panel

Added

• Java 21 to Minecraft eggs

Changed

• Updated Minecraft EULA link

Fixed

• Fixed backups not ever being marked as completed (#5088)
• Fixed .7z files not being detected as a compressed file (#5016)

SHA256 Checksum

b41774a6c7046bdfd4303969c6700d7f46f069b5250dfad25f91bbc389c9c063  panel.tar.gz

Changed

• Better node ownership checks for internal backup endpoints
• Improved validation rules on docker_image fields to prevent invalid inputs

Fixed

• Multiple XSS vulnerabilities in the admin area (GHSA-384w-wffr-x63q)

SHA256 Checksum

e72510ba7c8f40b1501add62f15e79e0ecc30f0740a101e06c1b831221668cf9  panel.tar.gz

Fixed

• Rust egg using the wrong Docker image, breaking Rust modding frameworks.

SHA256 Checksum

b01c97c14775c847725c54a33b5981bd77d2265642a9c26e6748d908814b94b3  panel.tar.gz

Added

• Added support for the server.queryport option on the Rust egg.
• Added support for the Carbon modding framework to the Rust egg.

Changed

• Upgraded to Laravel 10.
• Sensitive data is no longer shown in the CopyOnClick toast notification.

Fixed

• Allow SVGs to be edited in the server's file manager.
• Properly validate the request body when creating a backup.
• Fixed issue with schedules running at the wrong time when the panel utilized a timezone with non-hour offsets (such as Australia/Darwin).
• Fixes the log directory when running the Panel in a container.
• Fixes the permission name used to check if a user has permission to read files/folders.
• Fixes the ability to unset a server's description through the client API.
• Fixed the MassActionBar on the server's file manager blocking elements below it, preventing them from being interacted with.

SHA256 Checksum

3b1a9f893aa537a075b319c18ef4cf860889e6d96b0939e3053fa95e690d040f  panel.tar.gz

Changed

• When updating a server's description through the client API, if no value is specified, the description will now remain unchanged.
• When installing the Panel for the first time, the queue driver will now all default to redis instead of sync.

Fixed

• php artisan p:environment:mail not correctly setting the right variable for MAIL_FROM_ADDRESS.
• Fixed the conflict state rendering on the UI for a server showing reinstall_failed as restoring_backup.
• Fixed the unknown column uuid error when jobs fail, causing them not to get stored correctly.
• Fixed the server task endpoints in the client API not allowing sequence_id and continue_on_failure to be set.

SHA256 Checksum

5bd48cf0fe5fd605ced51928a35eff436cab163cfb60f5616dd29dec9ad3e657  panel.tar.gz

Changed

• Telemetry no longer sends a map of Egg and Nest UUIDs to the number of servers using them.
• Increased the timeout for the decompress files endpoint in the client API from 15 seconds to 15 minutes.

Fixed

• Fixed Panel Docker image having a v prefix in the version displayed in the admin area.
• Fixed emails using the wrong queue name, causing them to not be sent.
• Fixed the settings keys used for configuring SMTP settings, causing settings to not save properly.
• Fixed the MAIL_EHLO_DOMAIN environment variable not being properly backwards compatible with the old SERVER_NAME variable.

SHA256 Checksum

77b88e8572c34de2e583300d2eaefa14ed527635d7c6485612c61d6c25c5aba8  panel.tar.gz

Fixed

• Fixed Panel Docker image showing canary as it's version.

SHA256 Checksum

e909caef44a0025622bc7a23075525d21b1ab1b610b147bf1429ffff201b284e  panel.tar.gz

Changed (since 1.10.4)

• Changed minimum PHP version requirement from 7.4 to 8.0.
• Upgraded from Laravel 8 to Laravel 9.
• This release requires Wings v1.11.x in order for Server Transfers to work.
• MB byte suffixes are now displayed as MiB to more accurately reflect the actual value.
• Server re-installation failures are tracked independently of the initial installation process.

Fixed (since 1.10.4)

• Node maintenance mode now properly blocks access to servers.
• Fixed the length validation on the Minecraft Forge egg.
• Fixed the password in the JDBC string not being properly URL encoded.
• Fixed an issue where Wings would throw a validation error while attempting to upload activity logs.
• Properly handle a missing Content-Length header in the response from the daemon.
• Ensure activity log properties are always returned as an object instead of an empty array.

Added (since 1.10.4)

• Added the server:settings.description activity log event for when a server description is changed.
• Added the ability to cancel file uploads in the file manager for a server.
• Added a telemetry service to collect anonymous metrics from the panel, this feature is enabled by default and can be toggled using the PTERODACTYL_TELEMETRY_ENABLED environment variable.

