Conflicting save_post functions when passing the post id and saving custom meta boxes for different post types

3 comments

1. After doing some more research I found that:

   • Instead of hooking the add_meta_box function into admin_menu it should be hooked into add_meta_boxes
   • Instead of the foreach loop use the update_post_meta function on the save function
   • Instead of using the wp_nonce_field the data can be sanitized using esc_attr and strip_tags
   • To pass the post id to the save meta box function you don’t need to include the additional $post variable
   • You have to add a conditional state for the post type on the save function
   • You have to call global $post on the save function

   The new and much simpler code for adding both meta boxes:

   add_action( 'add_meta_boxes', 'c3m_sponsor_meta' );
   
   function c3m_sponsor_meta() {
       add_meta_box( 'c3m_sponsor_url', 'Sponsor URL Metabox', 'c3m_sponsor_url', 'sponsor', 'side', 'high' );
   }
   
   function c3m_sponsor_url( $post ) {
       $sponsor_url = get_post_meta( $post->ID, '_sponsor_url', true);
       echo 'Please enter the sponsors website link below';
       ?>
           <input type="text" name="sponsor_url" value="<?php echo esc_attr( $sponsor_url ); ?>" />
       <?php
   }
   
   add_action( 'save_post', 'c3m_save_sponsor_meta' );
   
   function c3m_save_sponsor_meta( $post_id ) {
       global $post;
       if( $post->post_type == "sponsor" ) {
           if (isset( $_POST ) ) {
               update_post_meta( $post_ID, '_sponsor_url', strip_tags( $_POST['sponsor_url'] ) );
           }
       }
   }
   
   add_action( 'add_meta_boxes', 'c3m_video_meta' );        
   
   function c3m_video_meta() {
       add_meta_box( 'c3m_video_embed_code', 'Video Embed Code Meta Box', 'c3m_video_embed_code', 'video', 'normal', 'high' );
   }
   
   function c3m_video_embed_code( $post ) {
       $embed_code = get_post_meta( $post->ID, '_embed_code', true);
       echo 'Please enter the video embed code below';
       ?>
           <input type="text" name="embed_code" value="<?php echo esc_attr( $embed_code ); ?>" />
       <?php
   }
   
   add_action( 'save_post', 'c3m_save_video_meta' );
   
   function c3m_save_video_meta( $post_id ) {
       global $post;
       if( $post->post_type == "video" ) {
           if (isset( $_POST ) ) {
               update_post_meta( $post_ID, '_embed_code', strip_tags( $_POST['embed_code'] ) );
           }
       }
   }
   

   Log in to Reply

2. Instead of using the wp_nonce_field the data can be sanitized using esc_attr and strip_tags

   I don’t follow the logic of escaping data in place of using a nonce? the example given on wordpress.org uses a nonce to verify intention, and also escapes the data before inserting it. how are those two things related?

   Log in to Reply

3. you should not need to global $post, you definitely can pass it into the function.

   i had 2 different save_post actions, one for quick edit and one for a metabox on the same post type and i ended up combining them to get rid of undefined index notices about my different nonces. since the 2 items were covering the same data i used the same nonce generating name.

   anyway, i would consider combining your save_post functions into 1… OR doing a check on the post type before you check the nonce.

   add_action( 'save_post' , 'c3m_save_meta' , 20, 2); //moved priority to later. you had priority 1 so is possible that WP actions were happening after your code
   
   function c3m_save_meta( $post_id , $post ) {   
   
      // verify if this is an auto save routine. If it is our form has not been submitted, so we dont want to do anything
      if ( defined('DOING_AUTOSAVE') && DOING_AUTOSAVE ) return $post_id;
   
      //don't save if only a revision
      if ( $post->post_type == 'revision' ) return $post_id;   
   
      // Check permissions
      if ( 'page' == $post->post_type ) {
       if ( !current_user_can( 'edit_page', $post_id ) ) return $post_id;
      } else {
       if ( !current_user_can( 'edit_post', $post_id ) ) return $post_id;
      }      
   
     //save video post meta
     if( $post->post_type == "video" && wp_verify_nonce( $_POST [ 'video_nonce' ], __FILE__ )) {
        if (isset( $_POST['_embed_code'] ) ) {
           update_post_meta( $post_ID, '_embed_code', esc_attr( $_POST['embed_code'] ) );
        }
     }
   
     //save sample bacon post meta
      if( $post->post_type == "bacon" && wp_verify_nonce( $_POST [ 'bacon_nonce' ], __FILE__ )) {
         if (isset( $_POST['_bacon_code'] ) ) {
           update_post_meta( $post_ID, '_bacon_code', esc_attr( $_POST['bacon_code'] ) );
         }
      }
   }
   

   or you could use the same nonce name for both metaboxes. can’t comment on the security of this, but seems ok to me as WP appears to do the same thing with _wpnonce in both quick edit and regular edit modes. WP also doesn’t seem to have a separate nonce for every metabox.

   function c3m_save_meta( $post_id , $post ) {   
          if(!wp_verify_nonce( $_POST [ 'c3m_nonce' ], __FILE__ )) return $post_id; //change both nonces to name=c3m_nonce
   
          // verify if this is an auto save routine. If it is our form has not been submitted, so we dont want to do anything
          if ( defined('DOING_AUTOSAVE') && DOING_AUTOSAVE ) return $post_id;  
   
          //don't save if only a revision
          if ( $post->post_type == 'revision' ) return $post_id; 
   
          // Check permissions
          if ( 'page' == $post->post_type ) {
           if ( !current_user_can( 'edit_page', $post_id ) ) return $post_id;
          } else {
           if ( !current_user_can( 'edit_post', $post_id ) ) return $post_id;
          }      
   
         //save video post meta
         if( $post->post_type == "video") {
            if (isset( $_POST['_embed_code'] ) ) {
               update_post_meta( $post_ID, '_embed_code', esc_attr( $_POST['embed_code'] ) );
            }
         }
   
         //save sample bacon post meta
          if( $post->post_type == "bacon" && wp_verify_nonce( $_POST [ 'bacon_nonce' ], __FILE__ )) {
             if (isset( $_POST['_bacon_code'] ) ) {
               update_post_meta( $post_ID, '_bacon_code', esc_attr( $_POST['bacon_code'] ) );
             }
          }
       }
   

   Log in to Reply