[wp-trac] [WordPress Trac] #41617: wp_verify_nonce() check fails on several websites because of filter possibility in wp_nonce_tick()

[WordPress Trac]

#41617: wp_verify_nonce() check fails on several websites because of filter
possibility in wp_nonce_tick()
--------------------------------------------+------------------------------
 Reporter:  ReneHermi                       |       Owner:
     Type:  defect (bug)                    |      Status:  new
 Priority:  normal                          |   Milestone:  Awaiting Review
Component:  Security                        |     Version:  4.8.1
 Severity:  critical                        |  Resolution:
 Keywords:  dev-feedback 2nd-opinion close  |     Focuses:
--------------------------------------------+------------------------------
Changes (by dd32):

 * keywords:  dev-feedback 2nd-opinion needs-patch => dev-feedback 2nd-
     opinion close


Comment:

 IMHO plugins which filter this, but do not do so conditionally (ie.
 add_filter, perform action, remove_filter) are probably doing it wrong.
 Additionally, plugins using this are probably not using it correctly and
 should be using something like a signed url instead.

 The filter is designed to be very generic, so change it from 1 day to
 something such as 1 hour or 1 week globally, rather than for single nonce
 checks.

 I personally don't think anything should/need be changed here, badly
 written plugins can break sites in many unintended ways.

--
Ticket URL: <https://core.trac.wordpress.org/ticket/41617#comment:2>
WordPress Trac <https://core.trac.wordpress.org/>
WordPress publishing platform