Skip to content

v1.3.3 - assigning contacts to a list works

Choose a tag to compare

@appcoderikbal appcoderikbal released this 23 Oct 15:47
· 10 commits to main since this release

Fixes "That link or form has expired" when assigning contacts to a list.

WP_List_Table::display() emits its own wp_nonce_field('bulk-...') for the bulk actions it manages. On Contacts that table sits inside the plugin's form and renders after it, so the page carried two inputs named _wpnonce. A browser posts both, PHP keeps the last, and the plugin then checked the list table's value against its own action. It could never match - the form was valid every time.

Nonces now travel in techzapp_crm_nonce, which core does not use, so the two cannot collide. Fixed at the single point every form and action link goes through rather than screen by screen: the same clash was already waiting on List members, and would have hit any future screen combining a list table with a plugin form.

Earlier tests missed this because they called the handler directly with a hand-built nonce, never rendering the form. The new test renders the real Contacts screen and posts what a browser posts - list table nonce included - then confirms the contacts actually land on the list. A forged nonce is still rejected.

No schema change.

Tested up to: 6.8

Installing

Download techzapp-crm.zip below. Do not use the auto-generated source archives - they omit vendor/ and the plugin will not load.