Changeset 8220 for sites/trunk/wordcamp.org/public_html/wp-content/plugins/wcpt/wcpt-event/class-event-admin.php

Timestamp:

02/11/2019 03:43:41 PM (6 years ago)

Author:

iandunn

Message:

WordCamp Post Type: Bypass nonce verification when saving programatically.

Nonce verification was added to the save_post callback for WordCamp/Meetup post types in r8085. That had the side-effect of breaking the process of manually sending Organizer Reminders, because that process saves data to the corresponding WordCamp post. Because the save_post callback is called programatically in that scenario, there is no nonce to verify, and the Unable to verify nonce. error would be triggered.

We previously attempted to fix this in r8133 / r8135, but it turns out that the problem was the missing nonce rather than the post type check.

File:

• sites/trunk/wordcamp.org/public_html/wp-content/plugins/wcpt/wcpt-event/class-event-admin.php (modified) (2 diffs)

sites/trunk/wordcamp.org/public_html/wp-content/plugins/wcpt/wcpt-event/class-event-admin.php

@@ -403 +403 @@
 
     /**
-     * Save metadata from form
+     * Save metadata from form.
+     *
+     * @param int     $post_id      The ID of the post being saved.
+     * @param WP_Post $post         The post being saved.
+     * @param bool    $verify_nonce Whether or not to verify the nonce. Set to false when calling manually, leave
+     *                              true when calling via `save_post` hook.
      *
      * @hook save_post
      */
-    public function metabox_save( $post_id, $post ) {
+    public function metabox_save( $post_id, $post, $verify_nonce = true ) {
         // Don't add/remove meta on revisions and auto-saves.
         if ( wp_is_post_autosave( $post_id ) || wp_is_post_revision( $post_id ) ) {
@@ -418 +423 @@
 
         // Make sure the request came from the edit post screen.
-        if ( empty( $_POST['_wpnonce'] ) || ! wp_verify_nonce( $_POST['_wpnonce'], 'update-post_' . $post_id ) ) {
-            die( 'Unable to verify nonce' );
+        if ( $verify_nonce ) {
+            if ( empty( $_POST['_wpnonce'] ) || ! wp_verify_nonce( $_POST['_wpnonce'], 'update-post_' . $post_id ) ) {
+                wp_die( 'Unable to verify nonce.' );
+            }
         }