[Kona Macphee]

I’ve recently migrated a couple of websites to WP Multisite and am now using bbPress on various multisite sub-sites. The issue I’m reporting may be specific to multisite, or it may be a new bug after the recent change to WP 4.3 (I’m using bbPress 2.5.8 and WP 4.3).

Context:
On the “Edit Topic” screen, there’s an “Author Information” box including an ID field. When you begin to type text into this box, the admin-ajax action “bbp_suggest_user” should auto-suggest potentially matching users.

Issue:
The user autosuggest is not returning any users, just “-1”. Having dug into the code, the step that’s failing is wp_verify_nonce() in check_ajax_referrer(), which is invoked on line 745 of bbPress file includes/admin/admin.php. The nonce is making it into wp_verify_nonce, but is not matching any expected/acceptable value – so wp_verify_nonce falls out the bottom with a failure.

If I remove the check_ajax_referrer step, the Edit Topic user auto-suggestion works perfectly so it’s definitely the nonce validation step that’s the problem.

Also, I’m NOT using any caching plugin on these sites, and the error exists whether the site uses https or not. It also continues to exist if I disable Wordfence.

[Robkk]

Thanks for finding that bug. I will create a trac ticket for this.

https://bbpress.trac.wordpress.org/ticket/2864

[Kona Macphee]

Hi guys, the ticket was created and has been marked as fixed and closed.

However, the problem is still occurring in bbPress 2.5.12, so the bug has not actually been fixed.

Could somebody please fix this issue? I’m still having to manually patch the bbPress code with every update.

Thanks!