=== Wordpress File Upload Pro === Contributors: nickboss Donate link: http://www.iptanus.com/support/wordpress-file-upload Tags: file, upload, ajax, form, page, post, sidebar, responsive, widget, webcam, ftp Requires at least: 2.9.2 Tested up to: 6.6.2 Stable tag: "trunk" License: GPLv2 or later License URI: http://www.gnu.org/licenses/gpl-2.0.html Simple yet very powerful plugin to allow users to upload files to your website from any page, post or sidebar and manage the uploaded files == Description == Wordpress File Upload Pro is a **[GDPR](https://www.gdpr.eu/) compliant** plugin that enables you, or other users, to upload files to your WordPress website from any page easily and securely by using shortcodes. The characteristics of the plugin are: * It enables uploads of files from a **page**, **post** or **sidebar** (as a widget). * It provides a nice upload form using **Material UI** React components. * It captures **video**/**screenshots** from the **webcam** and uploads it. * It is **responsive** and uses the latest HTML5 technology, however it will also work with old browsers and mobile phones. * It supports additional **form fields** (like checkboxes, text fields, email fields, dropdown lists etc). * It can upload files of **unlimited size**, regardless of web server restrictions. * It can upload files to a **Dropbox**, **Google Drive**, **Microsoft OneDrive**, **Amazon S3** account or to an **FTP** server. * **Multiple** instances of the plugin are supported. * It can work as a simple contact (or any other type of) form and file can be **optional**. * It allows selection and upload of **many files** at the same time. * It allows selection and upload of **directories**. * It includes a file list **viewer** for viewing, downloading or deleting files from a page or post. * It creates and then displays **thumbnails** of the uploaded files (images and PDFs) * Users can also **view**, **rename**, **move**, **download** or **delete** their uploaded files from the Dashboard. * It supports **drag and drop** of files. * It includes an overall upload **progress bar**. * It includes details and progress bars for each file individually. * It includes the **Google Recaptcha** for checking user before file upload. * It allows image files to be shown as image **gallery** from within the page. * It includes an **Admin Bar** item that displays the number of new uploaded files. * It includes an **Uploaded Files** top-level menu item in the Dashboard, from where admins can view the uploaded files. * It includes a **File Browser** in the Dashboard for administrators to manage the files. * It supports localization and **multilingual** character sets. * Uploaded files can be added to **Media**, or be attached to the current page. * Uploaded files can be added to a **NextGEN** gallery. * It is highly **customizable** with many (more than 50) options. * It produces **notification** messages send through **e-mail** and **Facebook Messenger**. * It supports **redirection** to another url after successful upload. * It supports **filters** and **actions** so that programmers can extend the plugin. * It supports **logging** of upload events or management of files, which can be viewed by admins through the Dashboard. * You can create you shortcode very easily by using the included Shortcode Composer in the plugin's settings inside Dashboard. * It supports the new **Gutenberg** editor and includes custom **blocks** so that it can be easily added in posts and pages. * It includes a **css editor** to better style the plugin using custom css. * It supports code **hooks** so that filters and actions can be implemented easily. * It comes with **full technical support**. The plugin is translated in the following languages: * Portuguese, kindly provided by Rui Alao * German * French, kindly provided by Thomas Bastide of http://www.omicronn.fr/ and improved by other contributors * Serbian, kindly provided by Andrijana Nikolic of http://webhostinggeeks.com/ * Dutch, kindly provided by Ruben Heynderycx * Chinese, kindly provided by Yingjun Li * Spanish, kindly provided by Marton * Italian, kindly provided by Enrico Marcolini https://www.marcuz.it/ * Polish * Swedish, kindly provided by Leif Persson * Persian, kindly provided by Shahriyar Modami http://chabokgroup.com * Greek Please note that old desktop browsers or mobile browsers may not support all of the above functionalities. In order to get full functionality use the latest versions browsers, supporting HTML5, AJAX and CSS3. == Installation == 1. First install the plugin by downloading the .zip file from www.iptanus.com and install it from the Plugins section of your Dashboard. 1. Deactivate the Free version of the plugin from Plugins section of your Dashboard, if you have it installed and active. 1. Activate the Professional version from Plugins section of your Dashboard. 1. In order to use the plugin simply go to the Dashboard / Settings / Wordpress File Upload and follow the instructions in Plugin Instances or alternatively put the shortcode [wordpress_file_upload] in the contents of any page. 1. Open the page on your browser and you will see the upload form. 1. You can change the upload directory or any other settings easily by pressing the small edit button found at the left-top corner of the upload form. A new window (or tab) with pop up with plugin options. If you do not see the new window, adjust your browser settings to allow pop-up windows. 