Resolved
Reported for: Advanced Custom Fields Multilingual 2.1.3
Resolved in: Advanced Custom Fields 6.3.6
Overview of the issue
You may encounter a conflict between WPML and Advanced Custom Fields (ACF) that affects field validation during Ajax requests. Specifically, nonce verification fails when WPML is active, causing ACF field validations to be bypassed in some cases.
Workaround
If you are experiencing a similar situation in your website, please start a chat in our assistance channel.
Hello,
This is issue seems to be there since a long time now.
If i refer to this ticket (https://wpml.org/forums/topic/wpml-4-6-11-and-acf-pro-conflict-wrong-validation-of-acf-select-fields/) it has been there for more than a month and no communication about it
As a developper, I investigated and I found where ARE the issues.
The main problem starts in the function ajax_validate_save_post() inside ACF plugin : /acf-pro/includes/validation.php (line 132)
In line 135, the function acf_verify_ajax() is called and it returns FALSE when WPML is installed.
From there I investigated in the POST data submitted in AJAX
I noticed that when WPML is installed the field „nonce“ is no longer the last field submitted. Instead it is sent juste after the post_content…. hmmm very strange !
First I was looking for JS data that could overwrite what it sent through AJAX but I cannot find anything. It took me another few minutes to realize that when I look in the source code of the page, if I search for string {id=“nonce“} (without brackets) I can find 2 occurences… but only when WPML is enabled
So the temp fix is to remove the wp_create_nonce() added near the 2 selects „Language of this %s“ and „Translation Priority“
To do that I commented lines 104 and 140 inside WPML plugin : WPML_dir/menu/post-menus/post-edit-screen/wpml-meta-boxes-post-edit-html.class.php
Both line call the function wp_nonce_field() and set name to „nonce“
Hello GreenPig,
Thank you for all the important information and possible workaround. 🙂
Our devs have already identified the same issue and it started after ACF 6.3.2. We are in communication with ACF team, however as it may involves changes for both teams, it may take a moment.
We will keep this erratum updated.
Thank you for your understanding.
Hi Andrés,
Would you have any update on resolving the issue with ACF team?
Kind regards,
Emile
Hello Emile,
We don’t have yet a new version available fixing this issue. However, we are in communication with ACF team as it may involves changes for both teams, but it may take a moment.
One possibility is to downgrade to ACF 6.3.2 in the meantime.
Thank you for your understanding.
Thanks Andrés.
Actually the last version which works correctly is the 6.3.1.2, but it has a vulnerability.
So, we will wait for the patch.
Thanks for the hint, Emile. 🙂
We will keep you updated.
Hi Emile,
I posted a quick fix in my initial reply. You can do as follow :
Open file : /wp-content/plugins/sitepress-multilingual-cms/menu/post-menus/post-edit-screen/wpml-meta-boxes-post-edit-html.class.php
Comment lines 104 and 140
(Both line call the function wp_nonce_field() and should not use the name “nonce”)
Hi !
I just noticed the release of WPML 4.6.13 and ACFML 2.1.4 but issue is still present
Indeed, ACFML 2.1.4 didn’t include a fix.
We will keep this page updated.
Hello everyone,
Just to let you know that today’s release from ACF 6.3.6 should fix this issue.