There is no one way of checking the nonce on plugin uninstallation

[szepe.viktor]

Before the shiny AJAX plugin de/activation and un/installation in the registered (register_uninstall_hook) plugin uninstall function we should have used check_admin_referer( 'bulk-plugins' );

But now check_ajax_referer( 'updates' ); works only unless the user has disabled JavaScript.

I think there is no way to use only one function for validating the nonce.
Please advise.

[szepe.viktor]

You must wrap check_admin_referer() in wp_doing_ajax() as all AJAX plugin actions check their nonces!

[dd32]

Plugins should not check core nonces on the deactivation/activation/uninstallation hooks as core does this for them.

Plugins also cannot expect that they're being activated by the web ui, as they may also happen through the CLI (see wp-cli) or other management scripts which might fire off the hooks.

In short: Check any nonces which the plugin adds, but allow core to validate it's own nonces.

[szepe.viktor]

Thank you.

Yes in wp-admin/plugins.php in case branch 'delete-selected' there is

<?php
check_admin_referer('bulk-plugins');