You can use filter_input to sanitize your $_POST array. $nonce = filter_input( INPUT_POST, ‘revv_meta_box_nonce’, FILTER_SANITIZE_STRING ) use empty() to check $nonce has a value or not. You can use the same for second issue $foo = filter_input( INPUT_POST, ‘foo’, FILTER_SANITIZE_STRING ) change 3rd parameter based on your expected data in $_POST[‘foo’]. check this doc for … Read more
I would always go for the role “check”. As in your case: if ( current_user_can( ‘vendor’ ) ) { // do stuff } Or of course the distributor role as created by you. This way you can be sure that one is not interfering with the other and you can assign each role to its … Read more
You can use wp_dropdown_roles()
Unfortunately it’s not currently possible nor does there appear to be will to consider it as a modification as you can see by this recent thread on the wp-hackers list and this ticket on trac. If you’d really like to see this be revisited I’d suggest: Present your case on wp-hackers but be forewarned your … Read more
I found an answer here i will give this a try.. Confirmation required on email change
Is it possible to only have the admin interface bind to the local loopback?
I think the answer is “it depends” — on how flexible and/or “slick” you want the solution to be. The quickest/easiest thing to do would be to create a custom post type (there are tried/true plugins out there that can help establish this) — and then in your theme functions.php (or in a very simple … Read more
wp_config was set up to force SSL by overwriting $_SERVER[‘HTTPS’], I respolved the issue. I assume someone was trying to make SSL work behind the proxy at one point. It would actually be a much better solution ( specifically for asset links ) to use the double slash //
Input/output related security issue can be roughly sorted into two buckets: someone manages to read information they are not supposed to; someone manages to write information they are not supposed to. Localize is not capable of writing anything into site, so you are safe on that front. On the read side it’s not much different … Read more
It turns our this error is caused by security software on the server. Meaning that a software that makes sure the hosting providers servers are safe is denying these requests. You cannot fix this because it’s on the hosting providers server, you have to call or email them and let them know this is happening. … Read more