Iptanus File Upload
Front-end file uploads for WordPress
Let visitors upload files from any page, post or sidebar widget — into your Media library, or straight to Dropbox, Google Drive, OneDrive, Amazon S3 or an FTP server.
What it does
A form on any page
One shortcode, or a Gutenberg block. Add your own fields, filter by size, extension or user role, and run several forms in the same post.
Files go where you need
The Media library, a NextGEN gallery, an FTP server or a cloud account. Large files upload in chunks, past the server’s own limit.
You see what arrives
A file browser and activity log in the dashboard, email notifications on upload, and a viewer your logged-in users can see too.
What it looks like
Set-up and reference
- Install the plugin with the WordPress auto-installer, or download the .zip file from wordpress.org and install it from the Plugins section of your Dashboard.Or copy the
wordpress_file_uploaddirectory into thewp-content/pluginsdirectory of your site yourself. - Activate the plugin from the Plugins section of your Dashboard.
- For an upload form, go to Dashboard / Settings / Iptanus File Upload and follow the instructions in Uploader Instances.
[wordpress_file_upload]Or put the shortcode straight into the contents of any page. - For a list of uploaded files, follow the instructions in Uploaded File List Instances instead.
[wordpress_file_upload_browser]Or put the shortcode straight into the contents of any page.
- Open the page in your browser and you will see the upload form, or the list of files.
- View what has arrived from the Uploaded Files item in the Dashboard menu.
- Change the upload directory, or any other setting, from the small edit button at the top-left corner of the upload form.It opens the plugin options in a new window. If nothing appears, allow pop-up windows for your site.
- Full documentation of the plugin options is in the Options section below.
A handy Getting Started guide can be found here.
You can download the free version of the plugin by pressing the FREE version button below, or you can go for the professional version that offers multiple file uploads, captcha and much more by pressing the PRO version button. Professional licences are one-off, and their updates never expire.
The plugin offers many options for the two shortcodes, so that they can be tailored to any requirements. These options are available in the following links:
From version 2.4.1 filters and actions are supported in order to allow programmers to integrate Iptanus File Upload plugin with other plugins, extend its capabilities or perform advanced operations.
A detailed list of the plugin’s filters and actions can be found in this article.
The plugin is translated in the following languages:
- Portuguese
- kindly provided by Rui Alao
- German
- French
- kindly provided by Thomas Bastide of omicronn.fr
- Serbian
- kindly provided by Andrijana Nikolic of webhostinggeeks.com
- Dutch
- kindly provided by Ruben Heynderycx
- Chinese
- kindly provided by Yingjun Li
- Spanish
- kindly provided by Marton
- Italian
- kindly provided by Enrico Marcolini marcuz.it
- Polish
- Swedish
- kindly provided by Leif Persson marcuz.it
- Persian
- kindly provided by Shahriyar Modami chabokgroup.com
- Greek
Translations in other languages are more than welcome!.
The plugin requires to have Javascript enabled in your browser. For Internet Explorer you also need to have Active-X enabled.
Please note that old desktop browsers or mobile browsers may not support all of the above features. In order to get full functionality use the latest versions of browsers, supporting HTML5, AJAX and CSS3.
You can read the Privacy Policy and Terms of Service of the plugin in the following links:
You can also read the Google Drive Privacy Policy and Terms of Service of the plugin in the following links:
Release notes
158 versions · 872 changes
What changed in each version. Grouped by major release — these entries carry no dates.
- Fixed a security issue, reported by peppa through Patchstack, that bypassed the HTML-content upload protection added in version 5.2.2. A file beginning with a vertical-tab character, or with an incomplete tag name such as <bx>, passed the check while browsers still read it as HTML. The detection now reproduces the sniffing rules browsers use, so files of that shape are rejected.
- Fixed a security issue, reported by netwind through Patchstack, that bypassed the HTML-content upload protection added in version 5.2.2. The check could be evaded when the opening HTML tag ended with a character other than a space, such as a slash; files of that shape are now reliably detected and rejected.
- Added bulk management of admin notifications across every page, so all notifications matching the active filter can be marked read, marked unread, or deleted in a single action.
