Member Avatar for WpExplorerr

Hello :)

Around a month ago, i got a custom bookmarklet coded for my wordpress blog and on top of the bookmarklet .js code there is this line

var token = 'QzEJ5PJ3/RRO4cubQQiKKNg5au6SESUSkQOK5w9HKFgH6GxVu1NNilA5TYqoMBbz6sKdZP6eQ4GeLyZ1Ht5S/VrHIISvHXKFPxXNUZmRp1M=';

I think this is some sort of API key or something that’s specific to a wordpress installation right? cause when i move the code from one blog to another, it does not work.
Unfortunately the coder that i hired is unreachable now and i am not sure how and where to fetch this key from.
Can someone please point me to where i can get this value off my wordpress instalation?

Entire Code for the Plugin / Bookmarklet
(Bookmarklet.php)
(Bookmarklet.js)

Thanks and Kind Regards.
Alex M.

  • 3 Contributors
  • 2 Replies
  • 369 Views
  • 5 Days Discussion Span
  • Latest Post Latest Post by Taywin

Dani AI

Generated

Short summary and pragmatic next steps (grounded in the replies from , and ).

The failure when you move the bookmarklet to another WordPress site usually means the client-side piece and the server-side check no longer match (and some plugins also enforce a hostname pattern). For a quick repair, update the same secret/value on both sides so they match. For a safer, long‑term fix, replace the static secret with a WordPress-built mechanism (short-lived nonces or the REST API) and avoid embedding long-lived secrets in client-side code.

Quick troubleshooting checklist

  • Locate the plugin files (wp-content/plugins/...) and search for the hard-coded secret or the server-side check that rejects requests from unknown hosts.
  • Reproduce the request with the browser DevTools Network tab (or curl) to inspect the request URL, query/body parameters and the server response code/body.
  • If the server returns a 4xx, look for referer/hostname checks or a secret-value comparison in the PHP handler; update the client and server together for a short-term fix.

Recommended secure approaches

  • Short term: keep the same site-specific secret but rotate it and store it server-side (do not publish credentials in public JS).
  • Better: use WordPress nonces for a short-lived, session-tied verification or use the REST API with application passwords for external tooling. Example pattern (very small sketch): generate a nonce server-side and verify it in the handler.
<?php
// server: create a nonce and expose to the bookmarklet landing page
$nonce = wp_create_nonce('bookmarklet_action');
echo "<script>var myBookmarkletNonce = '" . esc_js( $nonce ) . "';</script>";

// handler: verify incoming nonce
check_ajax_referer('bookmarklet_action', 'nonce');

WordPress provides built-in functions for creating/verifying nonces and for REST API authentication; prefer those over static client-side secrets. (developer.wordpress.org)

For programmatic external access consider Application Passwords or REST authentication; do this only over HTTPS and never embed long-lived credentials in public bookmarklets. (developer.wordpress.org)

Hard-coded secrets are a common source of compromise — remove or rotate them and use server-side, short-lived tokens where possible. (owasp.org)

Recommended Answers

All 2 Replies

Member Avatar for cereal

Hi,

see the lines 254 and 263 of the PHP page, the first checks if the token is set by the request (i.e. through javascript), the second is a conditional IF statement that verifies the value of the set token with the hardcoded.

Change the value in the javascript and, accordingly, in the PHP file.

Member Avatar for Taywin

when i move the code from one blog to another

That's the problem. The javascript is checking if your domain starts with http://...labs5.imvges.xyz or https://...labs5.imvges.xyz. If your new blog doesn't start the domain like that, it will reject. If that is the case, update the regex_found variable value to match whatever your new blog is.

PS: The variable token is there just to give a slightly sense of security. It is not an API or anything.

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.