validation - Do I need to validate the nonce when using the settings api?

admin管理员组

文章数量:1122797

I have been developing a plugin.

When using the 'Plugin Check' Wordpress plugin to check it before submission, it gave me a warning that 'Processing form data without nonce verification.'

Do I need to validate the nonce when using the settings api to create forms in the admin dashboard?

It has sent me on a wild goose chase without finding it explicitly stated, whether I should or not.

I have been developing a plugin.

When using the 'Plugin Check' Wordpress plugin to check it before submission, it gave me a warning that 'Processing form data without nonce verification.'

Do I need to validate the nonce when using the settings api to create forms in the admin dashboard?

It has sent me on a wild goose chase without finding it explicitly stated, whether I should or not.

• settings-api
• validation
• nonce

Share Improve this question asked May 17, 2024 at 10:15 dading84dading84 10111 bronze badge

Add a comment  | 

1 Answer 1

Sorted by: Reset to default 0

As mentioned I wasn't able to find it explicitly mentioned, although it was implied in some articles, that it was being done.

When using the settings_fields( string $option_group ) wordpress function you can see from the source code that it includes a nonce field:

https://developer.wordpress.org/reference/functions/settings_fields/

function settings_fields( $option_group ) {
    echo "<input type='hidden' name='option_page' value='" . esc_attr( $option_group ) . "' />";
    echo '<input type="hidden" name="action" value="update" />';
    wp_nonce_field( "$option_group-options" );
}

I finally realised that if I changed the value of this nonce in the dev tools in the browser to another value and submitted the form then if it were being validated it should fail.

This was the case giving me a 403 response and a message that 'The link you followed has expired.'

So I was reassured that the settings api does in fact validate this nonce and the warning in the Plugin Check was unnecessary.

I was surprised it was not more clearly mentioned in the docs or previous questions on here (or at least I couldn't find by googling), I hope that this saves someone else some time! :-S

本文标签： validationDo I need to validate the nonce when using the settings api