[wp-hackers] Any other way to do it? (or, do we really need Nonces?)

[Robert Deaton]

To make a long story short, POST or GET does not matter. Both actions
must be protected by nonces, period. And as far as I know, in the
administration panel, both actions are protected by nonces.

The answer to the original question is also no, because it would not
peacefully degrade, that particular solution cannot be used, and is
also essentially useless from a security standpoint.

For GET vs. POST and safe following of links, nowhere is it stated
that GETs in links are intended to not have side effects. There is a
recommendation that they do not, but it is not a requirement, nor
would it be enforceable if it was. There is no reason that a link that
is clearly labeled in the administration panel to point to an action
that is intended to delete something should not be allowed. If we're
not sending the right caching headers to comply with the
recommendations of the HTTP specification, then I suggest we change
that. Otherwise, I see absolutely no problem with using links to
perform operations.

-- 
--Robert Deaton
http://lushlab.com