Creating admin bar link with nonce

  • Resolved nitrospectide

    (@nitrospectide)


    2 months, 2 weeks ago

    I’m trying to create an admin bar link to clear a plugin cache that currently requires me to go to the plugin page to clear it. The clearing link on the plugin admin page looks like this:

    https://dev.udcus.com/wp-admin/admin.php?page=debloat-delete-cache&_wpnonce=XXXXXXXXXX

    This is my code:

    function custom_toolbar_link($wp_admin_bar) {
    $wp_admin_bar->add_node(array(
        'id'    => 'clear-all-caches',
        'title' => 'Clear All Caches',
        'href'  => false,
    ));

    $urlDebloat = wp_nonce_url( '/wp-admin/admin.php?page=debloat-delete-cache', 'debloat' );
    $wp_admin_bar->add_node(array(
        'parent' => 'clear-all-caches',
        'id'     => 'clear_debloat_cache',
        'title'  => 'Clear Debloat Cache',
        'href'   => $urlDebloat,
    ));

}
add_action('admin_bar_menu', 'custom_toolbar_link', 999);

    It creates the link, and adds a nonce, but the nonce is different from the one that I get on the plugin admin page clearing link, and I get “The link you followed has expired” when I use it. Hopefully, I don’t have to deep dive on understanding everything about nonces to make this work?

Viewing 5 replies - 1 through 5 (of 5 total)
  • Moderator bcworkz

    (@bcworkz)

    2 months, 2 weeks ago

    You don’t need to know everything about nonces, but you do need to determine how the plugin creates its own nonce. You’re using the typical WP way, but I’ve no idea what the plugin is doing. Aside from the WP way, there are any number of other possible ways to generate and validate a nonce.

    If you’re confident you’ve exactly replicated the plugin’s method, you’ll likely need to do a debug trace through the plugin’s nonce validation method to learn exactly what it is about your nonce that is failing to validate. There are basically 3 components in the WP way. User session token, time tick, and action word. The first two should normally match up, so the only other variable is the action word. You’re sure “debloat” is the correct action word? If so, it’s possible the plugin is using an alternative method.

    hmfaysal

    (@hmfaysal)

    2 months, 2 weeks ago

    Can you try this:

    function custom_toolbar_link($wp_admin_bar) {
    $wp_admin_bar->add_node(array(
        'id'    => 'clear-all-caches',
        'title' => 'Clear All Caches',
        'href'  => false,
    ));

    // Try 'debloat-delete-cache' as the action (matching the page slug)
    $urlDebloat = wp_nonce_url(
        admin_url('admin.php?page=debloat-delete-cache'), 
        'debloat-delete-cache'
    );
    
    $wp_admin_bar->add_node(array(
        'parent' => 'clear-all-caches',
        'id'     => 'clear_debloat_cache',
        'title'  => 'Clear Debloat Cache',
        'href'   => $urlDebloat,
        'meta'   => array('title' => 'Clear Debloat Cache'),
    ));
}
add_action('admin_bar_menu', 'custom_toolbar_link', 999);
    colordraws

    (@colordraws)

    2 months, 1 week ago

    You’re running into this issue because the nonce you’re generating doesn’t match the one the plugin expects. In WordPress, nonces are tied to a specific action string, so using 'debloat' in wp_nonce_url() will only work if the plugin also uses that exact same action when creating and verifying the nonce. That’s why you’re getting the “link has expired” error.

    The fix is to find the actual nonce action used by the plugin (usually in its source code where wp_nonce_url(), wp_create_nonce(), or check_admin_referer() is called) and use that exact action string in your code. Once you match it, your admin bar link should work correctly.

    If you can’t find or match the nonce, another option is to hook into whatever function or action the plugin uses to clear the cache directly instead of relying on the URL.

    Thread Starter nitrospectide

    (@nitrospectide)

    2 months, 1 week ago

    Thank you all for each of your contributions. All of you were right. @colordraws: Your detailed spelling out of the issue was the key to unlock my understanding. I appreciate it.

    colordraws

    (@colordraws)

    2 days, 10 hours ago

    You’re very welcome! I’m glad the explanation helped. Sometimes all it takes is looking at the problem from a slightly different angle before everything clicks into place.

    I enjoy breaking down issues step by step, both here and over at Colordraws, so I’m happy the detailed explanation was useful. Best of luck with the project!

Viewing 5 replies - 1 through 5 (of 5 total)

You must be logged in to reply to this topic.