SHA256 Checksum

d1eec5ef6b25f5568a5e0dfad49381f8935cab0f3f0f9cfb672c92db5c2298ea  panel.tar.gz

Changed

• MB byte suffix are now MiB to more accurately reflect the actual value.
• Server reinstallation failures are tracked independently of the initial installation process.

Fixed

• Properly handle a missing Content-Length header in the response from the daemon.
• Ensure activity log properties are always returned as an object instead of an empty array.

Added

• Added the server:settings.description activity log event for when a server description is changed.
• Added the ability to cancel file uploads in the file manager for a server.
• Added a telemetry service to collect anonymous metrics from the panel, this feature is disabled by default and can be toggled using the PTERODACTYL_TELEMETRY_ENABLED environment variable.

SHA256 Checksum

577e154b99c51ae02b0d96b2d3fdd31317161af18690f2f7806ed0340c05444b  panel.tar.gz

Added

• Added the ability for non-admin users to change their server description.

Changed

• Changed minimum PHP version is now 8.0 instead of 7.4.
• Upgraded from Laravel 8 to Laravel 9.
• This release requires Wings v1.11.x in order for Server Transfers to work.

Fixed

• Node maintenance mode now properly blocks access to servers.
• Fixed the length validation on the Minecraft Forge egg.
• Fixed the password in the JDBC string not being properly URL encoded.
• Fixed an issue where Wings would throw a validation error while attempting to upload activity logs.

SHA256 Checksum

7af0aa07f78664a5e078ac21d2666095b4f3c6900f1b96807b82487938405bc4  panel.tar.gz

Fixed

• Fixed an issue where subusers could be given permissions that are not actually registered or used.
• Fixed an issue where node FQDNs could not just be IP addresses.

Changed

• Change maximum number of API keys per user from 10 to 25.
• Change byte unit prefix from B to iB to better reflect our usage of base 2 (multiples of 1024).

SHA256 Checksum

b3614adf61a42b113c54040cafa46f7a602b2fed206ba33138ffc9a22a148f37  panel.tar.gz

Fixed

• S3 Backup driver now supports Cloudflare R2.
• Node FQDNs can now be used with AAAA records with no A records present.
• Server transfers can no longer be initiated if the server is being installed, transferred, or restoring a backup.
• Fixed an issue relating to the use of arrays in the config_files field with eggs.
• Fixed oom_disabled not being mapped in the Application API when creating a new server.

Added

• File manager now supports selecting multiple files for upload (when using the upload button).
• Added a configuration option for specifying the S3 storage class for backups.

Changed

• Servers will now show the current uptime when the server is starting rather than only showing when the server is marked as online.

SHA256 Checksum

4041398471327023fddb9f3ddbbd92ea3e514d92a9a8979d3564389e669a0ba1  panel.tar.gz

Fixed

• Fixes a rendering issue with egg descriptions in the admin area
• Fixes the page title on the SSH Keys page

Changed

• Additional validation rules will now show a toggle switch rather than an input when editing server variables
• The eggs endpoint will now always return an empty JSON object for the config_files field, even if the field is completely empty

Added

• Adds a Force Outgoing IP option for eggs that can be used to ensure servers making outgoing connections use their allocation IP rather than the node's primary ip
• Adds options to configure sending of email (re)install notifications
• Add an option to configure the part size for backups uploaded to S3

SHA256 Checksum

2e179242533e390f44514f7a5cdf7d6acedbdf10bae854d8a3e1243440282b2d  panel.tar.gz

Fixed

• Fixes a surprise clock() function that was used for debugging and should not have made it into the release. This was causing activity events to not properly sync between the Panel and Wings.

SHA256 Checksum

29cbc3f90d4a3cb2ae821ed22fb4b9794b53e023dc294489504bd012b17f886a  panel.tar.gz

Fixed

• Fixes improper cache key naming on the frontend causing server activity logs to be duplicated across server page views.
• Fixes overflow issues on dialogs when the internal content is too long.
• Fixes spinner overlay on console improperly taking up the entire page making it impossible to use navigation controls.
• Fixes 2FA QR code background being too dark for some phones to properly scan.
• File manager now properly displays an error message if a user attempts to upload a folder rather than files.
• Fixes the "Create Directory" dialog persisting the previously entered value when it is re-opened.

Changed

• IP addresses in activity logs are now always displayed to administrators, regardless of if they own the server or not.
• Scroll down indicator on the console has been changed to a down arrow to be clearer.
• Docker builds have been updated to use PHP 8.1.
• Recaptcha validation domain is now configurable using the RECAPTCHA_DOMAIN environment variable.
• Drag and drop overlay on the file manager has been tweaked to be slightly more consistent with the frontend style and be a little easier to read.