1. Full documentation about the plugin options can be found at http://www.iptanus.com/wordpress-plugins/wordpress-file-upload/ (including the Pro version) A getting started guide can be found at http://www.iptanus.com/getting-started-with-wordpress-file-upload-plugin/ == Frequently Asked Questions == = Will the plugin work in a mobile browser? = Yes, the plugins will work in most mobile phones (has been tested in iOS, Android and Symbian browsers as well as Opera Mobile) = Do I need to have Flash to use then plugin? = No, you do not need Flash to use the plugin. = I get a SAFE MODE restriction error when I try to upload a file. Is there an alternative? = Your domain has probably turned SAFE MODE ON and you have restrictions uploading and accessing files. Wordpress File Upload includes an alternative way to upload files, using FTP access. Simply add the attribute **accessmethod="ftp"** inside the shortcode, together with FTP access information in **ftpinfo** attribute. = Can I see the progress of the upload? = Yes, you can see the progress of the upload. During uploading a progress bar will appear showing progress info, however this functionality functions only in browsers supporting HTML5 upload progress bar. = Can I upload many files at the same time? = Yes, but not in the free version. If you want to allow multiple file uploads, please consider the [Professional](http://www.iptanus.com/support/wordpress-file-upload/ "Wordpress File Upload support page") version. = Where do files go after upload? = Files by default are uploaded inside wp-content directory of your Wordpress website. To change it use attribute uploadpath. = Can I see and download the uploaded files? = Administrators can view all uploaded files together with associated field data from the plugin's Settings in Dashboard. The [Professional](http://www.iptanus.com/support/wordpress-file-upload/ "Wordpress File Upload support page") version of the plugin allows users to view their uploaded files, either from the Dashboard, or from a page or post. = Are there filters to restrict uploaded content? = Yes, you can control allowed file size and file extensions by using the appropriate attribute (see Other Notes section). = Are there any upload file size limitations? = Yes, there are file size limitations imposed by the web server or the host. If you want to upload very large files, please consider the [Professional](http://www.iptanus.com/support/wordpress-file-upload/ "Wordpress File Upload support page") version of the plugin, which surpasses size limitations. = Who can upload files? = By default all users can upload files. You can define which user roles are allowed to upload files. Even guests can be allowed to upload files. If you want to allow only specific users to upload files, then please consider the [Professional](http://www.iptanus.com/support/wordpress-file-upload/ "Wordpress File Upload support page") version of the plugin. = What security is used for uploading files? = The plugin is designed not to expose website sensitive information. It has been tested by experts and verified that protects against CSRF and XSS attacks. All parameters passing from server to client side are encoded and sanitized. For higher protection, like use of captcha, please consider the [Professional](http://www.iptanus.com/support/wordpress-file-upload/ "Wordpress File Upload support page") version of the plugin. = What happens if connection is lost during a file upload? = In the free version the upload will fail. However in the Pro version the upload will resume and will continue until the file is fully uploaded. This is especially useful when uploading very large files. = The plugin does not look nice with my theme. What can I do? = There is an option in plugin's settings in Dashboard to relax the CSS rules, so that buttons and text boxes inherit the theme's styles. If additional styling is required, this can be done using CSS. The Professional version of the plugin allows CSS rules to be embed in the shortcode. == Screenshots == 1. A screenshot of the plugin in its most simple form. 2. A screenshot of the plugin showing the progress bar. 3. A screenshot of the plugin showing the successful upload message. 4. A screenshot of the plugin with additional form fields. 5. A screenshot of the plugin with subfolder selection. 6. A screenshot of the plugin in a sidebar. 7. A screenshot of the shortcode composer. 8. A screenshot of the file browser. == Changelog == = 4.24.12 = * verified compatibility with Wordpress version 6.6.2 * fixed directory traversal security issue in wfu_file_downloader.php file * extended csv, xml and m4a mime types * fixed warning in wfu_prepare_captcha_block() with $wp_scripts = 4.24.11 = * corrected bug where files with extensions containing capital letters were rejected due to MIME check failure = 4.24.10 = * corrected bug where FTP uploads where all rejected after release of version 4.24.9 due to fail of MIME type check = 4.24.9 = * verified compatibility with Wordpress version 6.6.1 * limited the number of whitelisted extensions to those having an associated MIME type, in order to avoid XSS attacks * added MIME type validation of uploaded files * added advanced variable WFU_MIMETYPE_VAL_EXCEPTIONS that enables exceptions when validating the MIME type of uploaded files * added scanning of textual uploaded file contents for detecting PHP and Javascript tags * added scanning of textual uploaded file contents for heuristic analysis and detection of suspicious content * added advanced variable WFU_FILESCAN_BUFFERSIZE that defines the size of the chunk when reading file contents sequencially * added advanced variable WFU_FILESCAN_OVERLAPSIZE