austinginder/minn-admin v0.34.0 on GitHub

The good-neighbour release. Minn spends this cycle fitting in with the tools and habits already in place. A database push or pull runs through WP Migrate from a page inside Minn, showing what it will rewrite before it starts. ACPT's post types and taxonomies join the ones ACF, CPT UI and Minn create on one Structure page, with their fields editable on the post. Pages built in Etch become correctable copy instead of a picture of a page, and CleanTalk brings its spam accounts onto the Users list. The editor answers the keys people already press: Tab nests a list item and carries you from the title into the writing, three dashes or a typed hr both reach a divider, and a link can open a post already in focus or outline mode. On the public site the bar condenses to a single mark, the same tile the admin wears, resting on the same point of the screen so the two views hand off without anything moving.

The rest of the release is what people wrote in to say. Long product names stop printing over the column beside them, the products list is usable on a phone again, languages are named rather than coded, and a language you removed stops asking to be updated. The bundled fonts can finally draw the alphabets the plugin is translated into, which eleven of its twenty-four languages could not rely on before. A full security review walked the plugin end to end, found nothing critical, and everything worth fixing is fixed here.

Added

Focus and outline mode from a link. Add ?focus=1 or ?outline=1 to an editor address to arrive already in that writing mode, or ?focus=0 to arrive with it off. The link speaks for that visit only: it never changes your own saved preference, and leaving the mode by hand sticks. Useful for bookmarks and launchers that go straight to distraction-free writing.
An Etch page looks like itself in the editor, and all of it is reachable. Etch keeps a page's styling in its own store and hands it to the browser at the last moment, which a preview never reached: pages arrived with the right words and none of the design, white headings on white, sections with their backgrounds missing. They render properly now. Copy inside Etch's reusable components is editable too, and lines that Etch draws in a different order than it stores them are no longer skipped. Buttons finally have somewhere to change where they point: right-click a link and choose Edit link. The Replace image label sits on the picture rather than on the paragraph beside it, and pressing it now actually opens the picker.
Field groups from every plugin share one place. ACF and ACPT both describe a named group of fields attached to something, and each had its own sidebar entry. They share one Field Groups item now, a list per plugin, and any plugin can add its groups the same way.
ACPT field groups edit in Minn's builder. An ACPT group row opens the same schema canvas ACF groups use, with ACPT's shape kept intact: boxes sit above their fields as sections, and the fields inside them create, configure, reorder and delete in place. Seventeen ACPT field types are editable, choice lists keep their stored identities through a relabel so saved selections never orphan, number bounds ride ACPT's own advanced options, and repeaters nest one level with their sub fields. Where a group appears is editable too: the rules ACPT stores map onto the builder's location sets both ways, and a rule of a kind the builder does not model is shown as it is and saved back untouched. Every save runs through ACPT's own group-save machinery after checking the whole submission first, so a mistake refuses with a plain sentence and writes nothing. Field types beyond the editable set stay listed with their configuration locked, and ACPT's own canvas is one click away for those.
The whole ACPT group lifecycle, without leaving Minn. Add field group creates one from a title and a "shown on" pick, ready to take fields; the row menu duplicates a group or deletes it behind a confirm that says plainly what ACPT's delete means (there is no trash, though values already saved on posts stay in the database). Export downloads a group in ACPT's own file format, so the file opens in ACPT's import screen on any site, and Import accepts those files back through ACPT's own pipeline: everything lands in one database transaction, anything that already exists here updates in place, and a file carrying post types or taxonomies beside its groups brings those along too, with a report of what came in. Two quiet safety rails guard quirks in how ACPT resolves names: creating a group under an existing name is refused rather than silently overwriting that group, and a new box cannot take a name another group's box already holds, which on some ACPT builds would silently move that box here.
Every plugin's option pages share one place. ACF and ACPT each claimed a sidebar entry of their own, so a site running both grew two items describing the same kind of thing, and a theme with a page of its own had nowhere to put it. They gather under a single Site options item now, each page a tab, and any theme or plugin can add one the same way. A site with just one page still sees that page's own name rather than being renamed.
ACPT option pages are editable in Minn. The site-wide fields ACPT keeps on its own pages, the business address, the phone number, the social links, were invisible here, so the most ordinary request after a handover sent people back to wp-admin. Each page a person is allowed to manage now appears under Tools with its fields ready to edit, and each page keeps whatever permission it was given. Two field types were also being read wrongly: a web address and a phone number are each stored with something beside them, a display label and a dialling code, and reading past that showed an empty box on a field that had content in it. Editing a link no longer overwrites a label someone wrote for it.
