Missing possibility to disable _wpnonce

  • Resolved Pixelbart

    (@pixelbart)


    5 years, 3 months ago

    Hello,

    Is there any way to disable _wpnonce? The filter that exists for it does not work.

    Not working:
    add_filter( 'wpcf7_verify_nonce', '__return_false' );

    Unfortunately, this does not work, because it does not filter the fields:

    add_filter( 'wpcf7_form_hidden_fields', function( $items ) {
unset( $items['_wpnonce'] );
return $items;
});

    Now we have to take that out with every update because there is no way to do that.

    file: contact-form-7/includes/contact-form.php:409

    adding: if ( '_wpnonce' === $name ) continue;

    We know there are security issues with this. However, the user of the website is aware of this. It would be great if there was a way to do this so we don’t have to change it every time we update.

    Thank you and stay healthy!

Viewing 9 replies - 1 through 9 (of 9 total)
  • Plugin Author Takayuki Miyoshi

    (@takayukister)

    5 years, 3 months ago

    Nonce verification is inactive by default. See Contact Form 7 4.9.

    Thread Starter Pixelbart

    (@pixelbart)

    5 years, 3 months ago

    @takayukister exactly, that’s what i read too. Funnily enough, it still outputs a _wpnonce field and the form only works for us if I remove it.

    Otherwise I get a 403 bug via admin-ajax.php right after submitting the form. Without the _wpnonce field it works.

    We also don’t have a cache or anything active, however we are using the theme Themify, which I guess caches things somehow, which I can’t asuset. Removing the _wpnonce field works here though and it’s also removed directly, so the cache seems to be inactive here.

    Plugin Author Takayuki Miyoshi

    (@takayukister)

    5 years, 3 months ago

    Where can we see the website in question?

    Thread Starter Pixelbart

    (@pixelbart)

    5 years, 3 months ago

    @takayukister

    Please use the parameter. With the parameter my change is not present and everything as it should be, but unfortunately does not work:

    https://vetmedicum.com/?cf7test

    Unfortunately you can’t see much in the response from the ajax request.

    Thank you for your support and stay well!

    Plugin Author Takayuki Miyoshi

    (@takayukister)

    5 years, 3 months ago

    What other plugins and theme do you use on the site?

    Thread Starter Pixelbart

    (@pixelbart)

    5 years, 3 months ago

    @takayukister 

    
### wp-core ###

version: 5.6
site_language: de_DE_formal
user_language: de_DE_formal
timezone: Europe/Berlin
permalink: /%postname%/
https_status: true
multisite: false
user_registration: 0
blog_public: 1
default_comment_status: open
environment_type: production
user_count: 2
dotorg_communication: true

### wp-active-theme ###

name: Themify Ultra (themify-ultra)
version: 5.1.6 (latest version: 5.1.7)
author: Themify
author_website: https://www.themify.me
parent_theme: none
theme_features: core-block-patterns, automatic-feed-links, woocommerce, post-thumbnails, wc-product-gallery-zoom, wc-product-gallery-lightbox, wc-product-gallery-slider, editor-style, title-tag, html5, themify-mega-menu, themify-toggle-dropdown, menus, align-wide, widgets
theme_path: /homepages/33/d844997429/htdocs/vet-medicum.com/wp-content/themes/themify-ultra
auto_update: Deaktiviert

