check_ajax_referer( int|string $action = -1, false|string $query_arg = false, bool $stop = true )
Verifies the Ajax request to prevent processing requests external of the blog.
Parameters
- $action
-
(Optional) Action nonce.
Default value: -1
- $query_arg
-
(Optional) Key to check for the nonce in
$_REQUEST
(since 2.5). If false,$_REQUEST
values will be evaluated for '_ajax_nonce', and '_wpnonce' (in that order).Default value: false
- $stop
-
(Optional) Whether to stop early when the nonce cannot be verified.<br>
Default value: true
Return
(int|false) 1 if the nonce is valid and generated between 0-12 hours ago, 2 if the nonce is valid and generated between 12-24 hours ago.<br> False if the nonce is invalid.
Source
File: wp-includes/pluggable.php
function check_ajax_referer( $action = -1, $query_arg = false, $die = true ) {
if ( -1 == $action ) {
_doing_it_wrong( __FUNCTION__, __( 'You should specify a nonce action to be verified by using the first parameter.' ), 'WP-4.7' );
}
$nonce = '';
if ( $query_arg && isset( $_REQUEST[ $query_arg ] ) )
$nonce = $_REQUEST[ $query_arg ];
elseif ( isset( $_REQUEST['_ajax_nonce'] ) )
$nonce = $_REQUEST['_ajax_nonce'];
elseif ( isset( $_REQUEST['_wpnonce'] ) )
$nonce = $_REQUEST['_wpnonce'];
$result = wp_verify_nonce( $nonce, $action );
/**
* Fires once the Ajax request has been validated or not.
*
* @since WP-2.1.0
*
* @param string $action The Ajax nonce action.
* @param false|int $result False if the nonce is invalid, 1 if the nonce is valid and generated between
* 0-12 hours ago, 2 if the nonce is valid and generated between 12-24 hours ago.
*/
do_action( 'check_ajax_referer', $action, $result );
if ( $die && false === $result ) {
if ( wp_doing_ajax() ) {
wp_die( -1, 403 );
} else {
die( '-1' );
}
}
return $result;
}
Changelog
Version | Description |
---|---|
2.0.3 | Introduced. |