Edit ACPT images, repeating sections and phone numbers. ACPT fields beyond plain text were listed as locked, which on a real site left a third of the fields on a page with nothing to fill in. Pictures use the media picker, repeating sections edit as rows, and a row keeps any part of itself Minn does not show.
Etch copy and images edit in Minn. A page built in Etch keeps its wording somewhere Minn could not previously read, so it arrived as a picture of a page rather than something a client could correct. The words are editable in place now, and pictures can be swapped from the block's own settings, while the layout stays in Etch where it belongs. Fields that Etch fills in for you, such as a page's own title, stay read-only, since what you are looking at is the answer rather than the question.
ACPT comes into Minn. Post types and taxonomies created in ACPT appear on Structure beside the ones ACF, CPT UI and Minn create, each marked with where it came from and each linking into ACPT's own builder for the parts only that builder can change. Posts get a Custom fields · ACPT panel for the field types Minn can round-trip through ACPT's public API (see the images, repeaters and phone numbers below); relationships and the other advanced fields stay locked and counted instead of being flattened. ACPT also joins Extensions → Licenses: the row reads only its local activation record, asks for the license code and account email together, activates through ACPT's own API client, and releases the seat through ACPT's manager. The rejected-key path is verified; a real-key success still needs a licensed account.
Push and pull with WP Migrate, without leaving Minn. A Migrate page under Tools runs a database migration through WP Migrate: pick a direction, paste the other site's connection info, choose whether everything moves or only some tables, and watch it go table by table. Before it runs, the page shows what the migration will rewrite, so the address and folder swap that keeps the other site pointing at itself is something you read rather than trust. Every step is WP Migrate's own code on both ends, so a migration started in Minn behaves like one started on their screen. A pull replaces the site you are looking at, so it says so, asks first, and reloads when it lands. The page also shows this site's own connection info, so the other end can be set up from Minn instead of hunting through WP Migrate's settings: one click copies the address and key in the format their field expects, and the key stays hidden until asked for. Two switches decide whether another site may push here or pull from here, with a note when both are off, because the key alone will not connect without them. Media, theme and plugin file transfers stay in WP Migrate, which is where those add-ons live.
WP Migrate's backups, beside every other backup. The .sql files WP Migrate writes, on their own or as the safety copy before a migration overwrites a database, now list as a provider in the Backups family next to UpdraftPlus, Duplicator and Disembark: each file with its kind, size and age, a card totalling what is on disk (with the honest note that these are database files only), a Download that goes through WP Migrate's own permission-checked handler rather than a bare file link, and a Delete that removes the real file through their machinery behind a confirm that says it cannot be recovered.
WP Migrate joins the Licenses tab. A site running WP Migrate (the paid plugin from Delicious Brains, now WP Engine) sees its license beside every other paid component, with the state, a plain explanation, and paste-to-activate, re-verify and remove where WP Migrate's own code allows. Minn reads the key wherever WP Migrate keeps it, including the case their own screen makes normal: the key belongs to the person who entered it rather than the site, so the row says when the key on file belongs to someone else. An expired subscription is described the way it actually behaves, since migrations keep running and only updates and support stop. Removing the key clears it from this site and says plainly that the activation is not released, because WP Migrate offers no way to do that from here.
Delete a customer without leaving Minn. Right-click a customer for a Delete option, or open one and use Delete customer. It runs the same flow as deleting a user: their content moves to whoever you pick, and the account is removed for good. Their orders are not part of that. Orders stay where they are, keep the billing details captured at checkout, and become guest orders, which the confirmation says before you commit.
CleanTalk's spam users, on the Users list. When CleanTalk is active, Users gains a Spam tab of the accounts it has already marked. Right-click one to say it is not spam, or to delete it the way CleanTalk does: the account and the posts they wrote, no reassignment, with a confirm that says so. Checking existing accounts still happens on CleanTalk's own screen (it needs a date range and talks to their cloud in chunks); Minn links out for that, then lists and acts on the results. Settings → Comments shows the same count on the CleanTalk card, and ⌘K has Find spam users.
Automatic.css joins the Licenses tab. Sites running Automatic.css (the styling framework beside Etch and Bricks) saw its license reported as missing even when a valid one was stored, because its options are named in a way the generic detector could never find. A dedicated reader now tells the truth, and the row carries the full set of controls: paste a key to activate, re-verify, and remove, each speaking to the Automatic.css server with exactly the request their own settings screen sends. A rejected key is explained in their own words and never stored, pasting the masked key from their screen is caught with a hint to use the full one, and a re-verify never rewrites the stored status (their server answers "not active for this URL" on a dev copy of a licensed site, which is about the copy's address rather than the license).
