wp_nonce_field() could pass along HTTP_REFERER info

[markjaquith]

Sometimes we make use of the HTTP_REFERER in WordPress in order to redirect people after an action is performed.

Since all forms that do something use wp_nonce_field() anyway, we could just have wp_nonce_field echo out another hidden form input:

echo '<input type="hidden" name="wp_http_referer" value="'. wp_specialchars(stripslashes($_SERVER['REQUEST_URI'])) . '" />';

Might be nice being able to count on that! I'd make it its own function, that wp_nonce_field would call.

[westi]

I like this.

We need to make check_admin_referer unset the value in the _POST array if the nonce check fails as we cannot trust the information then.

[robmiller]

This what we're after?

[robmiller]

Oops. This works :)

[markjaquith]

Good start, but we also need to be able to carry a REF along multiple requests.

e.g.

1. do something, passing along ref to #1
2. do something else, carring along ref to #1
3. return to #1.

This would obviously be two different fields. I'll whip something up.

[markjaquith]

Something like this.

If your post will embark on a multiple-request journey before needing to return, you just manually invoke wp_original_referer_field() in the form. Forms in the interim only need to call the nonce call, and it'll pass on the original referer value. When you're ready for it, just call wp_get_original_referer() and you can zoom back to your starting location. An example case for that would be the new user editing stuff, whereby you return to the exact user search/browse page that you were on after you've performed multiple edits on a user's profile.

[markjaquith]

wp_referer 4

[ryan]

(In [3908]) wp_get_referer() and friends from robmiller and markjaquith. fixes #2800

[ryan]

(In [3909]) wp_get_referer() and friends from robmiller and markjaquith. fixes #2800

[ryan]

I included a fix for #2853 when I committed this. Let's start spreading this to all places that use HTTP_REFERER. Now that referrers are not required to access the admin, people are tripping over redirect problems due to HTTP_REFERER being empty.

[ryan]

(In [3918]) Use wp_get_referer(). fixes #2800

[ryan]

(In [3919]) Have wp_referer_field() set the referer to the current page. fixes #2800

[ryan]

(In [3923]) Use wp_get_referer(). fixes #2800 #2855

[(none)]

Milestone 2.0.4 deleted