austinginder/minn-admin v0.48.0

on GitHub

The move-it release. Images, code blocks and tables now move up and down from their own settings and by dragging, the way blocks Minn keeps whole already did, and a screenshot pasted on Windows or Markdown from an AI chat's Copy button arrives the way you meant it, all from one reader's report. On a store, the Overview opens on what sold each day; Content gains a Drafts filter; and a post type's own taxonomies get pickers in the editor. An outside audit of v0.47.0 found three medium issues and twenty low ones. The full review of this release candidate found twenty-eight low issues and nothing worse, and reviews of the fixes and of the late editor work found one medium and a handful of lows of their own. Every finding is fixed or left with its reason written down, and every fix a test can reach has a test that fails without it.

Added

• Sales on the Overview. On a store, the Overview chart now opens on what sold each day: the sales amount as bars, the day's order count beside it when you hover, and the range's total and number of orders in the header (each week over 90 days). Click a bar to open exactly those orders in the Orders list, narrowed to that day. It counts what WooCommerce's own sales report counts (completed, processing, on-hold and refunded orders, by the day they were placed) and is live, so an order placed a minute ago is already on today's bar. The ⇄ button steps on to Traffic and Activity and the chart remembers where you left it. It shows for people who can read the store's reports, not for a vendor who handles only their own orders. The Orders Analytics chart's hover card, which called its sales "events", now names the sales and orders too.

Improved

• Move images, code and tables up and down. An image's settings (click it) now have ↑ and ↓ beside Duplicate and Delete, and so do code blocks and tables, the way blocks Minn keeps whole already did. Dragging an image moves it, where it used to drop a copy and leave the original; a line shows where it will land. Blocks Minn keeps whole move by dragging their picture too. The keyboard way is ⌘⇧⌥T and ⌘⇧⌥Y (Ctrl+Shift+Alt+T and Y on Windows), shown on the buttons; inside a Columns block it now saves the new order, which it didn't before (#69).
• SiteGround caching in System health. With SiteGround Speed Optimizer installed, System health shows which of its caching layers are on: Dynamic cache, file-based caching and Memcached. It passes when either page cache is on, and warns when none is, or when Memcached is the only layer on, since that caches database queries rather than pages.
• A Drafts filter in Content. Drafts are listed by their dates among everything else, so they could end up anywhere in a long list. A Drafts button beside Modified and Trash now narrows the list to drafts, for one post type or all of them. It and Modified take turns, since Modified means published content with unsaved edits.
• Custom taxonomies in the editor. A post type with taxonomies of its own, a wiki's topics or a portfolio's skills, now shows one picker per taxonomy in the editor's Settings: the item's terms arrive picked, a chip adds or removes one, and a name typed and Entered picks that term, making it when there is none yet. Saving sends only the taxonomies you changed. Posts keep their Categories and Tags as before.
• Content blocks show their words up front. In Edit content, a block that keeps its words in its settings, as a server-rendered timeline, card or stat block does, now shows those fields open on its card instead of behind a Settings button, and each card is labelled with its own title so a long list scans.
• ⌘K links a selected web address to itself. Select a pasted address in the editor, https://example.com/page or just example.com/page, press ⌘K (Ctrl+K on Windows) and the link field now opens filled with it, so Enter makes it a link. Typing replaces it, and selected words still open an empty field to search your content. (GitHub #68)
• List blocks arrive with a first item. A block whose registration names example children (block.json example.innerBlocks, the same field the block editor's previews use) is inserted from the / menu with those children, ready to edit, where it used to arrive empty with nothing to open.

