austinginder/minn-admin v0.49.0

on GitHub

The press-play release. Audio and video now sit in your writing the way images do: type /audio or /video, or drop a file on the page, and it plays where you put it. A site that mostly writes in its own content type can count it on the Overview and put it first in the New menu, and an editor panel's door can say what's set rather than how many fields are. ACF 6.8.11 started guarding its fields more closely, and duplicating a post kept none of them until Minn followed its rules. An outside audit of v0.48.0 found two medium issues and twelve low ones. The full review of this release candidate found one high, five medium and one low, and reviews of the fixes and of the late work found two medium issues and a handful of lows of their own. Every finding is fixed or left with its reason written down, and every fix a test can reach has a test that fails without it.

Added

• Audio and video in the editor. Type /audio or /video, or drop a file on the page, and pick or upload it. The player lands in your text, ready to play. Hover it for its settings: a caption, Replace, move, duplicate and Remove. What's saved is WordPress's own Audio and Video blocks.
• Your site's main content type on the Overview. The new minn_admin_overview_stats filter lets a site put the count of what it mostly writes where the posts count sits, and minn_admin_new_first puts that type first in the New menu.
• Panel doors that say what's set. An editor panel's field can ask to be named in its door with inSummary, so the door reads "Ohio to Illinois · Museum, Town" instead of "4 fields · 3 set". emptySummary says what's missing and tints the door until it's filled.