that defines the size of the overlapping of the chunks when reading file contents sequencially * added advanced variable WFU_FILESCAN_SECURITY_LEVEL that defines the security level when scanning uploaded files = 4.24.8 = * verified compatibility with Wordpress version 6.5.5 * escaped userdata values in File Browser, File Details page, View Log and front-end file viewer, in order to avoid XSS attacks * removed the ability to upload files outside /wp-content folder, in order to avoid directory traversal attacks * removed the ability to edit the shortcode for authors and contributors, in order to avoid CSRF attacks * stripped tags and escaped dir query param in File Browser in order to avoid reflected XSS attacks = 4.24.7 = * verified compatibility with Wordpress version 6.5.2 * fixed bug in Date, Time and DateTime user fields that were not working when Material UI theme was active * added Country List user field that prompts the user to make a selection from a list of countries = 4.24.6 = * sanitized uploadbutton attribute input in order to protect against Stored XSS attacks * fixed bug not showing RecaptchaV2 captcha in the upload form when MaterialUI theme was active = 4.24.5 = * added option dropboxduplicates that controls whether duplicates to Dropbox will be autorenamed or overwrite existing files * added external customizable templates folder /uploads/wfu_templates = 4.24.4 = * verified compatibility with Wordpress version 6.4.3 * added upload form option webcamstartoff to start webcam deactivated * corrected bug where Dropbox could not be reset when the stored access token had the old format before version 4.24.3 = 4.24.3 = * verified compatibility with Wordpress version 6.4.2 * upgraded Dropbox API to version 0.4.2 to correct issue with short tokens expiring after 4 hours, now Dropbox requires PHP version 7.3 or newer * corrected PHP errors appearing when elementor content is an array = 4.24.2 = * corrected bug where the plugin was generating a fatal PHP error during activation if allow_url_fopen was 0 * added debug log options in Maintenance Actions: activate/deactivate debug logging, download and reset debug log data = 4.24.1 = * verified compatibility with Wordpress version 6.4.1 * added nonce to visual editor and switched WFU_SHORTCODECOMPOSER_NOADMIN to false to avoid CSRF attacks through save_shortcode AJAX action * fixed bug with imagetypelib throwing error on some occasions when PHP version is lower than 7.1 * deactivated imagetypelib check for ftp uploads because it does not support it = 4.24.0 = * added license internal extension that adds license functionality in the plugin * defined a generic license for Pro version * removed the extensions from the Pro version, now the extensions are added automatically to the plugin after license verification * added License tab in Pro version, which is used to provide info about the license and activate it * added license check in plugin activation and every 12 hours * added license reset button in Maintenance Actions * converted all extensions to external * modified Extensions tab so that extensions can be installed and uninstalled * added WFU_EXTENSIONS_RESTOREFROMFILE advanced option which defines whether extension installation can be done manually by a file * extensions can be installed through Extensions tab either automatically or by uploading the extension's zip file * added standalone internal extension for the standalone version of the plugin * updated Iptanus servers to verify the plugin license and deliver the extensions * updated Iptanus account page to show license information and provide advanced license options, such as the standalone version * verified compatibility with Wordpress version 6.3.2 = 4.23.3 = * added response header information in wfu_get_request() and wfu_post_request() functions * fixed security issue that could allow users with admin access to perform XSS attacks through the redirect link attribute * corrected notice when transferring file to Google Drive or Microsoft OneDrive from File Browser = 4.23.2 = * verified compatibility with Wordpress version 6.3.1 * fixed bug where extensions could not be activated/deactivated from plugin's Dashboard area Extensions tab = 4.23.1 = * corrected compatibility issue with Divi Theme Builder = 4.23.0 = * external libraries of extensions moved inside the extensions, so that they are completely separated by the core plugin, as a preparation step for forecoming version 5 * added Home Domain information in Main tab of Dashboard area of the plugin * corrected bug where and templates were not placed correctly inside the shadow DOM * added _wfu_file_upload_output_inner filter for customizing inner upload form HTML before it is processed by the templating system * code improvements in auto-updater to avoid errors when $transient is null = 4.22.2 = * updated vendor libraries = 4.22.1 = * fixed bug in WFU.captcha.core() function that was breaking upload form in block themes when Material UI was activated * fixed bug in wfu_webcam_update_preview() function that was breaking upload form when uploadid was greater than 1 = 4.22.0 = * fixed warnings shown when opening the front-end file viewer's visual editor * added webcamselfile attribute in upload form shortcode so that webcam can work in parallel with file selection * added webcamswitch attribute in upload form shortcode to enable/disable camera switch button in webcam * added WFU_WEBCAMSWITCHMODE advanced variable attribute that defines the camera switch mode, 'side' for switching between front and rear cameras, 