SEOPress Pro joins the Licenses tab. A stored SEOPress Pro license was invisible whenever the Pro plugin sat deactivated, which is exactly how many sites rest: free running, Pro parked. The row now shows the license, its state and its renewal date whether or not Pro is active, and while Pro runs it carries paste-to-activate, re-verify and remove, each mirroring the requests SEOPress's own tooling sends. Removing a license releases the seat first and refuses to touch anything if the server does not confirm; a key defined in wp-config.php is honored, named as such, and never overwritten from a paste.
CleanTalk's access key, in the same places as Akismet. It is a cloud token, not a purchase license. Settings → Connectors lists it next to Akismet as spam filtering: activate the plugin in place, then paste the key. The same paste lives on the CleanTalk spam card and on the Licenses tab, where the row is labelled as a key. Every door drives CleanTalk's own save-and-check; a rejected token is named, kept in the field for a retype, and never stored. A key supplied in code (the CLEANTALK_ACCESS_KEY constant) stays read-only.

Improved

Type /hr for a divider. The block menu matched what you type against a block's name alone, so the obvious thing to type for a horizontal rule found nothing. Divider now answers to hr, rule, line and separator, in the block menu and in Browse all. Typing three dashes has always inserted one and still does.
Tab nests list items. Press Tab anywhere in a list item to tuck it under the item above, and Shift+Tab to lift it back out, the way the block editor and the classic editor have always worked. It goes as deep as you need, undo walks it back a step at a time, and Tab on the first item of a list still moves on rather than doing nothing.
Tab moves from the title straight into the writing. The formatting toolbar sat between them as sixteen separate Tab stops, which is the opposite of what the accessibility guidance for toolbars asks for. The toolbar is now a single destination outside the Tab order: press ⌥F10 while writing to reach it, move between buttons with the arrow keys, press Enter to apply one to your selection, and Escape puts the caret back exactly where it was. Every button keeps its name for screen readers, and the shortcut is listed in the help dialog.
The Minn bar becomes a Corner Reveal. Only the Minn mark rests in the top corner until hover or keyboard focus reveals the site name and complete control set. It no longer asks themes to reserve a WordPress-toolbar-sized strip, hides while scrolling or moves around for overlays. On phones the mark opens the controls in a compact panel when tapped, so the site's own mobile menu stays visible. The mark itself is the same tile as the admin's own sidebar logo, resting on the same point of the screen, so moving between the site and the admin hands off without anything shifting.

Fixed

A security review, and the fixes it asked for. An independent read of the whole plugin found nothing critical or high, and the eleven medium points it raised are all closed here. In plain terms: the admin app now refuses to be shown inside another site's page, so a hidden overlay can't trick a click; a contact-form entry built to trip the reader can no longer tie up the site; the database browser only ever shows this install's own tables, never a neighbour's on shared hosting; and across a dozen plugins that Minn re-exposes, an action now needs exactly the permission that plugin's own screen needs, so someone allowed less by SEO, redirect, gift-card, backup, snippet, media-replace or spam-filter tools can't reach further through Minn than through the tool itself. A gift-card balance change also now leaves a line in that plugin's own history, naming who made it.
A licence can no longer be credited to the wrong product. When two things on a site used SureCart's licensing kit, the Licenses tab could show one product wearing the other's activation record: with an activated Etch and an unlicensed Etch theme, the theme read "activation stored" on the strength of the plugin's licence. The detector now looks only under the names a product would actually store its own record under, so the activated product shows its licence and the unlicensed one honestly says none. It also now says when a key was saved but never activated, which reads differently from an activated one.
Activating no longer takes the site down next to certain older plugins. Two plugins that run during the same moment WordPress is still loading its helper functions, one that redefines a login check and one that asks for an admin address at that moment, could crash every page the instant this plugin was turned on. The address rewrite now waits until WordPress has finished loading.
Opening a post can no longer run something the last writer left in it. A person allowed to save unfiltered HTML could leave working code inside a post, and it ran in the browser of whoever opened that post next, which on most sites is an administrator with more permission than the person who left it there. Stored content is now taken apart safely before it is shown, anywhere it appears: the editor, the read-only preview, block previews, the pattern inserter and the revision viewer. What you saved is untouched. The parts that would have run are set aside for display only and put back exactly as they were when the post is saved again, so a page of hand-written HTML still saves character for character, including code a site owner put there deliberately.