### wp-plugins-active (29) ###

Announcement Bar: version: 2.0.5, author: Themify, Automatische Aktualisierungen deaktiviert
Antispam Bee: version: 2.9.3, author: pluginkollektiv, Automatische Aktualisierungen deaktiviert
Attachment Pages Redirect: version: 1.1.1, author: Samuel Aguilera, Automatische Aktualisierungen deaktiviert
Better Search Replace: version: 1.3.4, author: Delicious Brains, Automatische Aktualisierungen deaktiviert
Builder Counter: version: 2.0.1, author: Themify, Automatische Aktualisierungen deaktiviert
Builder Image Pro: version: 2.0.6, author: Themify, Automatische Aktualisierungen deaktiviert
Builder Slider Pro: version: 2.0.6, author: Themify, Automatische Aktualisierungen deaktiviert
Builder WooCommerce: version: 2.0.4, author: Themify, Automatische Aktualisierungen deaktiviert
casusbene DSGVO: version: 1.0.2, author: casusbene, Automatische Aktualisierungen deaktiviert
CF7 Smart Grid Design Extension: version: 4.7.4, author: Aurovrata V., Automatische Aktualisierungen deaktiviert
Contact Form 7: version: 5.3.2, author: Takayuki Miyoshi, Automatische Aktualisierungen deaktiviert
Disable XML-RPC Pingback: version: 1.2.1, author: Samuel Aguilera, Automatische Aktualisierungen deaktiviert
Duplicator: version: 1.3.40.1, author: Snap Creek, Automatische Aktualisierungen deaktiviert
Email Encoder - Protect Email Addresses: version: 2.1.0, author: Ironikus, Automatische Aktualisierungen deaktiviert
Enable Media Replace: version: 3.5.0, author: ShortPixel, Automatische Aktualisierungen deaktiviert
Flamingo: version: 2.2.1, author: Takayuki Miyoshi, Automatische Aktualisierungen deaktiviert
GDPR Cookie Compliance (CCPA, PIPEDA ready): version: 4.4.5, author: Moove Agency, Automatische Aktualisierungen deaktiviert
Germanized for WooCommerce: version: 3.3.4, author: vendidero, Automatische Aktualisierungen deaktiviert
Imsanity: version: 2.7.1, author: Exactly WWW, Automatische Aktualisierungen deaktiviert
MailPoet 3 (New): version: 3.57.1, author: MailPoet (latest version: 3.58.0), Automatische Aktualisierungen deaktiviert
Polylang: version: 2.9.1, author: WP SYNTEX, Automatische Aktualisierungen deaktiviert
TablePress: version: 1.12, author: Tobias Bäthge, Automatische Aktualisierungen deaktiviert
TablePress Extension: Responsive Tables: version: 1.7, author: Tobias Bäthge, Automatische Aktualisierungen deaktiviert
Themify Portfolio Post: version: 1.1.6, author: Themify, Automatische Aktualisierungen deaktiviert
Themify Updater: version: 1.2.9, author: Themify, Automatische Aktualisierungen deaktiviert
WooCommerce: version: 4.9.0, author: Automattic (latest version: 4.9.1), Automatische Aktualisierungen deaktiviert
WooCommerce PayPal Checkout Gateway: version: 2.1.1, author: WooCommerce, Automatische Aktualisierungen deaktiviert
WP Mail SMTP: version: 2.5.1, author: WPForms, Automatische Aktualisierungen deaktiviert
Yoast SEO: version: 15.6.2, author: Team Yoast, Automatische Aktualisierungen deaktiviert

### wp-plugins-inactive (1) ###

WP Fastest Cache: version: 0.9.1.4, author: Emre Vona, Automatische Aktualisierungen deaktiviert

### wp-media ###

image_editor: WP_Image_Editor_GD
imagick_module_version: Nicht verfügbar
imagemagick_version: Nicht verfügbar
file_uploads: File uploads is turned off
post_max_size: 64M
upload_max_filesize: 64M
max_effective_size: 64 MB
max_file_uploads: 20
gd_version: 2.2.5
ghostscript_version: 9.27

### wp-server ###

server_architecture: Linux 4.4.236-icpu-055 x86_64
httpd_software: Apache
php_version: 7.4.14 64bit
php_sapi: cgi-fcgi
max_input_variables: 5000
time_limit: 50000
memory_limit: -1
max_input_time: -1
upload_max_filesize: 64M
php_post_max_size: 64M
curl_version: 7.64.0 OpenSSL/1.1.1d
suhosin: false
imagick_availability: false
pretty_permalinks: true
htaccess_extra_rules: true

