Upperdog

Emil Gustafsson

<p>This plugin automatically converts language accent characters in filenames when uploading to the media library. Characters are converted into browser and server friendly, non-accent characters.</p>
<h3>Features</h3>
<ul>
<li>Converts accent characters to non-accent, latin equivalents in Swedish, Danish, German, and more.</li>
<li>Removes special characters like exclamation marks, periods, hashtags, and more.</li>
<li>Lets you choose if you want to convert only image files, or all file types.</li>
<li>Makes site and server migrations easier thanks to non-accent character filenames.</li>
<li>Provides filter hook for developers who want to specify which file types to convert.</li>
</ul>
<h3>Examples</h3>
<ul>
<li>Räksmörgås.jpg <span aria-hidden="true" class="wp-exclude-emoji">→</span> raksmorgas.jpg</li>
<li>Æblegrød_FTW!.gif <span aria-hidden="true" class="wp-exclude-emoji">→</span> aeblegrod-ftw.gif</li>
<li>Château de Ferrières.png <span aria-hidden="true" class="wp-exclude-emoji">→</span> chateau-de-ferrieres.png</li>
</ul>
<h3>Worth noting</h3>
<p>The plugin only converts filenames when the files are being uploaded. It can not convert existing files.</p>
<h3>Filter for developers</h3>
<p>This filter provides developers a way to specify which file types the plugin should convert. This filter overrides the plugin settings on the media settings page. For a complete list of mime types, see <a href="http://en.wikipedia.org/wiki/Internet_media_type" rel="nofollow ugc">Wikipedia</a>.</p>
<p>The following example will convert PDF, JPEG and PNG files only:</p>
<pre><code>function my_clean_image_filenames_mime_types() {
    $mime_types = array(
        'application/pdf',
        'image/jpeg',
        'image/png',
    );
    return $mime_types;
}
add_filter( 'clean_image_filenames_mime_types', 'my_clean_image_filenames_mime_types' );
</code></pre>


Clean Image Filenames

Using it happily on many websites without any issue.

Does what it says


Works like indicated. Simple and efficient


Works as expected

This plugin automatically converts language accent characters to non-accent characters in filenames when uploading to the media library.

codeprosai

<p>WordPress does not support SVG uploads natively — and naive SVG plugins are a well-known attack surface. SVG files are XML documents that can carry XSS payloads, XXE attacks, external resource injection, and embedded HTML. <strong>CodePros SVG Secure Support</strong> adds safe, production-ready SVG uploads through a layered defense pipeline.</p>
<h4>Security Pipeline</h4>
<p>Every uploaded SVG passes through five sequential checks before it is accepted:</p>
<ol>
<li><strong>Extension check</strong> — Blocks double-extension filenames (e.g. <code>payload.php.svg</code>) and enforces <code>.svg</code> only.</li>
<li><strong>MIME check</strong> — Verifies actual file bytes return <code>image/svg+xml</code> via <code>finfo</code>; confirms <code><svg</code> or <code><?xml</code> is present in the header bytes.</li>
<li><strong>Size check</strong> — Rejects files exceeding the configured maximum (default 1 MB).</li>
<li><strong>Node-count check</strong> — Parses the XML and counts DOM nodes; rejects files above the threshold (default 5,000 nodes) to prevent node-flood DoS attacks.</li>
<li><strong>Dimension check</strong> — Reads the root <code><svg></code> width/height/viewBox; rejects unreasonably large declared dimensions (default 10,000 px).</li>
</ol>
<p>After validation, the file is sanitized:</p>
<ul>
<li>DOM sanitization via the battle-tested <strong>enshrined/svg-sanitize</strong> library with custom tag and attribute whitelists.</li>
<li>Remote reference stripping — all external URLs are removed.</li>
<li>Final string-level regex scan for <code>javascript:</code>, <code><script</code>, inline event handlers (<code>on*=</code>), and CSS <code>expression()</code> — any match causes the upload to be rejected entirely.</li>
</ul>
<h4>Security Headers</h4>
<p>When SVG attachment pages are served, the plugin adds:</p>
<ul>
<li><code>Content-Security-Policy</code> (configurable, secure default provided)</li>
<li><code>X-Content-Type-Options: nosniff</code></li>
<li><code>X-Frame-Options: SAMEORIGIN</code></li>
</ul>
<h4>Server-Level Hardening (Optional but Recommended)</h4>
<p>The plugin’s PHP layer covers every SVG upload that passes through WordPress. But if someone accesses an uploaded file directly — e.g. by visiting <code>https://example.com/wp-content/uploads/2024/01/logo.svg</code> — WordPress is bypassed entirely, so the PHP security headers are never sent.</p>
<p>The plugin ships two ready-to-use server configuration snippets to close that gap:</p>
<ul>
<li><strong><code>uploads-htaccess.txt</code></strong> — for Apache / LiteSpeed servers</li>
<li><strong><code>uploads-nginx.conf</code></strong> — for Nginx servers</li>
</ul>
<p>Each snippet does three things:</p>
<ol>
<li><strong>Blocks server-side script execution</strong> in <code>wp-content/uploads/</code> — if an attacker somehow uploads a <code>.php</code> file and tries to access it directly, the server returns 403 instead of executing it.</li>
<li><strong>Enforces the correct SVG MIME type</strong> (<code>image/svg+xml</code>) — some server setups serve SVGs as <code>text/plain</code>, which prevents browsers from honouring Content Security Policy rules scoped to that MIME type.</li>
<li><strong>Adds security headers on direct SVG requests</strong> — the same <code>X-Content-Type-Options</code>, <code>X-Frame-Options</code>, and <code>Content-Security-Policy</code> headers that the PHP layer adds on WordPress attachment pages, so direct file links are equally protected.</li>
</ol>
<p>Applying these snippets is the difference between WordPress-mediated access being protected and <em>all</em> access (direct URL, CDN pull, hotlink) being protected.</p>
<h4>Admin UI</h4>
<p>A tabbed settings page under <strong>Settings <span aria-hidden="true" class="wp-exclude-emoji">→</span> SVG Secure Support</strong> provides:</p>
<ul>
<li><strong>Settings tab</strong> — Configure allowed upload roles, file size/node/dimension limits, sanitization options, CSP header value, and logging preferences.</li>
<li><strong>Security Logs tab</strong> — Paginated, filterable log viewer showing every security event (blocked upload, removed tag/attribute, suspicious payload). Includes a log purge action.</li>
</ul>
<h4>Key Features</h4>
<ul>
<li>Role-based upload access — select one or more WordPress roles (default: Administrator) whose members may upload SVG files</li>
<li>Automatic upload-time sanitization — clean SVG replaces the original tmp file before WordPress moves it</li>
<li>Security event logging to the WordPress debug log and a dedicated database table</li>
<li>Configurable log retention with one-click purge</li>
<li>Bundled <code>.htaccess</code> and Nginx config snippets for the uploads directory</li>
</ul>


CodePros SVG Secure Support

Highly secure SVG upload support for WordPress. Validates, sanitizes, and protects SVG files through a multi-layer security pipeline.

Clean Image Filenames vs CodePros SVG Secure Support