Fixed

• Pasting a screenshot on Windows uploads it. Windows puts a copied image on the clipboard with a little HTML around it, which Minn didn't recognise as just an image: it linked to the image's original address instead of uploading the screenshot, or, for an image an app holds inline, pasted nothing at all. A copied image now uploads to your library either way, and text copied with images still pastes as text (#69).
• Markdown from an app's copy button gets the Markdown choice. Some apps' copy buttons and raw views put Markdown on the clipboard inside a styled box, so it pasted as one paragraph full of # and ** marks. Minn now offers to format it as it does any other Markdown paste (#69).
• Classic posts don't store Minn's image marker. A classic (non-block) post that saved an image uploaded in Minn kept a Minn-only attribute on the image in the post itself. It is now left out, as block posts always did.
• White Label CMS hides options pages in Minn too. An options page an agency hid from clients in White Label CMS, such as a theme's settings page under Appearance, still showed in Minn under Tools. Minn now leaves out every ACF, JetEngine or ACPT options page the client's wp-admin menu leaves out, and the whole item once none is left. A change saved in White Label CMS also reaches Minn on the next page load, where it could take up to fifteen minutes before.
• wp minn install purges the host's caches after the switch. A host's page cache, Kinsta's for one, kept serving the WordPress pages it held after a site switched to Minn from the command line. The command now waits for the site to answer as Minn and then runs wp cache flush, as Minn's own installer does; --no-cache-flush skips it.
• Numbers and dates follow your language everywhere. The Gravity Forms builder's entry count, the count in its "Remove this field?" warning and the date on an order's page used your browser's language instead of the one you chose for Minn, so a Dutch reader on an English browser saw "1,234" inside a Dutch sentence. They now format like every other number and date in Minn.
• OPcache reads as on where the host hides its status. Some shared hosts keep PHP's OPcache status private, and System health then warned that OPcache was off on sites where it was running. Minn now checks whether the extension is loaded and switched on, and says OPcache is on with its status hidden by the host. (GitHub #67)
• A Shop Manager no longer reads an administrator's password reset link in a mail log. WooCommerce lets a Shop Manager edit customers, and Minn took that as leave to show logged mail whole, reset links included. Mail bodies now show whole only to someone who can edit every administrator; anyone else a log is open to sees reset links with the key hidden.
• A <noscript> in a post stays inert in the editor. Its inside reads as markup to Minn's safe parse and as plain text to the page, so a crafted attribute in it could become a live image and run script once the editor re-read its own markup, as every table change does (Safari still read it that way). The same re-read also turned an ordinary noscript's markup into escaped text on save. The editor now keeps a noscript's inside out of the page entirely and puts it back, unchanged, when it saves.
• A post's content stays inside the editor. WordPress lets every role give a paragraph a fixed position and a stacking order, so a Contributor could write one that covered the whole admin for whoever opened the post, catching every click. The editor, the rich-text field editor and the revision preview and comparison now keep content inside their own box.
• Minn's routes answer only as registered. WordPress matches REST routes without regard to case, so /wp-json/Minn-Admin/v1/… reached Minn's handlers while the checks that hide stored keys in Minn's responses and guard writes that could hand over the site read it as another plugin's request. Any other spelling of Minn's namespace is now refused before it reaches a handler.
• ACF block previews follow ACF's own rule. Outside a post the editor can edit, Minn now renders an ACF block through ACF's preview only for someone who passes acf/blocks/render_capability (Edit theme options unless the site narrows it), as ACF's own preview does; anyone else sees the block as the site shows it. The preview path also ends with the render that asked for it.
• Sucuri's audit log is the install owner's. Sucuri keeps one log for every site and network it runs on, so on a multi-network install only the main network's super admins see it in Minn, as with the other install-wide security logs.
• More plugins' keys stay out of Minn's screens. The tokens All in One SEO, Squirrly, Rank Math, SEOPress, SureRank and SiteSEO keep for their AI, analytics, indexing and Search Console connections, the integration keys Forminator, Fluent Forms and Gravity Forms add-ons keep (mailing services, Slack, Google Sheets, Twilio, the Web API), and Otter Blocks' Stripe, OpenAI, captcha, mailing-list, webhook and template-cloud keys are now hidden in the database browser and masked wherever a copy of one would leave in a Minn response.
• The SEO panel follows each SEO plugin's own switch for a content type. Where All in One SEO, SEOPress or SiteSEO has its SEO box switched off for a type, Minn's SEO panel now offers no fields for it either, and a type the SEO plugin never shows its box for (a type that is not public) is treated the same way with Yoast and Rank Math too. Minn had read SEOPress's "disable" setting the wrong way round and missed the other two.
• Mail logs hide more reset links. For readers a mail log hides reset keys from, Minn now also recognises Ultimate Member's and MemberPress's reset links, a reset link inside a click-tracking link (encoded once or twice), other ways of writing "&" or "=" in an email's HTML, and a link cut across lines in a logged SMTP conversation, even where the cut falls inside the word "key".
• Gravity Forms previews never show a password. A notification or confirmation preview, and a test send, now leave a password field's merge tag as a placeholder and blank the password on the entry they render from, as Gravity Forms' own entry screen does. A site that has Gravity Forms keep passwords would otherwise show the latest submitter's.
• Switching Gravity SMTP's sending service keeps the others on. Choosing a new primary service in Minn marked every other enabled integration, the backup service included, as switched off in Gravity SMTP's own records. It now changes only what Gravity SMTP's own screen changes: the new primary, and the old one's primary flag.