Links are labelled by where they actually go. The name beside a link on the Extensions page was chosen by looking for a well-known address anywhere in the link, so a plugin whose update server answered with a lookalike address could earn the words "WordPress.org" or "GitHub" on screen. Those labels are the only thing telling you whose site a link goes to, so they are now decided by reading the address properly. The Open button in the editor's link panel also checks the link before offering it, which the Apply button beside it already did.
The social image picker and the media folder list check who is asking. Setting a post's social sharing image accepted any media item by number, without checking whether the person was allowed to see it, so someone who can write a draft could learn the web address of files kept on other people's private posts. Since uploaded files are served to anyone who knows the address, that meant reading them. The image is now checked against the same permission the SEO plugins themselves put in front of that field, and its address is worked out here rather than taken from the request. Separately, the list of media folders answered to anyone who can write a post; on sites that file by client or by embargo the folder names say more than the files do, so it now asks for permission to upload, which is what every folder plugin asks for.
The activity feeds no longer name posts you cannot open. A comment row on the overview says which post it was left on, and comments were being listed without checking whether the reader is allowed to see that post. Anyone who could open the overview was shown the titles of private, draft, pending and trashed posts that happen to carry a comment, along with the commenter's name. The drill-down went further: because of how it asked the database for comments, it also picked up records other plugins keep as comments, so a site running WooCommerce was handing order notes to people with no business seeing an order. Every one of these feeds now applies the same check WordPress applies to its own dashboard, and asks only for real comments.
A snippet is judged by where it runs, not by what it is labelled. WPCode records what a snippet is and where it goes as two separate settings, and its own form only stops you pairing them in the browser, so a snippet can be labelled as markup while sitting in a spot WPCode actually executes. Turning one on, deleting one, or reading its source went by the label alone, which let it past the permission that governs code and past the setting a site owner turns on to forbid editing code from the dashboard entirely. All of these now read the location first, the way saving a snippet already did. Turning a snippet off is still always allowed, and a markup snippet in a spot that only prints it is unaffected.
A free-text checkbox on a site options page can no longer carry working code. Checkbox fields that let someone type their own value, rather than pick from a list, were the one kind of options field saved without being cleaned up first. Since an options value is site-wide and themes usually print it as-is, someone who is trusted to write posts but not to write HTML could have left working code on every page showing that field. Those values are now cleaned the same way every other options field already was. Picking from a defined list is unaffected, fields on a single post are unaffected, and anyone already allowed to write HTML still can.
Long product and customer names stay in their column. A long name ran past its column and printed across the ones beside it instead of trailing off with an ellipsis. Both lists shared the fault and both are fixed.
The products list works on a phone again. At phone width a product row showed only its checkbox and the arrow at the end: the rule that decides which columns to drop and the one that makes room for the checkbox were each dropping a different column, and together they dropped nearly all of them. Rows show the product and its price again. Anyone who cannot edit products was unaffected, which is why it looked like the list had no phone layout at all.
The admin's own fonts can draw the languages it speaks. Only the plain Latin part of each font was included, so Polish, Czech, Hungarian, Turkish and Vietnamese letters were borrowed from whatever font the device had, changing shape mid-sentence. Of the 24 languages this plugin is translated into, 11 could not be drawn by the font shipped to draw them. The accented Latin is now included, and only downloaded by readers whose language needs it. Alphabets this typeface does not cover, such as Cyrillic and Japanese, still come from the device, as they always have.
Languages are named, not coded. Installed languages could show as "pl_PL" with the same code repeated underneath, and the site language menu could do the same, while the list of waiting translation updates beside them showed proper names. It depended on a cached list from WordPress.org that quietly expires, which is why installing any language pack appeared to fix it. Every list names a language the same way now, and falls back to the browser, which can always name one.
A removed language stops asking to be updated. Removing a language left it listed under translation packs ready to update, because the check for WordPress core's own translations was skipped when it had run in the last minute, which this admin causes on nearly every screen.
Nested lists stay nested when Minn saves them. A list inside a list item was saved as plain markup tucked into its parent item rather than as a list in its own right. Nothing looked wrong: the page rendered the same, and the block editor showed no warning. But it had quietly stopped seeing those indented lines as list items, so its own list controls no longer applied to them, and this happened on every save of any post containing an indented list, whoever wrote it. Such lists are now saved with their structure intact, including their own settings and any styling on the indented items. Lists pasted from Word were affected the same way and are fixed by the same change.
