check_admin_referer( int|string $action = -1, string $query_arg = '_wpnonce' ): int|false

Description

Parameters

$actionint|stringoptional

The nonce action.Default: -1

$query_argstringoptional

Key to check for nonce in $_REQUEST. Default '_wpnonce'.Default: '_wpnonce'

Return

int|false

1 if the nonce is valid and generated between 0-12 hours ago, 2 if the nonce is valid and generated between 12-24 hours ago. False if the nonce is invalid. Only possible when $action is -1, as the function otherwise exits rather than returning false.

Hooks fired · 1

One hook fires while check_admin_referer() runs, in this order:

1. 1
   do_action( check_admin_referer )actionline 1392 (+18 into the body)

   Fires once the admin request has been validated or not.

Uses · 8

• _doing_it_wrong()Marks something as being incorrectly called.
• __()Retrieves the translation of $text.
• admin_url()Retrieves the URL to the admin area for the current site.
• wp_get_referer()Retrieves referer from '_wp_http_referer' or HTTP referer.
• wp_verify_nonce()Verifies that a correct security nonce was used with time limit.
• do_action()Calls the callback functions that have been added to an action hook.
• str_starts_with()Polyfill for `str_starts_with()` function added in PHP 8.0.
• wp_nonce_ays()Displays "Are You Sure" message to confirm the action being taken.

Used by · 12

• Custom_Background::handle_upload()Handles an Image upload for the background image.
• Custom_Background::take_action()Executes custom background modification.
• Custom_Image_Header::step_2()Displays second step of custom header image page.
• Custom_Image_Header::step_3()Displays third step of custom header image page.
• Custom_Image_Header::take_action()Executes custom header modification.
• WP_Privacy_Requests_Table::process_bulk_action()Process bulk actions.
• _wp_personal_data_handle_actions()Handle list table actions.
• media_upload_form_handler()Handles form submissions for the legacy media uploader.
• set_screen_options()Saves option for number of rows when listing posts, pages, comments, etc.
• use_block_editor_for_post()Returns whether the post can be edited in the block editor.
• wp_dashboard_setup()Registers dashboard widgets.
• wp_media_upload_handler()Handles the process of uploading media.

Source

View on Trac ↗View on GitHub ↗

1374	function check_admin_referer( $action = -1, $query_arg = '_wpnonce' ) {1375		if ( -1 === $action ) {1376			_doing_it_wrong( __FUNCTION__, __( 'You should specify an action to be verified by using the first parameter.' ), '3.2.0' );1377		}1378 1379		$adminurl = strtolower( admin_url() );1380		$referer  = strtolower( wp_get_referer() );1381		$result   = isset( $_REQUEST[ $query_arg ] ) ? wp_verify_nonce( $_REQUEST[ $query_arg ], $action ) : false;1382 1383		/**1384		 * Fires once the admin request has been validated or not.1385		 *1386		 * @since 1.5.11387		 *1388		 * @param string    $action The nonce action.1389		 * @param false|int $result False if the nonce is invalid, 1 if the nonce is valid and generated between1390		 *                          0-12 hours ago, 2 if the nonce is valid and generated between 12-24 hours ago.1391		 */1392		do_action( 'check_admin_referer', $action, $result );1393 1394		if ( ! $result && ! ( -1 === $action && str_starts_with( $referer, $adminurl ) ) ) {1395			wp_nonce_ays( $action );1396			die();1397		}1398 1399		return $result;1400	}

History

Introduced in 1.2.0. Unchanged from 6.7.7 through 7.1.0.

1. 6.7.7
2. 6.8.8
3. 6.9.7
4. 7.0.4
5. 7.1.0

Signature, return type and hooks compared across 5 parsed releases.

About this page

Parsed data

Generated from the wordpress-develop 7.1.0 tag, from src/wp-includes/pluggable.php, and regenerated for each WordPress release so it tracks the code rather than a snapshot of it.

Corrections

Something wrong on this page? Report it and it gets fixed in the next regeneration.