- Fixed a security issue, reported by fcc through Patchstack, where a file containing HTML but detected as a non-text type could be uploaded and then run as a script in the browser. Uploads whose leading bytes would be interpreted as HTML are now rejected, whatever their detected type.
- Fixed a critical error that could occur when deleting admin notifications in bulk, or when filtering them by a single status or category.
- Fixed a security issue, reported by Vidhi Parmar, where a crafted value of an upload form parameter could be interpreted as a regular expression instead of a literal upload identifier.
- Upload error responses no longer include internal session or request details unless debug mode is enabled.
- Fixed an SQL injection security issue reported through Patchstack, affecting an upload identifier that was not fully sanitized.
- Updated all bundled libraries of the plugin and of the cloud extensions to their current versions.
- Bundled libraries are now under a plugin-specific namespace, so they can no longer conflict with libraries bundled by other plugins.
- Extensions are now published in variants built for different PHP versions, and each site receives the variant matching its own PHP version. Pro
- Extensions are no longer loaded if the site's PHP version is lower than the one they require. Pro
- Removed the Facebook SDK, which was bundled but never used. Pro
- Messenger notifications now use the Facebook Graph API version defined in the plugin's settings, instead of a hardcoded 2018 version. Pro
- Fixed Dropbox authorization failing silently. Pro
- Corrected the error reported when Dropbox is not activated. Pro
- Google Drive activation now reports a clear error when its authorization configuration cannot be retrieved, instead of a blank page. Pro
- Fixed uploading files to a NextGEN Gallery, which stopped working with recent versions of NextGEN Gallery. Pro
- The upload details page linked from Messenger notifications now works when WordPress is installed in a subdirectory, and is displayed within the site's theme instead of as plain text. Pro
- Fixed a fatal error on PHP 8 and later caused by an unquoted internal directory reference in the Dropbox, Facebook, NextGEN Gallery and Elementor extensions. Pro
- Fixed two functions that would stop working in PHP 9. Pro
- Fixed a warning where, after the libraries were placed under their own namespace, the minifier still referred to one of its own classes by its former name. Pro
- The plugin now rechecks its license when the server's PHP version changes. Pro
- The upload path setting now notes that cloud storage destinations exist in the Professional version; the note can be dismissed and does not return.
- Corrected outdated links and information in the plugin's documentation.
- Fixed bug where emails could not be sent after the release of the previous version.
- Verified compatibility with latest 7.0 WordPress version.
- Added uploadid length check in wfu_ajax_action_send_email_notification().
- Added wfu_params_*, wfu_gst_* and wfu_userstate_* in periodical cleanup.
- Added Transient Options section in Maintenance Actions tab.
- Fixed SQL injection issue CVSS 9.3 from Patchstack.
- Fixed File Overwrite Race Condition when uploading files with the same filename concurrently.
- Verified compatibility with latest 6.9 WordPress version.
- Fixed bug where a file could not be downloaded from Uploaded Files Dashboard menu.
- Fixed double-escaped HTML code of text when Pro version is deactivated. Pro
- Added support for FTP over TLS (FTPS) uploads.
- Fixed bug where the visual editor of the file viewer could not be invoked when there was no upload form on the same page. Pro
- Fixed bug where alt text and description in NGG image was not stored because NGG modified its API. Pro
- Fixed bug where the visual editor threw warnings for not finding personaldata when Personal Data were deactivated from the plugin's Settings in Dashboard.
- Fixed bug where a fatal error was thrown when updating the Pro version of the plugin and the extensions had to be reloaded. Pro
- Fixed bug where Link and Remotelink columns showed HTML code instead of links, due to excessive escaping. Pro
- Modified Messenger activation workflow due to withdrawal of Send To Messenger plugin from Meta. Pro
- Corrected bug where the upload form visual editor was not opening when Material UI theme was active.
- Corrected bug where notification emails were not sent when Material UI theme was active.
- Updated vendor libraries.
- Removal of Post Method setting from free version.
- Removal of curl_exec, file_get_contents and sockets from wfu_get_request() and wfu_post_request() of free version.
- Improvements on how AJAX endpoint is provided.
- Corrections to "Requires at least" value.
- Replacement of eval() in minification function.
