NonceVerification overzealous ?

[jrfnl]

The following snippet of code triggers the WordPress.CSRF.NonceVerification sniff.

if ( ! isset( $_POST['field'] ) ) {
	// Do something (not using the post variable).
}

As this is checking whether a variable is not set, I believe that the error is thrown erroneously.

Opinions ?

[jrfnl]

Related #572

[westonruter]

Yeah, I agree. We should only start flagging accessing input vars once the value is being used. An isset() or empty() call shouldn't qualify as “using”.

[JDGrimes]

In this case, because you are checking that the value is not set, the sniff may be a bit overzealous. However, I wouldn't favor making it ignore all isset() and empty() checks. Even if no submitted values are being used, the fact that user input is being checked at all indicates that a user action is being reacted to, and thus CSRF protection is likely still needed.

[kkmuffme]

Even if no submitted values are being used, the fact that user input is being checked at all indicates that a user action is being reacted to

This is only true if you check that something exists. When checking that something does NOT exist, it makes no sense:

if ( empty( $_GET['author'] ) ) {    
    echo 'This is not an author page';
    exit;
}

In fact it's impossible to check for a nonce on something that does NOT exist.