Fixed

• Editing a post can't wake up hidden markup. Some odd markup that Minn's editor holds back could come alive again when a table was edited, block markup was pasted or a block was inserted from the / menu, and then run a script as whoever was editing. The editor now settles markup until a second reading can't change it before inserting anything, and refuses what never settles.
• Frames in a post load in a sandbox while you edit. A frame showing a page of the same site loaded with full access to the editor around it, so someone allowed to write raw HTML could act as whoever opened the post. Frames now load sandboxed while Minn shows them, embedded objects such as PDFs show on the published page rather than in the editor, and the post still saves exactly as written. YouTube, Vimeo and the other standard embed players still play in their previews.
• Popover buttons in a post stay inside it. A button in a post that opens a popover or dialog could, once clicked in the editor or the revision viewer, cover the whole admin with something that wouldn't close. Those buttons now do nothing while Minn shows the post.
• Block previews don't open edit controls. Clicking a link, image or table inside a block's preview, where content wore the class of Minn's editable areas, opened controls whose changes were then thrown away on save.
• Custom HTML survives a save. Saving a post turned its Custom HTML blocks, and older HTML between blocks, into paragraphs and dropped a wrapping div. An untouched one is now saved exactly as stored, and an edited one stays a Custom HTML block. Custom HTML that opens a tag in one block and closes it in a later one, or holds a stray closing tag, is kept exactly as written and can't swallow, duplicate or drop the blocks around it.
• An unclosed tag can't swallow the blocks after it. Saving a post in Minn could let a block with an unclosed tag, or a container with unusual wrapper markup, swallow the blocks after it, drop them, or save another block's preview into the post. Such a block is now kept exactly as stored.
• Block previews can't be typed into. Text in a block's preview marked editable by its content took typing that was thrown away at save.
• Text in a post can't pick up Minn's controls. Post text styled like Minn's tab strips or notices got Minn's tab buttons, which the next save wrote into the post.
• Email previews drop disguised prefetch links. A logged email or notification could tell its sender when you opened its preview through a prefetch link written in character codes, or inside a frame nested in the message. Previews now remove them in every form.
• Text in a post can't act as a Minn button. Post text wearing the notification panel's or a dialog's markup could start a plugin update or replay a notice's action when clicked in the editor. Those controls now answer only inside their own panel.
• Reset links stay hidden in mail logs however they were encoded. A password reset link that a tracking link, an HTML entity or a plugin's debug log had encoded could show its key in an email log. Minn now reads such a link the way a browser would before deciding what to hide, so the key stays hidden in every spelling.
• Gravity SMTP's log keeps message text where it belongs. An email sent through Gravity SMTP's Zoho connection showed the message itself under Stored headers, outside the reset-link mask. Stored headers now lists only the headers, every row of a logged email goes through the mask, and readers who may not open messages can no longer find emails by words inside them.
• Editor previews look up only embeds. A preview turned any bare web address in a block into an embed lookup and left a stored copy behind for each one, so one preview could make hundreds of lookups and rows. Previews now look up only an embed block's own address and the videos and addresses that covers and patterns look up themselves, at most ten new ones at a time, keep the answer with the post being edited or for a day, and leave no stored copy behind.
• The SEO panel follows your SEO plugin's own content types. On a content type SEOPress, Yoast SEO or SureRank keeps its SEO box off through a setting or a filter, Minn still showed its SEO panel, so SEO fields could be saved there. It now shows only where the plugin would.
• FluentSnippets and WPCode authoring switches apply in Minn. While FluentSnippets' REST API authoring setting or WPCode's AI & Automation Access setting is off, an Application Password could still add, edit or turn on snippets through Minn. Minn now refuses them as the plugins do, and Minn's own screens keep working.
• More plugin keys stay hidden. The database browser showed, and other screens could repeat, keys that Bookly, Gravity Forms, WPCode, Burst Statistics, WPForms, Bricks and Autoptimize keep in their settings: PayPal and marketing account keys, calendar and SMTP secrets, purchase codes, share-link tokens and API keys. They are now hidden like the rest.
• Gravity Forms form settings keep hidden keys. Saving a form's settings after editing text around a hidden key replaced the key with its placeholder. Minn now keeps the key when it comes back unchanged and refuses a save that would store a placeholder.
• Even more plugin keys stay hidden. Webhook and connection secrets, REST and AI keys, a private podcast feed's password, a visitor IP salt, Jetpack Protect keys, an UpdraftPlus licence key and Smash Balloon's Facebook access tokens, kept by Fluent Forms, Ninja Forms, Everest Forms, Seriously Simple Podcasting, WP Statistics, Jetpack, UpdraftPlus and Smash Balloon's feeds, are now hidden too, as are the secret Ninja Forms' PayPal connection signs with and the hash of a Password Protected site's shared password.
• Editing a form answer that holds a hidden key works. In Gravity Forms, Ninja Forms, WPForms and Elementor forms, such an answer always reported that the entry had changed, and saving it could put the key's placeholder in the key's place. It now saves like any other answer and keeps the key.
• Reset links stay hidden in every email log's list and details. A list's subjects, and an email's headers, error, provider reply or source in WP Mail Logging, FluentSMTP, Post SMTP and Gravity SMTP, could show a reset link's key to someone who may not read mail whole.
• Elementor MCP and Novamira refuse Application Passwords. Their settings, connections and memories could be changed with an Application Password that also brought a valid nonce. Only a signed-in browser can change them now.
• Bricks templates keep their tags. Saving a template could create a tag named after a hidden key's placeholder; a refused tag now also leaves the title and type as they were.
• Custom CSS & JS asks for its own permissions. An administrator the plugin never granted its snippet permissions, as happens when it is installed from the command line, could still add and publish site-wide code in Minn, which the plugin's own screens refuse. Minn now asks for the plugin's permissions, like its screens do.
• Gravity Forms add-on feeds need full access unless the add-on says otherwise. A form-builder role could switch on or delete the feeds of an add-on that names no permission of its own, which Gravity Forms opens only to full access. Minn now asks for full access there too.
• JetEngine meta boxes shown to nobody stay hidden. A meta box limited to chosen roles or posts, with none chosen, was shown and saved in Minn for every editor. It now stays hidden, as in JetEngine.
