plugins - Nonce failing on form submission

admin管理员组

文章数量:1309947

I'm updating some code in one of my WordPress plugins by adding a nonce to improve security. The plugin that has a form that generates some output that the user can copy and paste as a shortcode. At the bottom of the settings form I have a second form that resets the first form to its defaults.

As the headline says, the nonce keeps failing.

<?php
/**
 * Form reset.
 *
 * @package Foobar/foobar
 */

// $parent and $token construct the page slug. Settings form and these variables omitted for clarity.

$html  = '<form id="my-reset" name="my-reset" method="post" action="options-general.php?page=' . $this->parent->token . '&tab=generator">';
$html .= wp_nonce_field( 'options-general.php?page=' . $this->parent->token . '&tab=generator', 'my_reset_nonce' );
$html .= '
  <p class="submit"><input name="reset" class="button button-secondary" type="submit" value="' . esc_html__( 'Reset the Shortcode Generator', 'textdomain' ) . '" >
        <input type="hidden" name="action" value="reset" />
    </p>
</form>';

if ( isset( $_POST['reset'] ) ) {
    if ( ! wp_verify_nonce( 'options-general.php?page=' . $this->parent->token . '&tab=generator', 'my_reset_nonce' ) ) {
        die( esc_html__( 'Invalid nonce. Form submission blocked!', 'textdomain' ) );
    } else {
        // Logic to reset the settings form.
    }
};

Any help appreciated.

I'm updating some code in one of my WordPress plugins by adding a nonce to improve security. The plugin that has a form that generates some output that the user can copy and paste as a shortcode. At the bottom of the settings form I have a second form that resets the first form to its defaults.

As the headline says, the nonce keeps failing.

<?php
/**
 * Form reset.
 *
 * @package Foobar/foobar
 */

// $parent and $token construct the page slug. Settings form and these variables omitted for clarity.

$html  = '<form id="my-reset" name="my-reset" method="post" action="options-general.php?page=' . $this->parent->token . '&tab=generator">';
$html .= wp_nonce_field( 'options-general.php?page=' . $this->parent->token . '&tab=generator', 'my_reset_nonce' );
$html .= '
  <p class="submit"><input name="reset" class="button button-secondary" type="submit" value="' . esc_html__( 'Reset the Shortcode Generator', 'textdomain' ) . '" >
        <input type="hidden" name="action" value="reset" />
    </p>
</form>';

if ( isset( $_POST['reset'] ) ) {
    if ( ! wp_verify_nonce( 'options-general.php?page=' . $this->parent->token . '&tab=generator', 'my_reset_nonce' ) ) {
        die( esc_html__( 'Invalid nonce. Form submission blocked!', 'textdomain' ) );
    } else {
        // Logic to reset the settings form.
    }
};

Any help appreciated.

• plugins
• errors
• security
• nonce

Share Improve this question edited Jan 7, 2021 at 18:32 Chris J. Zähller asked Jan 6, 2021 at 22:57 Chris J. ZähllerChris J. Zähller 9111 silver badge99 bronze badges 2

• 1 Have you read developer.wordpress/reference/functions/wp_nonce_field – shanebp Commented Jan 6, 2021 at 23:19
• Yes. That's how I figured out this code. FWIW I've also tried $nonce = $_REQUEST['_wpnonce']; if ( ! wp_verify_nonce( $nonce, 'options-general.php?page=' . $this->parent->token . '&tab=generator', 'my_reset_nonce' ) ) { // Error. } – Chris J. Zähller Commented Jan 7, 2021 at 17:12

Add a comment  | 

1 Answer 1

Sorted by: Reset to default 0

Okay, not sure what was wrong with my original code, but this post put me on the right path.

To generate the nonce, use:

wp_nonce_field( plugin_basename( __FILE__ ), 'my_reset_nonce',true,false);

To verify, use:

if ( ! isset( $_POST['my_reset_nonce'] ) || ! wp_verify_nonce( ( $_POST['my_reset_nonce'] ), plugin_basename( __FILE__ ) ) ) {
    die;
} else {
    // Reset the form.
}

Various other variables, conditionals, sanitizing, etc. omitted for clarity.

本文标签： pluginsNonce failing on form submission