New answers tagged


I had one more look at the code and I realized the save function was missing couple of checks. So replace meta_boxes.php:366 with this, if ( empty( $_POST['nonce_car_details'] ) ) { return; } check_admin_referer( 'save_car_details_meta', 'nonce_car_details' ); if ( ! current_user_can( 'edit_post', $post_id ) ) { return; } if ( wp_is_post_autosave( $...


The API handles the nonce for the form part because you're using the settings_fields call, which outputs the *-options nonce, and you're passing the data to the options.php file for saving, which checks that nonce for you before saving the settings. This part the Settings API does indeed do for you. However, your tab code is not in that form. It's just ...


This is proper warning. No API takes care about nonce. You have to use verify_nonce() or check_admin_referer() before reading from $_GET or $_POST. And it is better to use the full set of coding standards, named simply WordPress, which includes Core, Docs, and Extra.


Based on the authentication documentation here - a nonce key needs to be passed with each request. So if the nonce key is being cached on the frontend beyond its lifespan, you will need to hook into the API request before the authentication step and replace the cached nonce key with a valid one. WordPress provides a rest_send_nocache_headers filter for ...

Top 50 recent answers are included