Changeset 33744

Timestamp:

08/26/2015 12:05:11 AM (11 years ago)

Author:

SergeyBiryukov

Message:

Add 'wp_verify_nonce_failed' action that fires when nonce verification fails.

props johnbillion, garza, Shelob9.
fixes #24030.

Location:

trunk

Files:

• src/wp-includes/pluggable.php (modified) (1 diff)
• tests/phpunit/tests/auth.php (modified) (2 diffs)

trunk/src/wp-includes/pluggable.php

@@ -1813 +1813 @@
         }
 
+        /**
+         * Fires when nonce verification fails.
+         *
+         * @since 4.4.0
+         *
+         * @param string     $nonce  The invalid nonce.
+         * @param string|int $action The nonce action.
+         * @param WP_User    $user   The current user object.
+         * @param string     $token  The user's session token.
+         */ 
+        do_action( 'wp_verify_nonce_failed', $nonce, $action, $user, $token );
+
         // Invalid nonce
         return false;

trunk/tests/phpunit/tests/auth.php

@@ -9 +9 @@
         var $wp_hasher;
 
+        /**
+         * action hook
+         */
+        protected $nonce_failure_hook = 'wp_verify_nonce_failed';
+
         function setUp() {
                 parent::setUp();
@@ -111 +116 @@
         }
 
+        /**
+         * @ticket 24030
+         */
+        function test_wp_nonce_verify_failed() {
+                $nonce = substr( md5( uniqid() ), 0, 10 );
+                $count = did_action( $this->nonce_failure_hook );
+
+                wp_verify_nonce( $nonce, 'nonce_test_action' );
+
+                $this->assertEquals( ( $count + 1 ), did_action( $this->nonce_failure_hook ) );
+        }
+
+        /**
+         * @ticket 24030
+         */
+        function test_wp_nonce_verify_success() {
+                $nonce = wp_create_nonce( 'nonce_test_action' );
+                $count = did_action( $this->nonce_failure_hook );
+
+                wp_verify_nonce( $nonce, 'nonce_test_action' );
+
+                $this->assertEquals( $count, did_action( $this->nonce_failure_hook ) );
+        }
+
         function test_password_length_limit() {
                 $passwords = array(