• Header Footer Code Manager snippets run as typed. That plugin stores a snippet with its HTML entities encoded and decodes it when it prints the snippet, and Minn stored and showed the raw text instead. A & or < written on purpose in a snippet saved from Minn ran as & or <, and a snippet saved in Header Footer Code Manager opened in Minn as encoded text. Minn now stores and reads snippets the way that plugin does.
• A Styles change keeps the palette it did not touch. On a site where someone who cannot post unfiltered HTML (a site administrator on a network) changed one color in Styles, after a theme's palette or typeset had been applied by someone who can, WordPress dropped the whole applied palette and its fonts on save. Minn now files them the way WordPress's own Site Editor does, so they survive.
• Text in a post can no longer pose as a pattern's Edit button. A contributor could mark ordinary text so that clicking into it in Minn's editor saved the post and opened a pattern of their choosing, and the text could not be typed into. Only Minn's own Edit pattern button on a synced pattern opens one now, and only the pattern that block uses.
• Block settings in a post's markup stay with the block they belong to. Minn's editor keeps a block's settings on the block while it is edited, under a name post content could wear too, so a contributor could write settings that an editor's next save in Minn turned into real block settings, past the cleaning WordPress gives the ones written directly. Minn now marks its own and ignores any the content brought.
• Email previews drop what could reach the sender. A logged email or notification preview now leaves out an instruction to load another page, early lookups of the sender's servers and a base address for its links, which its blocked-images frame did not cover in every browser.
• Menus and widgets no longer undo a change made elsewhere. Arranging a block theme's menu, moving a widget and giving a classic menu a location each wrote back the whole list as the page first loaded it, so a change made since in the Site Editor, another tab or by another administrator was quietly undone. A widget move and a location now apply to the list as it is stored; a menu that changed since asks you to make your change again on the reloaded copy.
• A customer's Email menu entry opens your mail app. Right-clicking a customer offered "Email …", but the link was empty and did nothing. It now opens a new message to them.
• The store Analytics chart follows its range. Orders, Analytics drew the same ten days whichever range was picked, newest on the left. 30d and 90d now draw a bar for every day, oldest first, and All starts at the store's first sale.
• The Media month filter and a coupon's order list ask what WooCommerce and WordPress ask. The month filter and the Overview's Media files card counted every author's uploads for anyone who could write posts, a Contributor included; both now need the right to upload, as WordPress's Media screens do. A coupon's order list showed every order that used the code to anyone who handles orders; on a marketplace a vendor who handles only their own orders could see other sellers' volume, so it now needs the right to edit every order.
• Gravity SMTP asks for each setting what Gravity SMTP asks. Its General tab asked only for the general settings capability, so a role Gravity SMTP keeps from test mode (which stops every email) or from the email and debug log settings could change them in Minn; each now asks its own capability. Disable and Delete on a routing rule could land on a different rule if one was added in Gravity SMTP between loading the list and the click; each rule is now found by what it is, not its place in the list. And the database browser no longer shows Gravity SMTP's raw messages and debug lines, or the raw logs of FluentSMTP, WP Mail SMTP, Post SMTP, WP Mail Logging, Site Mailer and SureMails, to an administrator those logs show reset links to with the key hidden.
• Gravity Forms entry lists leave out repeaters that hold a password. A password field was left out of the entry list only at the top level of a form; inside a repeater, every row's password went out with the list. A repeater with a password field among its fields is now left out, as Gravity Forms' own entry screen does.
• Inserting a design no longer hands you someone else's private image. When a design's picture shared a file name with one already in the library, Minn used that one, even when it belonged to another author's private post you could not open. It now fetches a fresh copy instead.
• An update batch's progress file can't be fetched by its link. The progress Minn shows during a bulk update is also kept in a file, so it stays readable while the site is in maintenance mode, and the file was named after the code in the page's progress link. On a server that ignores .htaccess (nginx), anyone holding that link could fetch the file directly, past the one-hour limit, and it still carried the server's temp folder paths. The file is now named with a key only the site holds, so the link doesn't lead to it, and those paths are taken out like the site's own.
• Switching to Minn Engine runs once at a time and keeps its report private. Two clicks on Switch, or Switch beside wp minn install, could start two installers moving the same files; a second run is now refused while one is going, as WordPress's own updater does. A failed switch's report, which names the site's folders, was written beside the staged release where a server that ignores .htaccess could hand it out; it is now kept with the check, for the person who ran it.
• Minn's write safeguards hold in two more corners. The refusal of Minn's own routes spelled another way stood aside when another plugin's REST filter answered with an empty value, and a delete of every account's role at once (a plugin's reset or uninstall action, say, whichever account it named) went past the check that keeps who runs the site as it is. Both are refused now.
• WPCode snippets with quotes switch on again. WPCode 2.4.1 changed how it test-runs a snippet you switch on, so a PHP snippet with a quote or backslash saved from Minn failed its own check and stayed off. Minn now tells WPCode the way its own editor does, and broken code is still refused.