- Corrected warning where translatable constants where loaded before the plugin textdomain was loaded.
- Further security improvements for compliance with wordpress.org.
- Added translation for all backend of the plugin.
- Modified plugin code so that all echoed variables to HTML are escaped.
- Modified code so that all input is sanitized, including all $_SERVER, $_COOKIE and $_SESSION input.
- Plugin name changed to Iptanus File Upload.
Every version on one page, without JavaScript: the full changelog.
Free and Pro
The free version does not expire and is not a trial. Pro adds nineteen features. The full comparison and the price are on one page.
Hello,
i’m having problem with email notification. If i set a fixed email (name.surname@host.ing) i get the notification. If i set the %useremail% variables the notification doesn’t work. What i can do?
Are the users who upload files logged in?
Regards
Nickolas
Yes, the upload is avaibile only for logged user.
Try only %useremail% in recipients. Does it work? Check Spam if they went there. You can also install and configure an SMTP plugin like WP Mail SMTP and try again.
Nickolas
Ok with wp mail smtp seem to work the notification to %useremail%.
Can i add also other email addresses? must be comma separated or one for row?
They must be comma separated
Nickolas
Hi
Thank you for this great plugin.
I have a problem with uploading several types of file (e.g., zip files – I get “file not allowed” notification). How can I fix this to include the file types I need my users to upload?
Thanks,
Eyal
Hi, in order to allow zip files you need to set Allowed File Extensions in the shortcode like this: *.*, *.zip
Here is a relevant article.
Regards
Nickolas
Hello;
We have the File Upload Pro. As a part of our order process, we allow our customers to upload 1 or more files. Once the order is in Processing, we use Booster.io to create and use a PDF of that WooCommerce order in our printing process. We would like to include a list of the files that were uploaded for the order in that PDF.
I’ve tried using the shortcode:
[wordpress_file_upload_browser candownload=”true” candelete=”true” columns=”inc:/#,file:s/File,date:n/Upload Date,size:n/Size,user:s/User,thumbnail:/Thumbnail,fields:/User Fields”]
I’ve also tried to use the bare bones version:
[wordpress_file_upload_browser]
Neither is working for me. I get a list of the uploaded files. But I also get lines and lines of “other stuff”.
Any thoughts as to what we can do to get the list of the uploaded files on our PDF?
Hi, first of all, how are the uploaded files linked to the order? have you made any integration with Woocommerce (or any other e-commerce plugin you use)?
Regards
Nickolas
Hello Nickolas;
It is integrated with WooCommerce and Storefront. I can see the files on Admin/Orders. Each customer can also see and modify the files that they have uploaded in My Account if they log in.
Thanks
Bill
How was the integration made? Can you show me the upload form shortcode?
Nickolas
Hello Nickolas;
We are using the WooCommerce Multi-Step Checkout from ThemeHigh. Step 1 is to gather the Billing info, Step 2 is to gather Shipping info if needed, Step 3 is what we call the Imprint area. We provide custom printed, multi-part forms. We frequently need additional details from our customers before we can print the forms. One of the most important details is that we need to provide a way that our customers can upload a file with their logo.
If you want to place an order to go through the process, you are welcome to. We do not require an online payment. Besides, you can always go through the process and get to the Imprint area and simply not complete the payment.
We added 2 functions to the functions.php file in /wp-content/themes/storefront.
// define the woocommerce_checkout_before_terms_and_conditions callback
function action_woocommerce_admin_order_data_after_order_details( $order ) {
// make action magic happen here…
$upload_dir = wp_upload_dir();
$scanned_directory = array_diff(scandir($upload_dir[‘basedir’].’/users/’.$order->get_user_id()), array(‘..’, ‘.’));
echo “Imprint Uploaded By User”;
foreach($scanned_directory as $pic){
echo ‘get_user_id().’/’.$pic.'” target=”_blank”>’.$pic.’‘;
}
};
// add the action
add_action( ‘woocommerce_admin_order_data_after_order_details’, ‘action_woocommerce_admin_order_data_after_order_details’, 10, 1 );
Is there a way for me to contact you that is not public? I can provide a user account with login information if that will help.
Thank you for your assistance.
Bill