{"id":8851130,"date":"2017-02-27T03:29:01","date_gmt":"2017-02-27T03:29:01","guid":{"rendered":"https:\/\/wordpress.org\/support\/topic\/security-error-9\/"},"modified":"2017-02-27T05:31:59","modified_gmt":"2017-02-27T05:31:59","slug":"security-error-9","status":"publish","type":"topic","link":"https:\/\/wordpress.org\/support\/topic\/security-error-9\/","title":{"rendered":"Security Error"},"content":{"rendered":"<p>With certain other third party plugins, the Better YOURLS plugin causes a &#8220;Security Error&#8221; on <code>save_post<\/code> and\/or <code>transition_post_status<\/code>.  This errors results due to an issue in <code>class-better-yourls-actions.php<\/code>.<\/p>\n<p>Starting at line #127, the evaluation of <code>$_POST[&#039;better_yourls_nonce&#039;]<\/code> begins.  The first part tests if <code>$_POST[&#039;better_yourls_nonce&#039;]<\/code> is set but at the same time validates the nonce while being dependent on <code>$_POST[&#039;better_yourls_nonce&#039;]<\/code>. <\/p>\n<p>Because some third party plugins do not paint the YOURLS Meta Box, the better_yourls_nonce INPUT does not exist on those edit pages.  When submitted, <code>$_POST[&#039;better_yourls_nonce&#039;]<\/code> does not exist.  Therefore, evaluating the nonce is futile.  <\/p>\n<pre><code>\/\/ Make sure we are originating from the right place.\nif (\n! isset( $_POST[&#039;better_yourls_nonce&#039;] ) || \/\/ WPCS: input var ok.\n! wp_verify_nonce( $_POST[&#039;better_yourls_nonce&#039;], &#039;better_yourls_save_post&#039; ) \/\/ WPCS: input var ok. Sanitization ok.\n) {\nwp_die( esc_html__( &#039;Security Error&#039;, &#039;better-yourls&#039; ) );\n}<\/code><\/pre>\n<p>What should happen is a test that <code>$_POST[&#039;better_yourls_nonce&#039;]<\/code> is good then if it is evaluate the nonce (not both at the same time).<\/p>\n<p>Line #131 (<code>wp_die( esc_html__( &#039;Security Error&#039;, &#039;better-yourls&#039; ) );<\/code>) should never be realized if the variable is simply not defined.  Instead, it should gracefully return and do nothing else.<\/p>\n","protected":false},"template":"","class_list":["post-8851130","topic","type-topic","status-publish","hentry"],"jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/wordpress.org\/support\/wp-json\/wp\/v2\/topic\/8851130","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/wordpress.org\/support\/wp-json\/wp\/v2\/topic"}],"about":[{"href":"https:\/\/wordpress.org\/support\/wp-json\/wp\/v2\/types\/topic"}],"version-history":[{"count":1,"href":"https:\/\/wordpress.org\/support\/wp-json\/wp\/v2\/topic\/8851130\/revisions"}],"predecessor-version":[{"id":8851133,"href":"https:\/\/wordpress.org\/support\/wp-json\/wp\/v2\/topic\/8851130\/revisions\/8851133"}],"wp:attachment":[{"href":"https:\/\/wordpress.org\/support\/wp-json\/wp\/v2\/media?parent=8851130"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}