Add an action for when nonce verification fails

[dd32]

Currently when a plugin (or core) calls check_admin_referer() there is no way for auditing (or debugging) plugins to hook in and record an event that the nonce check failed.

Previously it was possible to use the explain_nonce_$nonce filter to do this, but that was removed in [21133].

If a plugin wants to record an event for a failing nonce, it'll need to call wp_verify_nonce() manually itself, and die afterwards, or call check_admin_referer() after verifying the nonce itself for logging purposes.

I'd suggest either resurrecting the previous filter as an action (for back compat) or adding a new nonce failure hook.

[dd32]

#21190 was marked as a duplicate.

[nacin]

This will also need hook documentation: ​https://make.wordpress.org/core/handbook/inline-documentation-standards/php-documentation-standards/

[Shelob9]

I'm presuming that the very complex filter that was removed in 21133 was removed for its complexity, so I have created a very simple action. I used it successfully to log actions that failed because the nonce wasn't correct. My specific test was copying the link for switching the theme to Twenty Eleven, and removing the last character from the nonce string before submitting it. I was able to log 'switch-theme_twentyeleven' using the action added in my patch 24030.diff

If something more complicated is needed, please let me know and I will take a stab at it.

[johnbillion]

We should add the equivalent to check_ajax_referer() too.

[nacin]

There are existing hooks in check_(admin|ajax)_referer, so we should be able to just append _failed to those to get the other hook name.

Or, should this be done directly in wp_verify_nonce()?

[garza]

unit test for patch 24030-1

[garza]

Uploaded a new patch that moves the action created by Shelob9 into wp_verify_nonce() per the last comment by nacin.

Also created a unit test case which makes sure this action is getting called and passing the $uid and $action

[johnbillion]

I recently had a need for this.

24030.2.diff​ refreshes and tidies up the patch and tests from @garza.

Related: #33342 #32813

[SergeyBiryukov]

In 33744:

Add 'wp_verify_nonce_failed' action that fires when nonce verification fails.

props johnbillion, garza, Shelob9.
fixes #24030.