richardsweeney/Easy-PayPal-Custom-Fields — pull request #2 by stephenharris (2014-11-20 15:01:25+00:00)
Title: Adds nonce check for intention verification

Hi,

A customer of mine came across a bug in `RPS_eppcf->save_eppcf_meta()`.

In particular `save_eppcf_meta()` is hooked onto `save_post`, which is triggered any time that `wp_insert_post()` is called. The function then kills the processing if the current user cannot edit the post being created. In some contexts this is intentional. E.g. in this case the user is registering for an event, and a booking (post type) is created. Although the current user's actions cause this booking to be created, they do not have permission to edit it. Subsequently, when your callback is called and the page 'dies'.

The problem is that your method is killing the process when a user doesn't have permission to perform X without checking that the user is intending to do X. A nonce check is the best way of doing this. It's primary purpose is to check that the current user actually intended to perform that action (so as to prevent an attacker from 'tricking' a user into performing an action), but it helps to check that your method is required to run.

Thanks :)