Iptanus File Upload 5.2.0

This release fixes an SQL injection security issue, so we recommend it for every site. It also renews every bundled library, and delivers each extension in a build matched to your PHP version.

A security researcher reported the issue through the Patchstack bug bounty programme. It affected an upload identifier that the plugin did not fully sanitize.

We have fixed it, and the plugin now checks that identifier everywhere it uses it. We recommend updating every site as soon as possible.

Every library bundled with the plugin has also been rebuilt and brought up to date. That includes the SDKs of the cloud extensions of the Professional version: Dropbox, Google Drive, Microsoft OneDrive and Amazon S3.

Each library now lives under a namespace that belongs to this plugin. Previously, another plugin on the same site could bundle a different version of the same library. Whichever version loaded first was the one both plugins used. The plugin that lost had no way of knowing. That can no longer happen.

Extensions now come in several variants, each built for a different PHP version. Your site is served the one that matches the PHP it runs. Nothing is required of you. The correct variant is selected when the extension is installed or updated.

Sites on older PHP keep running exactly what they run today. Sites on current PHP now receive current libraries. A single build could never do that, because it had to satisfy every PHP version at once.

An extension also no longer loads at all if your PHP version is lower than it needs. That turns what used to be a fatal error into a clean absence.

The release corrects a number of issues as well:

• Dropbox authorization could fail without reporting anything. It now completes, or explains why it cannot.
• The error shown when Dropbox is not activated named neither the file nor the transfer it belonged to.
• Facebook Messenger notifications used a Graph API version fixed in 2018. They now use the version set in the plugin’s settings.
• Google Drive activation now reports a clear error when it cannot retrieve its authorization configuration, instead of showing a blank page.
• Uploads to a NextGEN Gallery had stopped working with recent versions of that plugin. They work again.
• A leftover internal reference caused a fatal error on PHP 8 and later in four extensions.
• Two functions declared an optional argument before a required one, which stops working in PHP 9. Both are corrected.
• The upload details page linked from Messenger notifications now works when WordPress runs in a subdirectory, and appears within your own theme.

You can find the complete list of changes in the Release Notes of the plugin’s support page.