Ok, so after some fiddling, I’ve got things working. It turns out that I was setting the add_action hooks incorrectly for the AJAX part. The hooks need to be: add_action( ‘wp_ajax_nopriv_MYFUNCTION’, ‘MYFUNCTION’ ); and add_action( ‘wp_ajax_MYFUNCTION’, ‘MYFUNCTION’ ); …in my case and original code the function (‘MYFUNCTION’) in question was to create a post via … Read more
Assuming you do not do stupid things, and use properly the relevant API, an AJAX login form can be as secure as the “core” login form. The way you transfer the data is not very important by itself. Even HTTP, although people and google will claim as being insecure, can probably be secure enough with … Read more
An option is to manually disable all plugins and enable them one-by-one and see when trouble occurse again. Another option is to use a WordPress profiler. I would highly recommend using InterconnectIT’s WordPress Performance Profiler. This plugin will profile all or a certain amount of requests and show you what plugins take a long time … Read more
You got the error 400 Bad Request because the Content-Type header is application/json: $.ajax({ headers:{ “Content-Type”:”application/json” }, data: { … }, … }); And when the request content is a JSON string, the $_REQUEST[‘action’] which WordPress uses to identify the proper AJAX action (which is foo in your code) is not available (i.e. it’s a … Read more
The values are not passed as parameters, but passed in the $_POST array. You need to add nonce for security using check_ajax_nonce https://developer.wordpress.org/reference/functions/check_ajax_referer/ You need to sanitize values submitted before inserting into database Here’s how this should be done: add_action( ‘wp_ajax_send_projectmessage’, ‘send_projectmessage’ ); function send_projectmessage() { global $wpdb; check_ajax_referer( ‘send_projectmessage’, ‘send_projectmessage_nonce’ ); $projectid = sanitize_text_field( … Read more
I manage to solved it by adding this code (at the bottom) to the YOUR BLOG THEMES my path : wp-content/themes/twentysixteen/function.php: function ws_register_images_field() { register_rest_field( ‘post’, ‘images’, array( ‘get_callback’ => ‘ws_get_images_urls’, ‘update_callback’ => null, ‘schema’ => null, ) ); } add_action( ‘rest_api_init’, ‘ws_register_images_field’ ); function ws_get_images_urls( $object, $field_name, $request ) { $medium = wp_get_attachment_image_src( get_post_thumbnail_id( … Read more
No, it is not possible. Nonce is generated on server as a function of domain name, user information, action, time, etc. This is made especially to distinguish requests from one server to another.
This is how I have used the default BP ajax queries/scripts in a custom BuddyPress theme: (gist with code: https://gist.github.com/3154297 ) function bp_custom_include_ajax() { global $bp; require_once( BP_PLUGIN_DIR . ‘/bp-themes/bp-default/_inc/ajax.php’ ); if ( !is_admin() ) { // Register buttons for the relevant component templates // Messages button if ( bp_is_active( ‘messages’ ) ) add_action( ‘bp_member_header_actions’, … Read more
You have nothing specific to do to “load” modified php code in WordPress. All files are just loaded as is at execution time (ie when the HTTP request is processed by the server). You just have to verify that your plugin is active. Your curl command is malformed. Use this instead : curl -X POST … Read more
Seems to me that the only problem is that you put the full approve url in the link, in this ways when you click the link you trigger the ajax and open the page url in the link. To be more clear your link is something like: <a class=”p3-comment-moderation” href=”https://wordpress.stackexchange.com/questions/128383/admin-ajax.php?action=p3_comment_approve&comment_id=123&nonce=xxxxx” data-comment_id=”123″ data-nonce=”xxxxx”>Approve</a> thanks to the … Read more