Hello all,
I also had the problem of adding both facebook and twitter accounts in WP 4.0 this morning. Now I have found a solution/tweak that temporarily enables you to add the accounts. All you have to do is just commenting 1 line of code.
Short Answer:
1. open file wp-content/plugins/social/lib/social/controller/auth.php, and inside function action_authorized(), look for this code block
if (wp_verify_nonce($nonce, $this->auth_nonce_key($salt)) === false) {
Social::log('Failed to verify authentication nonce.');
echo json_encode(array(
'result' => 'error',
'message' => 'Invalid nonce',
));
exit; //(comment this line to temporarily enable adding accounts, uncomment when finish.)
}
2. comment out the line that says exit;, it is line 88 for me (version 2.11), save and upload if necessary.
(now it becomes:) //exit;
3. Go to yout WP backend, and click the ‘Sign in with Facebook/Twiter’ button, and it should work.
4. For security reason, once you have added your accounts, remember to uncomment line 88.
(now it becomes:) exit;
If it works for you, please leave a comment to let others know.
Long Answer:
For plugin author Alex King and plugin developers:
The problem happens because WP 4.0 has changed the way it creates and verifies nonce. They call this Tie nonces and cookies to expirable sessions. Basically it means WP now use the current session value (along with other variables) to create and verify nonce. Bear this in mind, let take a look at how the plugin runs when the sign in button is clicked (according to my understanding of the plugin).
When the ‘Sign in with Facebook/Twitter’ button is clicked in WP backend, the following happends:
1. Browser sends request to WP, the plugin detects the requests and runs the action_authorize function, which creates a nonce and generates a redirect response and sends to the browser. Note that the nonce is created using the current session, probably as admin.
2. Browser receives the redirect response, and sends a new request to the proxy server.
3. Proxy server processes the request (e.g. contact Facebook/Twitter for confirmation) and sends a request to WP to run the action_authorized function. Note that this request is sent from the proxy server and the proxy server doesn’t have a session with WP. Now the action_authorized function first verifies the nonce before adding the accounts. Because the current session (which doesn’t exist) is different from the session used to create the nonce, WP will fail to verify the nonce and exit the funtion before adding the accounts.
Possible solutions:
A. encode the cookie into the redirect URL, so that the current session is passed to the proxy server. I think this will cause security concerns.
B. avoid using nonce, find other ways
I will leave it to your capable hands to find a proper solution to this problem. Let me know if I can assist further.
Kind Regards,
Cang
