Download UpdraftPlus Premium Backup & Restore Plugin v2.25.12.26

List of improvements in UpdraftPlus Premium Backup & Restore Plugin version 2.25.12.26

• The UpdraftPlus backup blog is the best place to learn in more detail about any important changes.
• N.B. Paid versions of UpdraftPlus Backup / Restore have a version number which is 1 higher in the first digit, and has an extra component on the end, but the changelog below still applies. i.e. changes listed for 1.16.32.x of the free version correspond to changes made in 2.16.32.x of the paid version.
• = 1.25.1 11/Jan/2025
• SECURITY: Fix a non-persistent reflected XSS vulnerability due to a missing nonce combined with missing sanitisation. This could allow an attacker, who persuaded you to click a personally-crafted link to your site’s dashboard whilst you were logged in, to once run JavaScript code in your dashboard. Thanks to Asaf Mozes for finding and responsibly disclosing this issue.
• FIX: Prevent the restoration from failing when there is a ‘sync-xhr=()’ permission policy on the response header.
• FIX: Improve the approach of acquiring a suggested region for Amazon AWS S3 if a failure arises during the getBucketLocation() call, particularly when the XML response fails to provide a field for the suggested region this resolves issues with regions (e.g. us-east-2) which recently changed their response behaviour
• TWEAK: Broaden the support to incorporate the “ap-southeast-4” region of Amazon AWS S3 and additional recently updated regions
• TWEAK: A regression in the paid version update checker to version 4.13.2, resulting in non-appearance of notices concerning subscription status or WP version compatibility.
• = 1.24.12 23/Dec/2024 =
• FIX: The pre-restoration stage failed to properly address the tables that were to be excluded, which caused a logical error that misread the checked “include all tables not listed” option as an instruction to restore every table
• FIX: Update PHPSecLib library to version 2.0.48 which has the fixes for the “gmp_pow(): base and exponent overflow” on certain PHP versions and could cause backups to fail on the SFTP remote storage
• TWEAK: Complete the review and removal of calls to the unserialize() PHP function allowing class instantiation begun in 1.24.7. (The final removal involved a theoretical security defect, if your development site allowed an attacker to post content to it which you migrated to another site, and which contained customised code that could perform destructive actions which the attacker knew about, prior to you then cloning the site. The result of this removal is that some search-replaces, highly unlikely to be encountered in practice, will be skipped).
• TWEAK: Drop search and replace feature for PHP 5.2 users (to fulfil the preceding item)
• TWEAK: Tweak UpdraftCentral media module to add “has_image_editor” property to each media item
• TWEAK: On the restoration screen in a multisite configuration, the dropdown labeled “which site to restore” was covering other HTML elements, which caused some buttons to be positioned at the bottom instead of at the top
• TWEAK: Avoid deregistering jQuery-UI CSS if already printed by other plugins to prevent compatibility issues
• TWEAK: In the context of database restoration, the execution of LOCK and/or ALTER SQL statements must be avoided for any tables that are part of the “skipped tables” list
• TWEAK: openssl_free_key() is only needed on PHP < 8
• TWEAK: Various coding style changes to comply with “Plugin Check” rules
• = 1.24.11 15/Nov/2024 =
• TWEAK: Do not request drive.readonly scope on Google Drive connections, due to Google’s app permissions review (unannounced and requires us to create a Youtube video for their review process) this means that (until the review completes) new connections to Google Drive can only access backups created by UpdraftPlus directly, and not backups which you manually upload to Google Drive. This restores the ability to make new connections to Google Drive.
• TWEAK: Adjustment of the UpdraftPlus_S3_Compat class to preserve compatibility with the external UpdraftPlus AWS SDK plugin (https://github.com/DavidAnderson684/updraftplus-aws-sdk).
• = 1.24.9 14/Nov/2024 =
• FIX: A regression in 1.24.8 when handling restoration of wp-config.php
• TWEAK: The changes in handling of loading text domains in 1.24.8 did not cover most cases
• TWEAK: Introduce the “updraftplus_use_builtin_wpcore_restoration” filter which can be used to restore WP-Core entity using a different WP-Core restoration mechanism especially in a case that the admin-ajax.php file couldn’t be deleted during the restoration
• = 1.24.8 13/Nov/2024 =
• TWEAK: Add descriptions for the ‘Clone Package’ dropdown when creating a clone.
• TWEAK: Move the “load_plugin_textdomain” call from being called through “plugins_loaded” action to being called via “init” action
• TWEAK: Update the log message to specify that backup files are marked as “processed” when no remote storage is selected, and as “uploaded” when remote storage is selected.
• TWEAK: Some code tidying in the restore class
• = 1.24.7 04/Nov/2024 =
• TWEAK: Include the .part file extension into the cleanup list, guaranteeing that files associated with this extension are regularly deleted from the backup directory
• TWEAK: The update functionalities in the WordPress plugin information box (6.5 and later) have been adjusted to stop updates from taking place in the same window, ensuring that the “auto-backup before update” dialog appears as intended
• TWEAK: Add customized “unserialized” method into the UpdraftPlus class which can handle the use of the “options” argument or its absence when running across different PHP versions
• TWEAK: Add the UPDRAFTPLUS_SEND_UNWRITABLE_BACKUP_DIRECTORY_EMAIL constant to disable the sending of unwritable backup directory emails to users.
• TWEAK: Clearer notifications to users regarding unconfigured remote storage settings and/or the selection of remote storage that are not part of their UpdraftPlus version
• TWEAK: During the resumption of OneDrive’s chunk uploads, the authorisation header and bearer token should not be included as it may lead to an unauthenticated error due to a different upload URL.
• TWEAK: Implement code to enable automatic activation of the UpdraftPlus plugin during the migration process from a multisite setup to a standalone site
• TWEAK: In a multisite environment, ensure that users can access the UpdraftPlus plugin page even in the absence of the WP_ALLOW_MULTISITE constant
• TWEAK: UpdraftClone now supports PHP 8.4
• TWEAK: Prevent a potential PHP deprecation notice when zip creation fails
• = 1.24.6 25/Sep/2024 =
• TWEAK: In 1.24.5, the browser title wrongly displayed as “UpdraftPlus” when accessing an unrelated plugin page using the main menu.
• = 1.24.5 24/Sep/2024 =
• FIX: Incorrect regular expression for DigitalOcean Spaces endpoint
• FIX: CSS conflicts with the LearnDash LMS Instructor Role Add-on plugin which caused some UI elements to disappear
• TWEAK: Reorganize UpdraftPlus in left-hand menu and rename it to “UpdraftPlus”; to disable it, follow this guide: https://updraftplus.com/new-location-of-updraftplus-in-the-wordpress-dashboard/
• TWEAK: Add span wrapper to UpdraftCentral connection failed message
• TWEAK: Add the “Go here to complete your settings” link into the appropriate admin notice that when clicked will jump to the UpdraftVault configuration if no settings are specified.