'device' for switching between available video devices * added WFU_MEDIARECORDER_MIMETYPE advanced variable attribute that defines a specific MIME type for webcam MediaRecorder * added webcambg attribute that defines the background color of the webcam capture box * webcam video width and height changed so that they correspond to ideal resolution of the camera * webcam capture feature improved so that screenshots have the camera's resolution * webcam playback of recorded video is now working on iOS devices * added extended support of webcam feature for mobile devices * several other code improvements in webcam feature * correction of bugs related to wfuca_update_option() function in alternative Iptanus server = 4.21.7 = * fixed bug in wfu_exclude_notifications_from_comments() which crashes the website when Woocommerce is present = 4.21.6 = * improved webcam operation on iOS devices * code modifications to hide WFU admin notifications from Comments Dashboard menu page = 4.21.5 = * added Themes tab in upload form visual editor to select a theme * added MaterialUI theme in upload form * added upload form attributes to define basic colors and dark mode in Material UI theme * added color picker with transparency in plugin's visual editor * fixed small bug with time indication in webcam feature of the upload form * improvements in plugin auto-update feature = 4.20.0 = * added Notifications tab in Dashboard area of the plugin * fixed bug with refresh token in Google Drive * improved Google Drive, Microsoft OneDrive, Dropbox and Amazon S3 functionalities so that admin is notified if there is something wrong with their activation * fixed bug in upload form when captcha is added = 4.19.2 = * codes improvements in plugin settings to protect against XSS attacks * code improvements in backend file browser to avoid directory traversal attacks * permanent fix for compatibility with block themes = 4.19.1 = * updated vendor libraries to their latest version * added logging of start and end time in uploader metrics * added userdata in wfu_before_upload filter * fixed bugs when uploading in classic HTML forms mode = 4.19.0 = * added compatibility with block themes * added shortcode attributes blockcompatibility and browserblockcompatibility for controlling block theme compatibility * added shortcode attribute uploaderids in front-end file viewer to display files that have been uploaded only by specific upload forms = 4.18.1 = * fixed compatibility issues with PHP 8.1 or higher * changed uploadform logic so that CSS pseudoselectors for Select Files button work * changed directory upload logic so that files and directories can be selected * added shortcode attribute "forcedir" to force selection of directories only = 4.18.0 = * added the ability to select (or drag) and upload directories * added attribute "Directory Upload" in the visual editor of the upload form in order to allow/forbid selection of directories = 4.17.0 = * modified Google Drive authorization process to comply with Google's guidelines * added Extensions page in Dashboard to activate/deactivate extensions = 4.16.4 = * sanitized page title in all places where it is retrieved to avoid XSS attacks = 4.16.3 = * improved sanitization and escaping of shortcode attributes to avoid XSS attacks * file type .svg moved to blacklist to avoid XSS attacks coming from scripts inside SVG files * added security check to forbid uploads inside wp-content/plugin directory * improved handling of videoname and imagename file uploader shortcode attributes to avoid directory traversal attacks * improved /lib loader to avoid arbitrary code execution through injected image files * all wfu_blocks.php functions became redeclareable * corrected bug where uploads were not working when dragdrop was deactivated = 4.16.2 = * corrected additional PHP8 warnings: "PHP Deprecated: Required parameter ... follows optional parameter ... in wfu_gdrive_functions.php" = 4.16.1 = * corrected PHP8 warning: "PHP Deprecated: Required parameter $GService follows optional parameter $parentID in wfu_gdrive_functions.php" * added IamException.php in Amazon S3 library * corrected $_SESSION variable problem in maintenance purge function = 4.16.0 = * major restructuring of external libraries * added option to upload files to an Amazon S3 bucket * added option in Settings to connect to an Amazon S3 account * added options in upload form's shortcode to upload files to an Amazon S3 bucket * added options in Maintenance Actions to reset or clear Amazon S3 uploads * added Remote Files section in Dashboard area of the plugin from where admins can manage remote files stored in cloud services * dropbox v1 version removed * visual editor edit button misalignment fixed * updated Facebook Messenger page access token * corrected drag-drop bug so that it is not allowed to add files on an upload form by dragging during a running upload * corrected echo problem when recording from webcam with sound * Selective's Image Type library functions became an extension so that it is loaded only when necessary = 4.15.0 = * added image file check using Selective's Image Type library * COOKIEHASH bug corrected * improved support for FTP and SFTP uploads, which are now included in all plugin file viewers * credentials in FTP and SFTP paths are stripped from the paths * corrected File Detais to File Details * corrected WFU_USERFILTER advanced option description * get_option( "wordpress_file_upload_unfinished_data" ) corrected to get_option( "wordpress_file_upload_unfinished_data", array() ); in functions.php * regex "/