Added

• Adds support for the user_uuid claim on all generated JWTs which allows Wings to properly identify the user performing each action.
• Adds support for recieving external activity log events from Wings instances (power state, commands, SFTP, and uploads).
• Adds support for tracking failed password-based SFTP logins.
• Server name and description are now passed along to Wings making them available in egg variables for parsing and including.
• Adds support for displaying all active file uploads in the file manager.

SHA256 Checksum

234ecacfd64a2899e348ae78067e3565dddca3affff032c0aaad5aa86c738d03  panel.tar.gz

Fixed

• Fixes rouding in sidebar of CPU usage graph that was causing an excessive number of zeros to be rendered.
• Fixes the Java Version selector modal having the wrong default value selected initially.
• Fixes console rendering in Safari that was causing the console to resize excessively and graphs to overlay content.
• Fixes missing "Starting"/"Stopping" status display in the server uptime block.
• Fixes incorrect formatting of activity log when viewing certain file actions.

Changed

• Updated the UI for the two-step authorization setup on accounts to use new Dialog UI and provide better clarity to new users.

Added

• Added missing <DOCTYPE html> tag to template output to avoid entering quirks mode in browsers.
• Added password requirement when enabling TOTP on an account.

SHA256 Checksum

1ee3e813a3acc321fdbc049eee5c2631579d6d8af70534268b1c2a01ce74a9b5  panel.tar.gz

Fixed

• Fixes missing "Click to Copy" for server address on the console data blocks.
• Fixes data points on the graphs not being properly rounded to two decimal places.
• Returns byte formatting logic to use 1024 as the base value, rather than 1000.
• Fixes permission error occurring when a server is marked as installing and an admin navigates to the console screen.
• Fixes improper display of install/transfer warning on the server console page.
• Fixes permission matching for the server settings page to correctly allow access when a user has any of the needed permissions.

Changed

• Moves the server data blocks to the right-hand side of the console, rather than the left.
• Rather than defaulting graph values at 0 when resetting or refreshing the page, their values are now hidden entirely.
• [security] Hides IP addresses from all activity log entries that are not directly associated with the currently signed in user.

Added

• Adds the current resource limits for a server next to each data block on the console screen.

SHA256 Checksum

a33d366951eaf6dc65ec075105f5ed6c296bd26eb1fda86e81e5670adffd23e9  panel.tar.gz

Added

• Added support for using Tailwind classes inside components using className={} rather than having to use twin.macro with the css={} prop.
• Added HeadlessUI and Heroicons packages.
• Added new Tooltip.tsx component to support displaying tooltips within the Panel.
• Adds a new activity log view for both user accounts and individual servers. This builds upon data collected in previous releases.
• Added a new column api_key_id to the activity_logs table to indicate if the user performed the action while using an API key.
• Adds initial support for language translations on the front-end. The underlying implementation details are working, however work has not yet begun on actually translating all of the strings yet. Expect this to continue in future releases.
• Improved accessibility for navigation icons by adding a tooltip on hover to indicate what each one does.
• Adds logging for API keys that are blocked from performing an API action due to IP address limiting.
• Adds support for ?filter[description]=foo when querying servers on both the client and application API.

Changed

• Updated how release assets are generated to perform more logical bundle splitting. This should help reduce the amount of data users have to download at once in order to render the UI.
• Upgraded From TailwindCSS 2 to 3 — for most people this should have minimal if any impact.
• Chart.js updated from v2 to v3.
• Reduced the number of custom colors in use — by default we now use Tailwind's default color pallet, with the exception of a custom gray scheme.
• [deprecated] The use of neutral and primary have been deprecated in class names, prefer gray and blue respectively.
• Begins the process of dropping the use of Gravatars for user avatars and replaces them with dynamically generated SVG images.
• Improved front-end route definitions to make it easier for external modifications to inject their routes and components into the codebase without having to modify as many core files.
• Redesigned the server console screen to better display data users might be looking for, and increase the height of the console itself.
• Merged the two network data graphs into a single dual-line graph to better display incoming and outgoing data volumes.
• Updated all byte formatting logic to use 1000 as the divisor rather than 1024 to be more consistent with what users most likely expect.
• Changed the underlying eslint rules applied to the front-end codebase to simplify them dramatically. We now utilize prettier in combination with some basic default rulesets to make it easier to understand the expected formatting.

