不朽的情缘是哪里的游戏

書名： WordPress Plugin Development Beginner's Guide
作者名： Vladimir Prelovac
本章字數(shù)： 239字
更新時間： 2021-05-21 20:12:22

Time for action – Add a security nonce

Open the wp-live-blogroll.js.php file and add create a nonce at the beginning of the script:

  function WPLiveRoll_ScriptsAction() 
        {
          global $wp_live_blogroll_plugin_url;
          if (!is_admin())
          {
            // create a nonce
            $nonce = wp_create_nonce('wp-live-blogroll');

            wp_enqueue_script('jquery');
            wp_enqueue_script('wp_live_roll_script', 
            $wp_live_blogroll_plugin_url.'/wp-live-blogroll.js', 
            array('jquery'));
        
          }
        }

Modify the Ajax call to include the generated nonce as an additional parameter:

   $.ajax({
      type: "GET",
      url: LiverollSettings.plugin_url + '/wp-live-blogroll-ajax.php',
      timeout: 3000,                    
      data: {
         link_url: this.href,
 _ajax_nonce: '<?php echo $nonce; ?>'
       },       
       success: function(msg) {

Modify wp-live-blogroll-ajax.php and add this check at the beginning of Ajax handler function:

       function WPLiveRoll_Handle ajax($link_url)
        {
            // check security
            check_ajax_referer( "wp-live-blogroll" );

With this simple modification, we have made sure that our Ajax handling script is used only when our plugin calls it.

What just happened?

When our script is run the next time, a unique nonce is created using the wp_create_nonce() function. We use a nonce identifier as a parameter:

    $nonce = wp_create_nonce( 'wp-live-blogroll' );

We then pass this nonce as the Ajax_nonce parameter. WordPress checks this parameter automatically in the check_ajax_referer function, which also uses the nonce identifier parameter:

        check_ajax_referer( "wp-live-blogroll" );

If the check fails, the script will simply exit at that point (internally, die(-1) happens).

Note

Quick reference

wp_create_nonce(nonce_id): It creates a unique nonce using the identifier.

check_ajax_referer(nonce_id): It is used to check Ajax nonces; passed as the ajax_nonce parameter, using the nonce identifier.

To read more about possible security implication and Cross-Site Request Forgery (CSRF), visit http://en.wikipedia.org/wiki/Cross-site_request_forgery.

官术网_书友最值得收藏!

WordPress Plugin Development Beginner's Guide

Time for action – Add a security nonce

What just happened?

Note