Happy to help with ongoing maintenance

[MillerMedia]

I’m Matt Miller, a WordPress plugin developer. I maintain several plugins on WordPress.org including IP Blacklist for Cloudflare, Edit Usernames, Expire User Passwords, and others. I understand the security sensitivity of filesystem access plugins and would treat that seriously.

I’d love to help share the maintenance burden on Add From Server if you’re open to it. I’m doing my best to contribute back to the WordPress plugin community and have a goal of maintaining plugins supporting over 1M WordPress sites. Things I could take on:

• Keeping “Tested up to” current and handling compatibility testing for new WP releases
• Addressing the open issues (Windows/IIS path separator bugs, root folder detection)
• Reviewing the open PR and any future community contributions
• Tightening input sanitization and security mitigations where needed
• Fielding support forum questions so they’re not all on you

I’m not looking to take the plugin in a new direction since it does its job well and should stay lean. Just want to help keep it healthy for the sites that depend on it.

If you’d be willing to add me as a committer on either the GitHub repo or WordPress.org (or both), I’d be happy to start with a small PR so you can evaluate the quality of my work first.

Thanks for all your work on WordPress core and this plugin.

[dd32]

Hi Matt,

I appreciate you reaching out.

At this time this plugin is not being actively maintained in any form (and for clarity, I won't be transferring it to anyone else).

While PRs would be appreciated, I can't guarantee that they'll be actively worked on by myself. PRs may be enough to get you write access though, and I'll be able to review/approve plugin releases after that :)

• Keeping “Tested up to” current and handling compatibility testing for new WP releases

I'd actually prefer to keep this not updated, because IMHO people often use this plugin for the wrong reasons.... I guess people are going to use it though.

root folder detection

My plan was to restrict all activity to the WP_CONTENT_DIR going forward, and in multisite environments their uploads folder.
This is due to the never-ending stream of security vulnerability claims when the server can access something outside of it's own web-root that's considered sensitive (which is the entire purpose of this plugin in some respects) which would neuter the purpose #10

I was also going to remove any functionality that I deemed not necessary.. such as date functions and anything else that looked shitty code :) Which is all of it.

compatibility testing for new WP releases

It makes use of the old media upload API, which AFAIK doesn't integrate well into the modern