I’m having a security issue with some wordpress code. Apparently this first line of code is illogical, and I don’t understand what to do to fix it. I’ve tried setting nonce on the page in various ways, and the code listed below is part of the menu function and was the way to get the code to work with nonce. On different pages a url variable will need to be grabbed. If nonce isn’t set in the post data (as is the case with a pop up with dynamically loaded content so no new page load, and no new nonce), then I use check admin referer instead, and if it is set then I verify the nonce, and if I’m don’t need to get a variable then I do neither. But I’m told this is illogical because nonce should always be set and not empty. So I’m at a loss for what to do. I can’t find a way to set nonce the normal way for a pop up. Can anyone explain this better to me?

if ((isset($_GET['action']) && !empty($_GET['action'])) && isset($_GET['page']) && $_GET['page'] == 'wp-scraper' && (!isset($_POST['_wpnonce']) && empty($_POST['_wpnonce']) && check_admin_referer('wp_scraper_url'))) {
 $action = $_GET['action'];
} elseif ((isset($_GET['action']) && !empty($_GET['action'])) && isset($_GET['page']) && $_GET['page'] == 'wp-scraper' && (isset($_POST['_wpnonce']) && !empty($_POST['_wpnonce']) && check_ajax_referer('wpsf-save-wpscraper', '_wpnonce'))) {
$action = $_GET['action'];
} else {
$action = 'add';
}

It seems like the logic here should be written as:

(isset($_POST['_wpnonce']) && !empty($_POST['_wpnonce']) && check_admin_referer('wp_scraper_url'))

Which will ensure that $_POST[‘_wpnonce’] is set and is NOT empty

but it breaks the code

Any help would be greatly appreciated