Security Error

I, too, am getting the “Security Error” message when creating a new post with certain custom post types. Disabling Better YOURLS resolves the issue.

So far:

• Advanced Ads
• Chimpy

Some advice on debugging this would be greatly appreciated.

I ran this down.

The problem is Better YOURLS does not know when it is unable to paint the META box on a particular admin post type page. When it is unable, the INPUT field does not exist. When the script does wp_verify_nonce the var better_yourls_nonce $_POST var is bad (because it does not exist).

On that condition, it throws an error. You will find this on about line #129 of class-better-yourls-actions.php. I resolved this by doing a return instead of die().

protected function _generate_post_on_save( $post_id ) {

		// Make sure we are originating from the right place.
		if (
			! isset( $_POST['better_yourls_nonce'] ) || // WPCS: input var ok.
			! wp_verify_nonce( $_POST['better_yourls_nonce'], 'better_yourls_save_post' ) // WPCS: input var ok. Sanitization ok.
		) {
		    return; // Do nothing.
			wp_die( esc_html__( 'Security Error', 'better-yourls' ) );
		}

For some reason, the dev of YOURLS is evaluating if the $_POST var is set OR if wp_verify_nonce fails at the same time. This does not make sense. The latter test would always require the $_POST to be set. The dev should evaluate whether or not the $_POST is set then if it is evaluate it using wp_verify_nonce; not both at the same time.

• This reply was modified 8 years, 2 months ago by moongear.
• This reply was modified 8 years, 2 months ago by moongear.
• This reply was modified 8 years, 2 months ago by moongear.