check_ajax_referer() – Verifies the Ajax request to prevent processing requests external of the blog.

You appear to be a bot. Output may be restricted

Description

Verifies the Ajax request to prevent processing requests external of the blog.

Usage

$int|false = check_ajax_referer( $action, $query_arg, $die );

Parameters

$action
( int|string ) optional default: -1 – Action nonce.
$query_arg
( false|string ) optional – Optional. Key to check for the nonce in $_REQUEST (since 2.5). If false, $_REQUEST values will be evaluated for '_ajax_nonce', and '_wpnonce' (in that order). Default false.
$die
( bool ) optional default: 1 – Optional. Whether to die early when the nonce cannot be verified. Default true.

Returns

int|false

  1. if the nonce is valid and generated between 0-12 hours ago,
  2. if the nonce is valid and generated between 12-24 hours ago.
  3. False if the nonce is invalid.

    Source

    File name: wordpress/wp-includes/pluggable.php
    Lines:

    1 to 38 of 38
      function check_ajax_referer( $action = -1, $query_arg = false, $die = true ) {
        if ( -1 == $action ) {
          _doing_it_wrong( check_ajax_referer, __( 'You should specify an action to be verified by using the first parameter.' ), '4.7.0' );
        }
    
        $nonce = '';
    
        if ( $query_arg && isset( $_REQUEST[ $query_arg ] ) ) {
          $nonce = $_REQUEST[ $query_arg ];
        } elseif ( isset( $_REQUEST['_ajax_nonce'] ) ) {
          $nonce = $_REQUEST['_ajax_nonce'];
        } elseif ( isset( $_REQUEST['_wpnonce'] ) ) {
          $nonce = $_REQUEST['_wpnonce'];
        }
    
        $result = wp_verify_nonce( $nonce, $action );
    
        
    /**
     * Fires once the Ajax request has been validated or not.
     *
     * @since 2.1.0
     *
     * @param string    $action The Ajax nonce action.
     * @param false|int $result False if the nonce is invalid, 1 if the nonce is valid and generated between
     *                          0-12 hours ago, 2 if the nonce is valid and generated between 12-24 hours ago.
     */
        do_action( 'check_ajax_referer', $action, $result );
    
        if ( $die && false === $result ) {
          if ( wp_doing_ajax() ) {
            wp_die( -1, 403 );
          } else {
            die( '-1' );
          }
        }
    
        return $result;
      }
     

     View on GitHub View on Trac