Support Forum

Access Denied and Nonce error

BS BSABantam
BSABantam
Member
Member since Dec 2012
69 posts
Mar 5, 2017 · 9:12 am · Edited

Looking at the Error Log there are usually a few instances of ‘Nonce Error’, sometimes connected with PM’s, but always when moving a Member between User Groups. It gets generated every time. Along with the Error there is always an ‘Access Denied’ pop-up when the Member move is made.

The action is completed successfully and confirmation displayed followed by the pop-up. It appears the problem is not with the actual move but in updating the display. Dismissing the pop-up and refreshing the display by clicking the ‘Usergroups’ tab shows the change has taken place.

This occurs using a full WP/SP Admin account and I have tried the operation after clearing the Browser cache and using a different Logon using just an SP Admin account but the result is the same.

Doesn’t seem to have any impact on the Forum in general but reporting it as requested in the Error Log header.

Screenshot1.pngScreenshot2.png
Screenshot1.png Screenshot2.png

4 Answers

New Answer
YS Yellow Swordfish
Yellow Swordfish
Member
Member since Nov 2008
16,437 posts
Mar 5, 2017 · 11:16 am

Curious. I have just made 3 user moves from different groups and am unable to make it error or fail.

The failure of the nonce check is not actually an error of course. We log it as an error just so we can see it happened but actually it is because of the nonce timeout that WordPress builds in to each nonce – random security key. Refreshing the whole admin from the WP menu down the side automatically creates a new nonce which is why you get straight back into the admin.

I will do some more tests later to see if I can replicate the issue but no luck so far… but there again – my nonce was fresh so a while yet for the timeout to kick in.

BS BSABantam
BSABantam
Member
Member since Dec 2012
69 posts
Mar 5, 2017 · 8:28 pm

OK, thanks for looking into it, I will just add that what I have detailed above happens under the Members Forum Profile (not in WP Admin) and it’s exactly the same whether I have just logged in or been logged in for hours.

MP Mr Papa
Mr Papa
Member
Member since Dec 2006
19,448 posts
Mar 6, 2017 · 2:03 am

any security plugins or server side (such as mod_security) that might be blocking some urls with query args it doesn like?

YS Yellow Swordfish
Yellow Swordfish
Member
Member since Nov 2008
16,437 posts
Mar 6, 2017 · 4:01 am

Sorry @bsabantam – I CAN replicate this now. I thought originally you were referring to making these changes in the admin – User Groups section. My fault for not looking closer at the error log entry you attached.

The question @mr-papa asked above probably has no relevance now I can replicate. I have opened a ticket to get this fixed for forthcoming 5.7.4…