fatal error when calling wp_create_nonce in options-init.php - wordpress

Question

I am developing a wordpress plugin using the wordpress boilerplate template. Additionally, I am using Redux Framework as an options framework. I load the options-init.php in the load_dependencies() function of the main include file.
Everything works fine. However, when calling wp_create_nonce in options-init.php I get a Fatal error: Uncaught Error: Call to undefined function wp_create_nonce()
Why is it and how to solve it?

Answer 1

wp_create_nonce() is a pluggable function loaded after plugins are loaded.
BEFORE call pluggable.php file:
require_once( ABSPATH . 'wp-includes/pluggable.php' );
Thanks.

Answer 2

I found the solution myself, although not sure if it is correct/best practice.
I moved the include of the redux framework into a seperate class which I call via action hook on ''plugins_loaded'
//Initiate Redux Framework
$this->loader->add_action( 'plugins_loaded', $plugin_admin_redux, 'init_redux_framework' );
Inside the method init_redux_framework() I just put the require once to the admin-init.php
Interestingly though that adding it on 'init' instead of 'plugins_loaded' was too late for Redux to be initialized.

Answer 3

Why do you need wp_create_nonce() inside plugin?
Nonce is usually included in a hidden HTML form field or as a part of an URL and therefore sent with a request by submitting a form field or visiting a link:
<?php
// Create an nonce for a link.
// We pass it as a GET parameter.
// The target page will perform some action based on the 'do_something' parameter.
$nonce = wp_create_nonce( 'my-nonce' );
?>
<a href='myplugin.php?do_something=some_action&_wpnonce=<?php echo $nonce; ?>'>Do some action</a>
And inside plugin files you can verify nounce:
wp_verify_nonce( $nonce, 'my-nonce' );

Answer 4

wp_create_nonce() is a pluggable function loaded after plugins are loaded.
Be sure to call your class method on proper hook, 'init' (or later) is a good place: once your function output something (a form) there is no reason to run earlier than that.
wp_verify_nonce() receives 2 arguments:
$nonce
$action
1st argument is the nonce, and comes from the request
In fact, wp_verify_nonce() have to be used like so:
// here I assume that the form is submitted using 'post' as method
$verify = wp_verify_nonce($_POST['message-send']);
So the first argument passed to wp_verify_nonce() is exactly the value that is present in the hidden field
2nd argument: the wp_create_nonce() method
Regarding the second argument, it depends on how you build the nonce value.
E.g. if you did:
<?php $nonce = wp_create_nonce( 'custom-action' ); ?>
<input type="hidden" name="message-send" value="<?php echo $nonce ?>" />
Then you need to do:
$verify = wp_verify_nonce( $_POST['message-send'], 'custom-action' );
So, the second argument is what was used as argument to wp_create_nonce().
2nd argument: the wp_nonce_field() method
If you created the nonce using wp_nonce_field() like:
wp_nonce_field( 'another_action', 'message-send' );
Then you need to verify the nonce like so:
$verify = wp_verify_nonce( $_POST['message-send'], 'another_action' );
So, this time, the action is whatever passed as first argument to wp_nonce_field().
Recap:
To pass wp_verify_nonce() validation you need to pass 2 arguments to the function, one is the value in the nonce hidden field, the other is the action, and depends on how the nonce value was built.