Basehim 1.2.72: your own dashboard, apps that can't break your site, and public pages for apps

Five releases in, here is what changed in Basehim from 1.2.68 to 1.2.72. The theme is the same throughout: a site that stays up, an admin that's yours to arrange, and apps that can do more without being able to do harm.

Update from Admin → Updates. Each release installs on the one before, and there is nothing to do afterwards.

A dashboard that's yours (1.2.68–1.2.69)

The dashboard is now a grid of cards that everyone arranges for themselves. You can:

• add, remove, resize, collapse and reorder cards;
• change a card's settings;
• refresh a single card without reloading the page.

Your layout is saved to your account, so it's the same on your laptop and your phone. An administrator can make one layout the site default.

Apps add cards the same way core does, as stats, lists, tables, charts, activity feeds or status checks. A card that is slow or broken affects only itself. Developers: see Dashboard widgets.

The new dashboard also fixes a privacy problem. Every signed-in account could see the titles of other people's drafts and pending comments on the dashboard. Each card now has its own permission, and its data is limited to what you may see.

Simpler installs, smoother media (1.2.70)

• The installer no longer asks for a table prefix. Each new site gets its own random one, so several sites can safely share a database.
• The Media Library shows a calm placeholder of the right shape while images load. Its file details window works like Quick Edit, full screen on phones.
• Dashboard cards that load their own figures (such as Analytics) no longer get stuck on "Loading…" after a refresh. On phones, New post, Upload and Customize now sit on one line.

One broken app can't take your site down (1.2.71)

Before, an app that clashed with Basehim's own code could stop every page from loading, the admin included. Now Basehim checks an app's code before running it:

• when the app is installed, updated or activated;
• whenever its files change.

If an app fails anyway, Basehim switches that app off, and your pages, admin and other apps keep working.

The Apps screen shows the app in red with the reason, and every admin page tells you until it's dealt with. View report explains what went wrong, when and where. Once the app is fixed, Check and reactivate turns it back on, but only if it now passes the checks. The app's files, settings and data are never touched. Developers: see When an app fails.

Public pages for apps (1.2.72)

Apps can now add their own public pages and web addresses: a shop, a pricing page, a members area, a small API. Those pages appear inside your theme, with your header, footer and menus.

Your own pages, posts, search, feed and admin always come first. An app can't take over one of Basehim's addresses or slip a page into the admin area without sign-in. If it tries, it's refused, and the app's report says why. The report also lists every address an app serves and the checks on each.

Developers get one small API with every HTTP method, parameters, named URLs and per-route sign-in, permissions, CSRF protection and rate limits. See Public routes for apps.

Also in these releases

• Saving your preferences in two tabs at once no longer loses one of them.
• Requests that use the wrong method now get "method not allowed" instead of "not found".
• The installer shows the right version number again.