• Store settings keep the choices you didn't touch. Saving a WooCommerce settings section could reset an untouched dropdown to its default when its saved choice was not among the options offered to you. It now keeps its saved choice.
• Gift card balance edits stay out of sales reports. Adjusting a WooCommerce Gift Cards balance in Minn recorded the change as a sale or a redemption, so the plugin's analytics counted it. Minn no longer adds that record.
• A shared preview link stays on until you turn it off. A Public Post Preview request that said neither on nor off turned the post's shared link off. It now has to say which.
• Previews can't break another post's embeds. A Query Loop or Latest Posts block that shows other posts' full content could, once a preview reached its ten-lookup limit, store those posts' videos and links as failed embeds, so the published posts showed a plain link until they were next saved. Previews now store nothing for the posts they show.
• Taking money off a gift card can't undo a purchase. If a customer paid with a WooCommerce Gift Cards card just as you took an amount off it in Minn, Minn could write the card's old balance back and hand the customer's spend back to the card. Minn now takes amounts off the way the plugin's checkout does, and asks you to reload when the card no longer holds enough.
• The site visibility switch has to say on or off. A request that said neither turned a maintenance, coming-soon or password mode off and opened the site. It now has to say which, like the other site switches.
• Snippet switches have to say on or off. In Custom CSS & JS and Header Footer Code Manager, a request that didn't say turned a snippet off, and one that wasn't JSON turned it on. Both now have to say which, as WPCode and FluentSnippets already do.
• Redirection's permalink monitor comes back as it was. Switching Monitor permalink changes off and on again in Minn left only posts and pages monitored and dropped the associated redirect path. Turning it back on now restores the post types, group and path it had, even after a refused save or once one of those post types is gone, and switching it on when it is already on changes nothing.
• Gravity Forms notifications without an event stay unsent. A notification saved with no event never sends, and Gravity Forms makes you pick one before it saves it again. Minn showed it as sent on form submission, so changing just its subject started sending it. Minn now shows the event blank and asks you to pick one, as Gravity Forms does.
• JetReviews approve has to say approve or unapprove. A request that didn't say unapproved the review, which took it off the page and changed the item's average rating. It now has to say which.
• WPForms stars have to say star or unstar. A request that didn't say unstarred the entry. It now has to say which.
• Membership discounts keep their type and stay off until switched on. Saving a WooCommerce Memberships purchasing discount without saying whether it was on, or which kind it was, switched it on and made it a percentage, so an inactive discount started applying at checkout and a fixed amount became that many percent. Minn now saves them as Memberships does.
• Gravity Forms conditions keep what you didn't set. A notification, confirmation or field condition saved without its "all or any" choice, its show or hide choice or a rule's operator had them filled in, which could start sending a notification, show a confirmation or hide a field that Gravity Forms would leave alone. They are now saved as sent, as Gravity Forms saves them.
• Fluent Forms confirmations keep their redirect. A confirmation with no type stored showed as a message and, once its message was edited, stopped sending visitors to its address. It now shows no type and asks you to pick one, as Fluent Forms does.
• Opening an Everest Forms entry leaves it unread. It used to mark it read, which Everest's own screen never does.
• Forminator entries hide their private keys. An entry's details showed a lead's ownership token and a signup's account activation key among the answers. Forminator's own screen shows neither, and now Minn doesn't either.
• ACPT location rules keep their match. A location rule saved without saying is or is not was saved as is, so a field group could appear where ACPT shows it nowhere, or flip from is not to is. Minn now keeps the stored choice and asks for one on a new rule.
• Store data retention keeps its unit. A WooCommerce retention period with no unit saved was saved in months, where WooCommerce counts days, so pending, failed and cancelled orders and the customer details on them were kept much longer. It now saves days, as WooCommerce reads it.
• Saving advanced store settings can't make your first post the checkout. On a store whose checkout page was never set, saving the Advanced settings stored a value WooCommerce then read as post 1, sending shoppers there to check out. It now stays unset.
• Rank Math advanced robots stay off when you clear them. Clearing the last of a post's advanced robots directives removed the post's own setting, so the site-wide directives it was overriding came back on the page. Minn now stores them off, as Rank Math does.
• Block previews keep a theme's container queries. A theme that lays out its sections with @container lost those rules in Minn's previews, so every section fell back to its narrow layout. They now come through with the theme's other rules.
• ACF field instructions show in the editor. Text written for a field under Instructions never appeared in Minn's custom fields panel, though Minn's own field builder promises it's shown to writers. It now sits under the field, as plain text.
• No buttons for things you can't do to a record. A content type whose records can't be added still appeared in the New menu and the palette, and a record you can't delete still offered Move to trash and Duplicate, each ending in a refusal. Those are gone where they can't work.
• Blocks are called by their names. A block from a plugin or theme showed its code name on its chip (gravityforms/form). It now shows the title it registered.
• The Overview counts custom content. Its Activity chart and Recent activity only looked at posts and pages, so a site writing in its own content type looked empty. Types Minn lists as content now count.
• Editors see each other's work under Recent activity. The feed asked for a permission no role holds, so an Editor saw only their own posts, or "No activity yet."
• A new draft says Draft. An entry opened before its first save showed its status as auto-draft.
• The search visibility switch is only for those who can flip it. An Editor was offered it on the Overview, and the switch answered with an error.
• Duplicating a post keeps its ACF fields. Since ACF 6.8.11, a copy made in Minn came out with none of the original's custom fields. A field now copies with its value when ACF shows it on that post to whoever is duplicating, as ACF's own screen would let them save it.
• ACF relationships follow ACF's own rules when saved from Minn. On ACF 6.8.11 or later, a relationship or post field saved in Minn could pick a post its writer can't read, and a two-way relationship could write its link back into a post they can't edit. Minn now saves through ACF's own checks: posts already chosen stay, and a back-link lands only where the writer could edit.