### wp-database ###

extension: mysqli
server_version: 5.7.30-log
client_version: mysqlnd 7.4.14

### wp-constants ###

WP_HOME: undefined
WP_SITEURL: undefined
WP_CONTENT_DIR: ...
WP_PLUGIN_DIR: ...
WP_MAX_MEMORY_LIMIT: -1
WP_DEBUG: false
WP_DEBUG_DISPLAY: true
WP_DEBUG_LOG: false
SCRIPT_DEBUG: false
WP_CACHE: false
CONCATENATE_SCRIPTS: undefined
COMPRESS_SCRIPTS: undefined
COMPRESS_CSS: undefined
WP_LOCAL_DEV: undefined
DB_CHARSET: utf8
DB_COLLATE: undefined

### wp-filesystem ###

wordpress: writable
wp-content: writable
uploads: writable
plugins: writable
themes: writable

### wp_mail_smtp ###

version: 2.5.1
license_key_type: lite
debug: Keine Debug-Hinweise gefunden.
db_tables: xe8ro_wpmailsmtp_tasks_meta

### pll_options ###

browser: 1
rewrite: 1
hide_default: 1
force_lang: 1
redirect_lang: 1
media_support: 1
sync: 0
post_types: post, page, wp_block, attachment, cf7sg_page, tbuilder_layout, tbuilder_layout_part, tglobal_style, product, announcement, mailpoet_page, portfolio
taxonomies: category, post_tag, product_cat, product_tag, product_shipping_class, wpcf7_type, product_price_label, product_unit, product_delivery_time, portfolio-category
domains: 0
version: 2.9.1
default_lang: de
main-nav: de => 3 | en => 15
footer-nav: de => 0 | en => 0
previous_version: 2.8.4

### pll_language_de ###

term_id: 7
name: Deutsch
slug: de
term_group: 0
term_taxonomy_id: 7
count: 67
tl_term_id: 8
tl_term_taxonomy_id: 8
tl_count: 2
locale: de_DE_formal
is_rtl: 0
w3c: de-DE
facebook: de_DE
flag_url: https://vetmedicum.com/wp-content/plugins/polylang/flags/de.png
home_url: https://vetmedicum.com/
search_url: https://vetmedicum.com/
mo_id: 302
page_on_front: 8
page_for_posts: 0
flag_code: de

### pll_language_en ###

term_id: 11
name: English
slug: en
term_group: 1
term_taxonomy_id: 11
count: 0
tl_term_id: 12
tl_term_taxonomy_id: 12
tl_count: 1
locale: en_GB
is_rtl: 0
w3c: en-GB
facebook: en_GB
flag_url: https://vetmedicum.com/wp-content/plugins/polylang/flags/gb.png
home_url: https://vetmedicum.com/en/
search_url: https://vetmedicum.com/en/
mo_id: 303
page_on_front: 0
page_for_posts: 0
flag_code: gb
    Plugin Author Takayuki Miyoshi

    (@takayukister)

    5 years, 3 months ago

    Try switching to the default theme and deactivating all plugins excluding Contact Form 7, Flamingo, WooCommerce, WP Mail SMTP, and Yoast SEO.

    Why you are advised to deactivate plugins and switch to the default theme.

    Thread Starter Pixelbart

    (@pixelbart)

    5 years, 3 months ago

    @takayukister

    So we know it’s because of Themify. Themify has an internal cache that you can’t disable. All blocks are cached that way.

    If I disable Themify (that is the WordPress theme), everything works of course. Also with the other plugins.

    Therefore also the request that there should be a filter to disable the _wpnonce. This can not be deactivated currently.

    billyqureshi

    (@billyqureshi)

    5 years, 1 month ago

    did you get anywhere with this?
    my wordpress has started adding ?_wpnonce=xxxx to all my links and its stopped my modals from working.
    is there any way to disable it from adding these nonces to all links?
    i think this has happened at the same time as i added the site to sucuri web firewall, but i cant understand how they could be linked.

    • This reply was modified 5 years, 1 month ago by billyqureshi.
Viewing 9 replies - 1 through 9 (of 9 total)

The topic ‘Missing possibility to disable _wpnonce’ is closed to new replies.