Leave a Reply

3 comments

  1. It seems that the action save_post gets fired when sending a post to the trash… Therefore, my custom metadata save function was being activated with no $_POST data to send thru it.

    To circumvent this, I wound up adding a nonce to the save function.

    function wpg_testimonial_author() {
      global $post;
      $custom = get_post_custom($post->ID);
      $testimonial_author_name = $custom['testimonial_author_name'][0];
      $testimonial_author_link = $custom['testimonial_author_link'][0];
      ?>
      <p>
        <label><?php _e("Author's Name:", 'quotable'); ?></label>
        <input name="testimonial_author_name" value="<?php echo $testimonial_author_name; ?>" />
      </p>
      <p>
        <label><?php _e('Attribution Link:', 'quotable'); ?></label>
        <input name="testimonial_author_link" value="<?php echo $testimonial_author_link; ?>" />
        <input type="hidden" name="testimonial_author_noncename" id="testimonial_author_noncename" value="<?php echo wp_create_nonce(plugin_basename(__FILE__).$post->ID); ?>" />
      </p>
      <?php
    }
    
    function wpg_save_testimonial_author($post_id) {
      global $post;
      if (!wp_verify_nonce($_POST['testimonial_author_noncename'], plugin_basename(__FILE__).$post->ID)) {
        return $post->ID;
      }
      if(defined('DOING_AUTOSAVE') && DOING_AUTOSAVE) {
        return $post_id;
      }
      if(defined('DOING_AJAX')) {
        return;
      }
      if(!current_user_can('edit_post')) {
        return $post->ID;
      }
      if($post->post_type == 'revision') {
        return;
      }
      update_post_meta($post->ID, 'testimonial_author_name', $_POST['testimonial_author_name']);
      update_post_meta($post->ID, 'testimonial_author_link', $_POST['testimonial_author_link']);
    }
    add_action('save_post', 'wpg_save_testimonial_author');
    

    Hopefully this might help someone else later…

  2. I have run into the same problem and found even shorter solution (in terms of writing).

    if (isset($_POST['action']) && $_POST['action'] == 'editpost') {
    // do your update_post_meta, delete_post_meta, etc.
    }
    

    I tried to test it now on 5+ WP version and seems to fire only on editing or saving a new post.

  3. Wow, thank you Nero_DCLXVI. Very helpful. For future people looking to implement this, here’s simplified instructions of his solution:

    1. Add this hidden input along with your other custom meta inputs:
    <input 
        type="hidden" 
        name="prevent_delete_meta_movetotrash" 
        id="prevent_delete_meta_movetotrash" 
        value="<?php 
            echo wp_create_nonce( plugin_basename(__FILE__) . $post->ID ); 
        ?>" />
    
    1. Add this right before your update_post_meta() functions.
    if ( ! wp_verify_nonce( 
            $_POST['prevent_delete_meta_movetotrash'], 
            plugin_basename(__FILE__) . $post->ID ) 
        ) { 
        return $post_id; 
    }