Ticket #24030: 24030.2.diff

src/wp-includes/pluggable.php

@@ -1803 +1803 @@
                 return 2;
         }
 
+        /**
+         * Fires when nonce verification fails.
+         *
+         * @since x.x.x
+         *
+         * @param string     $nonce  The invalid nonce.
+         * @param string|int $action The nonce action.
+         * @param WP_User    $user   The current user object.
+         * @param string     $token  The user's session token.
+         */ 
+        do_action( 'wp_verify_nonce_failed', $nonce, $action, $user, $token );
+
         // Invalid nonce
         return false;
 }

tests/phpunit/tests/auth.php

@@ -8 +8 @@
         var $user_id;
         var $wp_hasher;
 
+        /**
+         * action hook
+         */
+        protected $nonce_failure_hook = 'wp_verify_nonce_failed';
+
         function setUp() {
                 parent::setUp();
                 $this->user_id = $this->factory->user->create();
@@ -110 +115 @@
                 $this->assertFalse( wp_verify_nonce( 1 ) );
         }
 
+        /**
+         * @ticket 24030
+         */
+        function test_wp_nonce_verify_failed() {
+                $nonce = substr( md5( uniqid() ), 0, 10 );
+                $count = did_action( $this->nonce_failure_hook );
+
+                wp_verify_nonce( $nonce, 'nonce_test_action' );
+
+                $this->assertEquals( ( $count + 1 ), did_action( $this->nonce_failure_hook ) );
+        }
+
+        /**
+         * @ticket 24030
+         */
+        function test_wp_nonce_verify_success() {
+                $nonce = wp_create_nonce( 'nonce_test_action' );
+                $count = did_action( $this->nonce_failure_hook );
+
+                wp_verify_nonce( $nonce, 'nonce_test_action' );
+
+                $this->assertEquals( $count, did_action( $this->nonce_failure_hook ) );
+        }
+
         function test_password_length_limit() {
                 $passwords = array(
                         str_repeat( 'a', 4095 ), // short