Hot answers tagged

15

TL;DR In short, wp_verify_nonce() uses that value because it expects that value as its first argument. wp_verify_nonce() arguments wp_verify_nonce() receives 2 arguments: $nonce $action The value in the hidden field ('cabfd9e42d' in your example) represent the $nonce. 1st argument is the nonce, and comes from the request In fact, wp_verify_nonce() ...


11

In WordPress, nonces are specific to the user, the action being performed, and the time. With regards to time, a nonce is valid for 24 hours, and changes every 12 hours. This is considered an acceptable trade-off, since using a real number-used-once would involve adding a tracking system and having storage of the used nonces. Nonces are also hashed, and so ...


11

Short answer: No. You can use normal strings for actions, md5'ing them doesn't change anything. The nonce is built from three main pieces of information: Time: The current time() divided by 43200 is worked into the nonce. This is what lets the nonce be changed every 12 hours (43200 seconds in 12 hours). The action string you provide. More on this below. ...


10

Now I got it! WordPress is just awesome. Also Thank you knif3r, your suggestions help me lot. I am trying to explain it in my words. Please correct me, if I am wrong. What is nonce? Nonce is something like security hash to prevent attacks and mistakes. It creates unique identifiers to check if the ajax request is coming from website or not. In WordPress ...


8

If you are an advanced user, check if you forgot to pass the wp_rest nonce that, ultimately, makes the global $current_user be the user that sent the request. If you are an intermediate user who wants to know how to use the REST class, continue reading: You should pass the special wp_rest nonce as part of the request. Without it, the global $current_user ...


7

Use the following code inside just before tag on your front end code. wp_nonce_field('name_of_your_action', 'name_of_your_nonce_field'); The above code will generate two hidden inputs inside your form tag. Now you can verify your nonce in the backend where you will process your form. Use the following code to verify the nonce you just created above. if(...


7

These are your problem lines: if ( $_POST && !wp_verify_nonce($_POST['at_nonce'], __FILE__) ) { return; } You check to see that $_POST is set, but you don't check $_POST['at_nonce']. If $_POST is set but that key is not then you will get a Notice. It is a simple fix: if ( isset($_POST['at_nonce']) && !wp_verify_nonce($_POST['at_nonce'],...


7

You need to pass the action to check your nonce against, wp_verify_nonce has two parameters. if($_POST && wp_verify_nonce($_REQUEST['test_slider_options_nonce'],'test_slider_action')) echo "TEST";


7

I think required would mean that "it doesn't work without it". It will work, but the question is of security and best practices. Even if it doesn't seem necessary, it's better to play in the safe side and do it always. You have to enqueue your JavaScript like bellow, passing PHP values (like the admin Ajax URL and the nonce) with wp_localize_script. ...


7

Your problem is that you call wp_logout_url immediately after wp_set_auth_cookie. wp_set_auth_cookie() does some setcookie() calls. Unfortunately setcookie doesn't make the new value available instantly in the PHP global $_COOKIE. It must be set through a new HTTP Request first. wp_logout_url() (via wp_nonce_url > wp_create_nonce > wp_get_session_token > ...


7

Difficult to say for sure where the mistake is as you have not mentioned about your add_action('wp_ajax_my_function','whatever_callback');which I think you missed out on that. But your question is missing info in this respect. This is how I would get on about this: In your functions.php file or similar: add_action(wp_ajax_handle_login, 'handle_login_ajax')...


7

The problem with expiring a nonce is that in WordPress, nonces aren't nonces in the purest sense of the term: "number used once." Rather, a WP nonce is a (substring of a) hash of a string involving a time signature at the moment it was generated, among other things: user ID, the action name and your php session token. As such, once generated, it is what it ...


7

I think the problem was that I manually deleted my cookies a few times while testing. Among them was a cookie called "wordpress_logged_in_{token}" where {token} is an unique identifier. My best guess is that lack of this cookie caused issues with nonce creation or/and verification. It was hard to notice because I was still able to browse the admin panel (it ...


7

The REST API included in WordPress doesn't actually have authentication built into it. If you do normal authentication in WordPress by logging in, then your browser will receive a set of cookies. If you send those cookies along with your request, then that will authenticate you to perform the actions in question. If you need to add authentication for an ...


6

You are not inserting the nonce field in your form, so your script won't recieve the nonce field and this code: if ( !isset($_POST['nonce_name'])) Will be validated becasue $_POST['nonce_name'] is not set. In your code, remove this line: <input type='hidden' value='".wp_nonce_field('nonce_action','nonce_name')."'/> And, where it said //TODO: set ...


