wp_nonce_field() does not pass the result of wp_referer_field()

[webduo]

When using wp_nonce_field in "no echo mode" ($echo argument is set to false) and with the $referer variable set to true (which is the default) the result of wp_referer_field function is not added to $nonce_field which is returned at the end of wp_nonce_field.

I'd expect wp_nonce_field to return the same content what it echoes, but now it outputs two fields and passes just one (without the referer field). So:

wp_nonce_field('some-action-name');

results in something like

<input type="hidden" id="_wpnonce" name="_wpnonce" value="123456789a" />
<input type="hidden" name="_wp_http_referer" value="/wp-admin/options-general.php?page=some-action-name" />

where

wp_nonce_field('some-action-name', '_wpnonce', true, false);

returns only

<input type="hidden" id="_wpnonce" name="_wpnonce" value="123456789a" />

[webduo]

wp_nonce_field function patch for wordpress 2.9.1 tag

[webduo]

This issue could be solved in few other ways, so the attached patch is only a suggestion. Regards.

[nacin]

Makes sense to me, but I'm wondering about how this will play into back compat.

[ZephyrWest]

This still hasn't been fixed as of 3.0.4... Is this going to make it into 3.1?

[philipwalton]

I ran into this bug today in my development. May I ask why it hasn't been implemented yet? If there is testing that needs to be done, I'm willing to help out in any way I can.

[scribu]

Patch looks good to me.

As for backwards compatibility, check_admin_referer() wouldn't have worked anyway.

Worst case, the referer field is added twice.

[scribu]

See 11953.diff​.

[ryan]

The phpdoc detailing this behavior would also need to be removed. Those who have been following the phpdoc would get duplicate fields, as scribu mentions, which seems acceptable.

[scribu]

Removed docblock.

[ryan]

In [18130]:

Properly return referrer when referer = true and echo = false. Props scribu, webduo. fixes #11953