The Minn bar gets out of the way of image lightboxes. The bar sits above WordPress's own toolbar, which also put it above anything a page opens over itself: click a screenshot to enlarge it and the mark stayed floating on top of the darkened backdrop. It now notices when something has taken the whole screen and sits behind it until that closes. It works this out by asking what is actually on top rather than by guessing at a number, so it steps aside for any lightbox or full-screen viewer, whichever plugin or theme opened it, and decorative full-page layers still leave it alone.
Settings fields say what they are, and status text is readable in light mode. Every field on the Settings page had its caption sitting beside it as plain text rather than as a label, so a screen reader announced nine unnamed boxes on the Site tab alone, and clicking a caption did nothing. They are real labels now. Separately, several pieces of coloured status text kept the colours tuned for the dark theme: the core update chip, the update badge, the active and spam and license pills, the switch-back link and every soft Delete button all fell below the contrast minimum on a white background, one of them at 1.84 against a required 4.5. They use the darker light-theme colours that already existed for this purpose.
A security review of this cycle, and everything it found. An audit went through the plugin again. Nothing it found could be reached by a visitor who is not signed in, and nothing let anyone sign in who could not already. What it found were places where Minn allowed or showed a little more than the plugin or WordPress screen it stands in for. All of it is fixed below.
A snippet is judged by where it runs, not only by what it is called. WPCode decides which snippets to run from the place a snippet is filed under, and it never checks the snippet's type when it does. Minn asked only about the type. So a snippet filed as plain text, the one kind a person can write without permission to store raw markup, ran as code the moment it was placed in one of the spots WPCode executes, and that spot was both offered for every kind of snippet and the one chosen by default. Minn now decides from the kind and the place together, says plainly which places run code, and refuses a pairing it does not offer. Moving a live snippet into one of those spots counts as starting it, the same as switching it on. Two smaller repairs came with it: creating a snippet no longer forces its insert method on, and a switch sent as the word "false" is no longer read as on, which had let an ordinary rename start a snippet that was meant to run only where its shortcode appears.
Removing a language removes only that language. Which files belong to a language was decided by looking for its code anywhere in the file name, and plugin names often contain something that is also a language code. Removing Ukrainian deleted the German files of a plugin whose name happens to start with "uk", on a site whose own language is German. Files are now matched against the languages the site actually has.
Gift card codes and expiry follow WooCommerce. A gift card code is spendable by whoever holds it, and WooCommerce shows only its last characters to anyone below administrator unless the store says otherwise. Minn was printing the whole code with a copy button, and now follows the store's setting. Resending a card's email is also not the harmless act it looks like: WooCommerce's send routine records the card as delivered and can reset its expiry to never. Their own screen refuses this for expired and disabled cards; Minn checked only that there was an address, so a button labelled Resend email could quietly return a written-off card to circulation. It is refused now, and hidden on a disabled card.
Deleting a network asks which network you administer. On an installation with several networks, the check for deleting one asked whether you administer the network you are looking at rather than the one being deleted, so one network could remove another along with its sites, content and users. Moving a site learned this last release; deleting a network beside it did not. Deleting the sites inside a network is also no longer implied by the request.
Uploaded files and notes follow Gravity Forms. An entry's uploaded files were shown by their real address instead of the protected link Gravity Forms' own entry screen uses, and since the folder name is the only thing keeping those files private, one link exposed everything that form had received. Entry notes are a separate permission in Gravity Forms because that record also holds the text of every email the form sent; Minn was showing and accepting them on the permission for viewing entries.
Every Perfmatters field that reaches the page is treated as markup. The rule that code fields need permission to store raw markup named the three boxes labelled as code, but the DNS prefetch list is printed into the page head with nothing escaped, so it is markup by any other name and was writable with ordinary settings permission. The rule now follows what a value does rather than what its field is called.
A debug log outside the site is left alone when reading it too. Where the debug log points at a file outside the site, which on shared hosting is often a log the whole server writes to, clearing it already refused. Reading it did not: the viewer returned the full path on the server and the end of the file. Both now refuse.
User and media lists stop where the caller's permission stops. WooCommerce gives shop managers a user list, then limits them to customers one account at a time. Minn kept going and showed staff and administrator email addresses, roles and whether they had an active login. The list and its login filters now follow that account-by-account rule. Image blocks and media folders learned the same lesson: an attachment inside a private post is no longer resolved or included for someone who cannot read it.
Duplicate respects post types that cannot be created. A custom post type may allow an existing item to be edited while deliberately withholding the ability to create another. Duplicate checked only the first half, so it could create a draft anyway. It now asks the post type's own create rule before copying anything.