您没有在表单中插入nonce字段,因此脚本不会接收nonce字段和以下代码:
if ( !isset($_POST[\'nonce_name\']))
将进行验证,因为
$_POST[\'nonce_name\']
未设置。
在代码中,删除此行:
<input type=\'hidden\' value=\'".wp_nonce_field(\'nonce_action\',\'nonce_name\')."\'/>
还有,上面说
//TODO: set nonce
, 您需要包括:
$out .= wp_nonce_field( plugin_basename( __FILE__ ), \'nonce_name\',true,false);
注:设置
wp_nonce_field()
\'“echo”参数设置为false以检索nonce输入字段,而不是打印它。
然后通过以下方式进行验证:
if (!isset( $_POST[\'nonce_name\'] ) || ! wp_verify_nonce( $_POST[\'nonce_name\'], plugin_basename( __FILE__ ) ) )
return;
那么,你的
function get_form()
应为:
function get_form( $post_id=null, $tax=\'category\' ) {
if ( is_null($post_id) || ! taxonomy_exists($tax) )
return false;
$args = array( \'hide_empty\' => false );
$args = apply_filters( \'mcc_get_terms_args\', $args, $post_id, $tax );
$all_terms = get_terms( $tax, $args );
if ( ! $all_terms )
return false;
$post_terms = wp_get_object_terms( $post_id, $tax, array( \'fields\' => \'ids\' ) );
$permalink = get_permalink( $post_id );
$out = "<form id=\'crowd-cats\' action=\'$permalink\' method=\'POST\' >
<ul >";
foreach ( $all_terms as $t ) :
$checked = in_array( $t->term_id, $post_terms) ? \'checked\' : \'\';
$out .= "<li>
<input type=\'checkbox\' id=\'crowd-cat-$t->term_id\' name=\'crowd-cat-radio[]\' value=\'$t->term_id\' $checked />
<label for=\'crowd-cat-$t->term_id\' >".esc_attr($t->name)."</label>
</li>";
endforeach;
$out .= "</ul>
<input type=\'submit\' value=\'Submit\' name=\'crowd-cats-submit\'/>
<input type=\'hidden\' value=\'".esc_attr($tax)."\' name=\'crowd-cats-tax\'/>
<input type=\'hidden\' value=\'$post_id\' name=\'crowd-cats-pid\'/>";
$out .= wp_nonce_field( plugin_basename( __FILE__ ), \'nonce_name\',true,false);
$out .= "</form>";
return $out;
}
还有你的
function process_request()
应为:
function process_request(){
// check submission
if ( ! isset($_POST[\'crowd-cat-radio\']) || ! is_array($_POST[\'crowd-cat-radio\']) )
return;
if ( !isset($_POST[\'nonce_name\']) || !wp_verify_nonce($_POST[\'nonce_name\'],plugin_basename( __FILE__ )) )
{
print \'Sorry, your nonce did not verify.\';
exit;
} else { // continue to process form data
// sanitize and check the input
$suggested_terms = array_map( \'absint\', $_POST[\'crowd-cat-radio\'] );
$post_id = absint( $_POST[\'crowd-cats-pid\'] );
$tax = $_POST[\'crowd-cats-tax\'];
if ( ! taxonomy_exists($tax) )
return;
// Allow only existing terms. Not sure if this is needed.
$args = array( \'hide_empty\' => false );
$args = apply_filters( \'mcc_allowed_terms_args\', $args, $post_id, $tax );
$args[\'fields\'] = \'ids\';
$allowed_terms = get_terms( $tax, $args );
foreach ( $suggested_terms as $key => $term_id )
if ( ! in_array( $term_id, $allowed_terms ) )
unset( $suggested_terms[$key] );
// Add terms to taxonomy
$affected_terms = wp_set_object_terms( $post_id, $suggested_terms, $tax, false );
update_term_cache($affected_terms);
return $affected_terms;
}
}