6

Here's a very lengthy answer of my own question that goes beyond just addressing the question of generating unique nonces for subsequent Ajax requests. This is an "add to favorites" feature that was made generic for the purposes of the answer (my feature lets users add the post IDs of photo attachments to a list of favorites, but this could apply to a ...


6

jQuery is a js library not a transport protocol, your data is sent via GET or POST, wether you use jquery or not. Think of it like this, sometimes it's the user in the first frame, sometimes it's javascript: Firstly nonces are not the same as sanitisation, they have different purposes Sanitisation is about verifying what the source says is in the correct ...


6

If you read Wordpress Nonces in Codex, they have explained it pretty fairly. some of the key points are: always assume Nonces can be compromised. Nonces are a hash made up of numbers and letters. Wordpress Verifies any https request with both nonces and user cookies. I believe point #3 is, in short, is how it works with WordPress. They have mentioned that ...


5

1, the nonce lifetime is about 24 hours by default actually. take a look at wp_verify_nonce function. To be more accurate, the lifetime is controlled by filter apply_filters( 'nonce_life', DAY_IN_SECONDS ); 2, if the lifetime value makes you doubt if it is "an implementation side-effect", you may want to add_filter('nonce_life',create_function('$v', '...


5

Just use get_delete_post_link( $post_ID ) - it'll return the absolute URL with nonce and all! Just to be clear, this will get the link to trash posts (if trash supported). If you want to skip trash & get the perma-delete link, pass a second argument of true*. http://codex.wordpress.org/Function_Reference/get_delete_post_link Update: Having checked the ...


5

You could also hook the submit box that never dissapears adding the nonce field to it add_action( 'post_submitbox_start', 'theme_submitdiv_extra' ); function theme_submitdiv_extra() { wp_nonce_field( 'theme_meta_box_nonce', 'meta_box_nonce' ); } Then, in your save_post action: if( !isset( $_POST['meta_box_nonce'] ) || !wp_verify_nonce( $_POST['...


4

This issue arrises because of a couple of problems: 1) WP_List_Table::search_box() inserts the default _wpnonce and _wp_http_referer fields by using wp_nonce_field() without giving you the ability to override and say "I've already go a nonce field thanks". 2) You need to use GET as your method of form submission when subclassing WP_List_Table because ...


4

To add a nonce to a form you can use the following function: wp_nonce_field($action, $name, $referer, $echo) $action = (optional) this is a string which represents the action name $name = (optional) this is a string which represents the name of the nonce. If you leave this field blank WordPress will default to “_wpnonce” Example: Frontend: <form ...


4

Nonces are one time use limited life unique numbers. You can clone them but the problem you'll see is that once sent back to the server and validated, the other clones will become invalid. You have a few ways to handle this. Generate all your boxes on the server and discard the Javascript. Use Ajax to request a new nonce for each cloned box. My preferred ...


4

No, not really. You're assuming the function that called wp_insert_post() has already performed those checks. But wp_insert_post() may be used in other pages too, not just the edit page, by plugins, or even themes (many of them with security holes). That's why you should ensure that your code runs only where you want to by using the nonce. Ok I'm editing ...


4

It should be action instead of "doaction", then it will work just fine. As for your request for some documentation, as far as I know there is no overview about parameters/actions available at edit.php. So lets do some source code inspection, as you said yourself, you have gotten the inpiration for your approach from the edit.php, so we start there. You have ...


4

You might be a little confused as to the purpose and function of nonces in WordPress. Recommended reading: WordPress Nonces An Introduction to WordPress Nonces with Examples Protect_Queries_Against_SQL_Injection_Attacks A nonce is a "number used once" to help protect URLs and forms from certain types of misuse, malicious or otherwise. Nonces help you ...


4

You need to call like below. API call:- http://78.47.177.214/blog/api/get_nonce/?json=get_nonce&controller=posts&method=create_post Responce:- {"status":"ok","controller":"posts","method":"create_post","nonce":"92f31d49b5"}


4

After some fiddling and sparring with @t-todua I found the issue: With the Fetch API fetch call you must manually set to send cookies with a request. After setting the credentials option properly the cookies were sent and the AJAX endpoint recognized the current user. So the JS becomes: var msg = ''; // I'm using the whatwg-fetch polyfill and a polyfill ...


4

Sanitizing is required when you are inserting user input into Database or outputting it in HTML etc. Here, you are simply doing a String comparison. wp_verify_nonce function checks $nonce value like this: if ( hash_equals( $expected, $nonce ) ) { return 1; } For this you don't need sanitizing. So the following is fine: wp_verify_nonce( $_GET['...


Only top voted, non community-wiki answers of a minimum length are eligible