Security Check Failure when Adding Comments to Photos

You need the following arguments in the ajax call:

&moccur=1 ( may be any integer number, usually the sequence number of the wppa instance on the page, let’s call it $moccur ),
&wppa-nonce= the value generated by the wp function:
wp_create_nnce( 'wppa-nonce-' . $moccur );

If these arguments are present and match (= based on the same $moccur) you will pass the security check.

So, if you have &moccur=7 you should add
&wppa-nonce={the value of: wp_create_nnce( 'wppa-nonce-7' );}

I have encountered this error when adding a Comment. It works fine, but hits an error in my situation.

I would like to know why you need this; what do you want to do that is not possible using the standard features. In other words: pls explain what you mean by ‘my situation’.

• This reply was modified 5 years, 4 months ago by Jacob N. Breetvelt. Reason: Fixed typos

You could make a page with shortcode [wppa type="landing"] and create a link in the email like:

https://betatest.opajaap.nl/landin-page/?wppa-occur=1&wppa-single=1&wppa-album=5&wppa-photo=5584

Try the link, its live (for the moment)

I think the problem is with your login procedure.
The nonce value is dependant of login status and time. Maybe the login url args should also be included in the ajax calls and that is un-doable.

I have an idea for a different approach:

Try this:
– UNtick Table IV-F1: Comment login. They need not to login
– Untick Table IV-E1: Rating login. They need not to login
– Tick Table IV-A6.1: Enable encrypted links
– Tick Table IV-A6.2: Refuse unencrypted

Now they need not to login, but they can not guess a photo or album identifier.

Try this link: ( &wppa-xxx is equivalent to &xxx ), Tick Table IV-A5: Use short query args.

https://betatest.opajaap.nl/landin-page/?occur=1&single=1&album=40kMMnA6ursF&photo=382T9Q24UFii

You can make such a link as follows (example for the link above on my test site):

<?php
$page  = 840;  // Landing page id
$album = 5;    // Album id
$photo = 5584; // Photo id
$link  = get_permalink( $page ) . '?occur=1&single=1&album=' . wppa_get_album_item( $album, 'crypt' ) . '&photo=' . wppa_get_photo_item( $photo, 'crypt' );

You can make the link more crypyic by using Table IV-A6: Enable prety links:

‘Classic’: (This one works even when my setting of IV-A6 = ‘none’ )
https://betatest.opajaap.nl/landin-page/wppaspec/oc1/si1/ab40kMMnA6ursF/pt382T9Q24UFii

‘Compressed’: (This one does not work now because my setting of IV-A6 = ‘none’ )
https://betatest.opajaap.nl/landin-page/-//1/40kMMnA6ursF/382T9Q24UFii///////////1

Now you have the full security, no special things to do for your users, and believed to be not hackable to enter comments or ratings to other photos.
Make sure other pages with slideshows are login protected, because no need to login for comments and ratings is system wide.

In Table IV-F4 you can switch off the need for the email.

If you accept the need to use the crypts for both album and photo ids, i could make a setting that bypasses the nonce check if – for the comment – both crypts are valid, and for the rating: the photo crypt is valid.

Another thing that may be usefull for you: You can invalidate ‘old’ emails by renewing the crypts (Table VII-A 13, 13.1, 14, 14.1)

Yes, same for ratings.
Will be implemented in 7.0.03, available in a few days.

Pls update to 7.0.03, and tick the box in Table IX-A14.

I called it Direct comment Enable direct commenting and rating from remote source

The helptext is:

This setting has only effect when Table IV-A6.1 and 6.2 are ticked
Use with care, and only in specisl situations! The default for this setting is: no: Unchecked

It should work now. Pls keep me informed

Thanx for the feedback.

What is your setting in Table VI-7: Link type?