Question

I’m getting a notice and a warning when I try to delete a post or update something:

Notice: Undefined index: vsw_noncename in /mysite/wp-content/plugins/video-sidebar-widgets/class-postmetavideowidget.php on line 296

Warning: Cannot modify header information – headers already sent by (output started at /mysite/wp-content/plugins/video-sidebar-widgets/class-postmetavideowidget.php:296) in /mysite/wp-includes/pluggable.php on line 881

¿Any hints about this? I have tried to fix the Header Information issue by removing spaces in the file as the codex says but without results, so, probably is another thing.

I’m using wordpress 3.4.2, the plugin version is 5.3 (latest) and a custom theme (checked with Theme-Check and no issues found)

Thank you for your help

Answer 1

The plugin has a bug – it is not checking to make sure that the nonce field exists in the $_POST. Many types of actions that call save_post will not have this field, as it is only added on the post editor (line 154 of the plugin).

You should check to make sure that the nonce field exists before validating it. If it does not exist, just return from the function.

To correct it change line 296-297 to read:

if ( !isset($_POST['vsw_noncename']) || !wp_verify_nonce( $_POST['vsw_noncename'], plugin_basename( __FILE__ ) ) )
    return;