasons, such implementation makes it very hard for Front End applications to implement a simple ‘Register’ or ‘Sign Up’ function. The simple solution is use this wp-rest-user plugin. This ...


5

Just add a filter: function change_menu($items){ foreach($items as $item){ if( $item->title == "Log Out"){ $item->url = $item->url . "&_wpnonce=" . wp_create_nonce( 'log-out' ); } } return $items; } add_filter('wp_nav_menu_objects', 'change_menu');


5

The "The link you followed has expired" message is in the function wp_nonce_ays on line 2607 of wp-includes/functions.php. Apparently, the message was changed from "Are you sure you want to do this?" in 4.9.5. The wp_nonce_ays function is called by check_admin_referer if the nonce check fails. This is the only place in the Wordpress code where this message ...


4

Nonces are one time use limited life unique numbers. You can clone them but the problem you'll see is that once sent back to the server and validated, the other clones will become invalid. You have a few ways to handle this. Generate all your boxes on the server and discard the Javascript. Use Ajax to request a new nonce for each cloned box. My preferred ...


4

This issue arrises because of a couple of problems: 1) WP_List_Table::search_box() inserts the default _wpnonce and _wp_http_referer fields by using wp_nonce_field() without giving you the ability to override and say "I've already go a nonce field thanks". 2) You need to use GET as your method of form submission when subclassing WP_List_Table because ...


4

No, not really. You're assuming the function that called wp_insert_post() has already performed those checks. But wp_insert_post() may be used in other pages too, not just the edit page, by plugins, or even themes (many of them with security holes). That's why you should ensure that your code runs only where you want to by using the nonce. Ok I'm editing ...


4

It should be action instead of "doaction", then it will work just fine. As for your request for some documentation, as far as I know there is no overview about parameters/actions available at edit.php. So lets do some source code inspection, as you said yourself, you have gotten the inpiration for your approach from the edit.php, so we start there. You have ...


4

Well, looks like I have found the answer. The action should be changed like so: $action = 'install-plugin'; $slug = 'akismet'; wp_nonce_url( add_query_arg( array( 'action' => $action, 'plugin' => $slug ), admin_url( 'update.php' ) ), $action.'_'.$slug ); The answer was found in line 275 in ...


4

You can localize your script and pass the nonce and ajax url to the script.Learn more about script localization. function wpse_206839() { // Register our script just like we would enqueue it - for WordPress references wp_register_script( 'my-special-script', 'directory/my-special-script.js', array( 'jquery' ), false, true ); // Create any ...


4

I have been having the same problems and I solved using another related ajax function: Just changing your check_ajax_referer( 'login_nonce', $_POST['security'], false ) to wp_verify_nonce( $_POST['security'], 'login_nonce' ) seems to work and return true / false correctly. About if it's more secure one way or other I have found this info: ...


Only top voted, non community-wiki answers of a minimum length are eligible