Fixed

• Fixes a bug causing a 404 error when attempting to delete a database from a server in the admin control panel.
• Fixes console input auto-capitalizing and auto-correcting when entering text on some mobile devices.
• Fixes SES service configuration using a hard-coded us-east-1 region.
• Fixes a bug causing a 404 error when attempting to delete an SSH key from your account when the SHA256 hash includes a slash.
• Fixes mobile keyboards automatically attempting to capitalize and spellcheck typing on the server console.
• Fixes improper support for IP address CIDR ranges when creating API keys for the client area.
• Fixes a bug preventing additional included details from being returned from the application API when utilizing a client API key as an administrator.

Screenshots

SHA256 Checksum

c4aa3902e70a77c64d1bd446ccfdb68becb50354d6839b3f9383021d54667f94  panel.tar.gz

Fixed

• Fixes a bug causing mounts to return a 404 error when adding them to a server.
• Fixes a bug causing the Egg Image dropdown to not display properly when creating a new server.
• Fixes a bug causing an error when attemping to create a new server via the API.

SHA256 Checksum

f973a99eb432c34592fbc4001557551d431b726c32a6554551311d53688c8fbb  panel.tar.gz

Breaking Changes

This version updates the version field on generated Eggs to be PTDL_v2 due to formatting changes. This should be completely seamless for most installations as the Panel is able to convert between the two. Custom solutions using these eggs should be updated to account for the new format.

This release also changes API key behavior — "client" keys belonging to admin users can now be used to access the /api/application endpoints in their entirety. Existing "application" keys generated in the admin area should be considered deprecated, but will continue to work. Application keys will not work with the client API.

Fixed

• Schedules are no longer run when a server is suspended or marked as installing.
• The remote field when creating a database is no longer limited to an IP address and % wildcard — all expected MySQL remote host values are allowed.
• Allocations cannot be deleted from a server by a user if the server is configured with an allocation_limit set to 0.
• The Java Version modal no longer shows a dropdown and update option to users that do not have permission to make those changes.
• The Java Version modal now correctly returns only the images available to the server's selected Egg.
• Fixes leading and trailing spaces being removed from variable values on file manager endpoints, causing errors when trying to perform actions against certain files and folders.

Changed

• Forces HTTPS on URLs when the APP_URL value is set and includes https:// within the URL. This addresses proxy misconfiguration issues that would cause URLs to be generated incorrectly.
• Lowers the default timeout values for requests to Wings instances from 10 seconds to 5 seconds.
• Additional permissions (CREATE TEMPORARY TABLES, CREATE VIEW, SHOW VIEW, EVENT, and TRIGGER) are granted to users when creating new databases for servers.
• development: removed Laravel Debugbar in favor of Clockwork for debugging.
• The 2FA input field when logging in is now correctly identified as one-time-password to help browser autofill capabilities.
• Changed API authentication mechanisms to make use of Laravel Sanctum to significantly clean up our internal handling of sessions.
• API keys generated by the system now set a prefix to identify them as Pterodactyl API keys, and if they are client or application keys. This prefix looks like ptlc_ for client keys, and ptla_ for application keys. Existing API keys are unaffected by this change.

Added

• Added support for PHP 8.1 in addition to PHP 8.0 and 7.4.
• Adds more support for catching potential PID exhaustion errors in different games.
• It is now possible to create a new node on the Panel using an artisan command.
• A new cron cheatsheet has been added which appears when creating a schedule.
• Adds support for filtering the /api/application/nodes/:id/allocations endpoint using ?filter[server_id]=0 to only return allocations that are not currently assigned to a server on that node.
• Adds support for naming docker image values in an Egg to improve front-end display capabilities.
• Adds command to return the configuration for a specific node in both YAML and JSON format (php artisan p:node:configuration).
• Adds command to return a list of all nodes available on the Panel in both table and JSON format (php artisan p:node:list).
• Adds server network (inbound/outbound) usage graphs to the console screen.
• Adds support for configuring CORS on the API by setting the APP_CORS_ALLOWED_ORIGINS=example.com,dashboard.example.com environment variable. By default all instances are configured with this set to * which allows any origin.
• Adds proper activity logging for the following areas of the Panel: authentication, user account modifications, server modification. This is an initial test implementation before further roll-out in the software. Events are logged into the database but are not currently exposed in the UI — they will be displayed in a future update.

Removed

• Removes Google Analytics from the front end code.
• Removes multiple middleware that were previously used for configuring API access and controlling model fetching. This has all been replaced with Laravel Sanctum and standard Laravel API tooling. This should make codebase discovery significantly more simple.

Deprecated

• The use of Pterodactyl\Models\AuditLog is deprecated and all references to this model have been removed from the codebase. In the next major release this model and table will be fully dropped.

SHA256 Checksum

14481c084fdf53fde0c697ffb678029d4e77f34801f71cd9ca6c9e48b249a20f  panel.tar.gz