* added um_image_upload_validation hook for 3rd-party validation during upload images;

changelog.txt

@@ -1,5 +1,20 @@
 == Changelog ==
 
+= 2.9.1 November 14, 2024 =
+
+* Enhancements:
+
+  - Added: `um_image_upload_validation` hook for 3rd-party validation during upload images
+
+* Bugfixes:
+
+  - Fixed: "Load textdomain just in time" issue
+  - Fixed: Capabilities checking in the wp-admin > Users list table
+  - Fixed: File/image upload on the role specific profile form
+  - Fixed: Issues when the form's custom fields meta has a wrong format
+  - Fixed: Validation of the "Registration Default Role" slug
+  - Fixed: Allowed query variables via registered REST API class only when REST_REQUEST is defined
+
 = 2.9.0 November 12, 2024 =
 
 * Enhancements:

includes/core/class-files.php

@@ -450,6 +450,37 @@ if ( ! class_exists( 'um\core\Files' ) ) {
 			$ret['error'] = null;
 			$ret          = array();
 
+			if ( empty( $_POST['key'] ) ) {
+				$ret['error'] = esc_html__( 'Invalid image key', 'ultimate-member' );
+				wp_send_json_error( $ret );
+			}
+
+			$id      = sanitize_text_field( $_POST['key'] );
+			$user_id = empty( $_POST['user_id'] ) ? null : absint( $_POST['user_id'] );
+
+			/**
+			 * Filters the custom validation marker for 3rd-party uploader.
+			 *
+			 * @param {bool}   $custom_validation Custom validation marker. Is null by default. Keep null for UM core validation.
+			 * @param {string} $id                Uploader field key.
+			 * @param {int}    $user_id           User ID.
+			 *
+			 * @return {bool} Custom validation marker.
+			 *
+			 * @since 2.9.1
+			 * @hook um_image_upload_validation
+			 *
+			 * @example <caption>Custom validation.</caption>
+			 * function my_image_upload_nonce( $verify_nonce ) {
+			 *     // your code here
+			 *     $ret['error'] = esc_html__( 'Error code', 'ultimate-member' );
+			 *     wp_send_json_error( $ret );
+			 *     return true;
+			 * }
+			 * add_filter( 'um_image_upload_validation', 'my_um_image_upload_validation', 10, 3 );
+			 */
+			$custom_validation = apply_filters( 'um_image_upload_validation', null, $id, $user_id );
+			if ( is_null( $custom_validation ) ) {
 				/**
 				 * Filters image upload checking nonce.
 				 *
@@ -479,7 +510,6 @@ if ( ! class_exists( 'um\core\Files' ) ) {
 					}
 				}
 
-			$user_id = empty( $_POST['user_id'] ) ? null : absint( $_POST['user_id'] );
 				if ( $user_id && is_user_logged_in() && ! UM()->roles()->um_current_user_can( 'edit', $user_id ) ) {
 					$ret['error'] = esc_html__( 'You have no permission to edit this user', 'ultimate-member' );
 					wp_send_json_error( $ret );
@@ -553,8 +583,6 @@ if ( ! class_exists( 'um\core\Files' ) ) {
 					}
 				}
 
-			$id = sanitize_text_field( $_POST['key'] );
-
 				if ( ! array_key_exists( 'custom_fields', $post_data ) || empty( $post_data['custom_fields'] ) ) {
 					$ret['error'] = esc_html__( 'Invalid form fields', 'ultimate-member' );
 					wp_send_json_error( $ret );
@@ -588,6 +616,7 @@ if ( ! class_exists( 'um\core\Files' ) ) {
 						wp_send_json_error( $ret );
 					}
 				}
+			}
 
 			if ( isset( $_FILES[ $id ]['name'] ) ) {
 				if ( ! is_array( $_FILES[ $id ]['name'] ) ) {

readme.txt

@@ -168,6 +168,10 @@ IMPORTANT: PLEASE UPDATE THE PLUGIN TO AT LEAST VERSION 2.6.7 IMMEDIATELY. VERSI
 
 = 2.9.1 2024-11-14 =
 
+**Enhancements**
+
+* Added: `um_image_upload_validation` hook for 3rd-party validation during upload images
+
 **Bugfixes**
 
 * Fixed: "Load textdomain just in time" issue

ultimate-member.php

@@ -3,7 +3,7 @@
  * Plugin Name: Ultimate Member
  * Plugin URI: http://ultimatemember.com/
  * Description: The easiest way to create powerful online communities and beautiful user profiles with WordPress
- * Version: 2.9.1-alpha
+ * Version: 2.9.1
  * Author: Ultimate Member
  * Author URI: http://ultimatemember.com/
  * Text Domain: ultimate-member