Skip to content

POST Forms: Nonce fields according to current action#38

Merged
nicolas-jaussaud merged 5 commits into
mainfrom
fix/match-nonce-with-action
May 28, 2026
Merged

POST Forms: Nonce fields according to current action#38
nicolas-jaussaud merged 5 commits into
mainfrom
fix/match-nonce-with-action

Conversation

@nicolas-jaussaud
Copy link
Copy Markdown
Contributor

Hi @zinigor!

As I mentioned in this comment on a previous pull request, I think we need to update the way we handle nonces

This pull request does the following changes:

  • Move get_nonce_action() from UrlBuilder to DataViewConfig
  • In the default layout, display action buttons according to current action
  • Switch from the default input name for nonces (_wpnonce) to use an action specific one (_wpnonce_{action}))

The reason I moved get_nonce_action() away from UrlBuilder is because we also use it to generate nonce fields in our POST <form>, and as it relies on get_menu_page() to generate the nonce action name I thought it could make sense to move it to DataViewConfig (honestly wasn't really sure what would be the best place)

The default layout was returning a "Save" and "Delete" button for the create action, we should now display only a "Create" button instead

Lastly, it switch from the default name for the nonce field (_wpnonce) to an action specific name. It was causing issues in the edit form, as we need a 2 nonce fields (2 actions in the same form: edit and delete). Both actions require a different nonce in the backend (here and here), so we have to use a different name otherwise the second nonce will overwrite the first one

@nicolas-jaussaud nicolas-jaussaud requested a review from zinigor May 27, 2026 18:51
Copy link
Copy Markdown
Contributor

@zinigor zinigor left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks good to me!

@nicolas-jaussaud nicolas-jaussaud merged commit 4d9b327 into main May 28, 2026
3 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants