panel

Fixed

• [Security] Fixes improperly escaped output in user dropdown listing when adding or editing a server that could allow remote XSS. GHSA-5822-pw57-vv37

SHA256 Checksum

a792866375f6c9414bb6968504ed202e82affa148c498a2e0c60a5ad57064c04  panel.tar.gz

Fixed

• [Security] Re-addressed missed endpoint that would not properly limit a user account to 5 API keys.
• [Security] Addresses a Client API vulnerability that would allow a user to list all servers on the system (GHSA-6888-7f3w-92jx)

SHA256 Checksum

55b12acfdb795c6f0dfca174f9cb7f7b4512a0cdbdf4c3d6c2ea799879d8798b  panel.tar.gz

Fixed

• Max connection count for server databases is now properly saved to the database.
• Fixed admins being unable to select permissions for subusers on servers that they are not assigned to.
• Fixed invalid class extension for server transfers.
• Filenames with special characters are now displayed correctly throughout the UI.
• Pressing Ctrl+S/Cmd+S in the file edit screen now correctly saves the file.
• Scheduled tasks for backups are now properly displayed and do not require a payload be provided.

Changed

• Server resource limits are now displayed consistently across the UI.

Fixed

• Fixes assorted validation error and translation key issues.
• Support pipe characters within regex validation rules for egg variables. (see #1960)
• Properly passes the value to skip install scripts on servers being created.
• Subuser welcome email now correctly links into the panel, rather than to an API endpoint.
• Only the relevant node configuration data is displayed in the panel now, allowing wings to change the configuration structure without having to update panel releases as well.
• Fixes bugs that cropped up when changing the FQDN for a node.
• URL fragments are now correctly decoded before being passed along to wings when working with files and directories containing spaces and special characters.

Added

• Backups stored in S3 can now be downloaded and deleted from the system properly.

Changed

• Various helper text throughout the admin area has been updated to be more correct and more easily understood.
• Admin area CSS updated to be more visually appealing and consistent with the rest of the design.

SHA256 Checksum

fa55f47366162be90de792f3b73b39260e5e5787d2eadd471b7b6d3976ded04c  panel.tar.gz

Fixed

• Fixes an error with database migrations causing the final migration to fail.
• Browser progress indicators are no longer incorrectly flashed on the page when a request fails if an indicator was not already being displayed.
• Server console can now correctly be viewed by an administrator while a server is running the installation process.

Added

• Adds support for specifying how many backups a server is allowed to have at once. (Don't worry, we'll be implementing total size limits as well before final release!)
• Adds support for using AWS S3 as a backup location for server files. This implementation is not yet completed, but the base code for generating them now exists.

SHA256 Checksum

4e1b6b526d3a1e27ec383a804b2c917bd9881e7c2617f5c7d7c264be38e8db90  panel.tar.gz

Fixed

• Admin design updated to be easier to read in some locations and update missed templates.
• A UUID is now properly assigned to a node when that node is created.
• Fixes multiple errors on the login checkpoint screens.
• SFTP authorization is now back to working correctly.
• Admins can now view both their own servers, and all servers on the system via a toggle on the dashboard.

Changed

• Multiple internal react templates were updated to be easier to extend and re-use in the future.
• Error messaging updated to be more user friendly and indicate if they should or should not wait for it to resolve.
• Descriptions for locations, nodes, and servers are now all optional fields.

Added

• Local backups can now be generated via the scheduled tasks system.

SHA256 Checksum

025b0d5ffe8a45766d2fc05d120b1c52b401b5e8b4edf11dc9d8e35a9f86ff05  panel.tar.gz

This is the first beta release in our new 1.0 panel series! This represents the biggest step in Pterodactyl's history, providing many high-demand features, a cleaner user interface, and a massively overhauled control layer.

This version is not yet production ready, and should only be used for testing purposes. There is currently no upgrade process from the current stable 0.7 series, but rest assured we will have one before rolling out the final release.

Added

• Comprehensive client API allowing full control of all Pterodactyl servers.
• Initial support for local server backups via the Panel. At this time this functionality is in an early-beta stage. Expect more features such as limiting backup numbers, proper file exclusion, scheduled backups, and S3 integration before final release.
• Initial support for transferring servers between nodes.
• Keyboard shortcut to search your servers, simply press "K" on any page to bring up the search menu.
• Server owners can now reinstall their server using a button on the frontend.
• Administrators can now view a server's installation progress in the server console.
• A server's storage usage is now visible in the sidebar while viewing the console.
• CPU threads can now be assigned to a server's container to provide even more controls over resource usage.

Changed

• Radically re-designed front-end built with React & Typescript.
• A new API endpoint for getting a node's configuration was added. Node automated deployments now generate an API key for the user with a nodes:read permission which is used for the deployment command.
• Statistic graphs for servers now use a fixed scale, rather than constantly re-adjusting their scale as values change.
• Restarting a server will now properly wait for the server to stop before terminating it if unresponsive.
• Server information, including egg details are now fetched by wings on each server boot, rather than one time when the daemon boots. This allows on-the-fly modification of eggs for easier testing and keeping everything in-sync.
• Daemon authentication tokens are now stored encrypted-at-rest in the database.

Fixed

• Fixed the server creation page in the admin area from clearing out all of the values when an error occurred.
• Fixed the file manager to support using the browser back button for navigation.
• Fixed websocket authentication for servers to use a JWT with a short expiration time. This has addressed some security concerns in the previous implementation and provides a much smoother authentication experience.
• Hostnames can now be provided for the database host configuration.
• Suspending a server is now a graceful stop (and termination if more than a minute passes without successful stop).

SHA256 Checksum

10125ab213ec40ac9e86ae6a84fef543623be50ad75297cc9136a1dd276153ca  panel.tar.gz

Fixed

• Limited accounts to 5 API keys at a time.
• Fixes database passwords not being generated with the proper requirements for some MySQL setups.
• Hostnames that are not FQDNs/IP addresses can now be used for connecting to a MySQL host.

SHA256 Checksum

b3e37e5cf34b3fbcec73cab8947300dd55f1ba289a83501c76f198dd4e6c3750  panel.tar.gz

Added

• New remote API endpoint to mark a server as being installed or failed.

Changed

• When viewing a server's database page a proper message will be displayed if the user cannot add any databases.

Fixed

• Changing account password now prompts the user to sign back in to reset some cookies.
• Display of QR code when enabling two-factor authentication is now a proper square, and not stretched weird.
• Error message on login page is now confined to the width of the login box.

SHA 256 Checksum

9db77308d7b7e3748d744414538421992ab6ac659a6a4e24ab9e6a805698428f  panel.tar.gz

Fixed

• Fixed the /api/application/servers endpoint erroring when including subusers or egg
• Fixed bug in migration files causing failures when using MySQL 8.
• Fixed missing redirect return when an error occurs while modifying database information.
• Fixes bug in login attempt tracking.
• Fixes a bug where certain URL encoded files would not be editable in the file manager.

Added

• The application API now includes the egg's name in the egg model's response.
• The /api/application/servers endpoint can now include server's databases and subusers.

SHA256 Checksum

28ab84518285c6f260737e4bb423a2de19a1935693179811ea15b378fd4856ac  panel.tar.gz

🎉 Pterodactyl 0.8 Alpha Release 1 🎉

This is the first release for the long-awaited 0.8 release cycle of Pterodactyl. This build is not production ready, it should only be used for development and testing purposes.

Pterodactyl 0.8 ships with brand new features such as a single page application for the frontend (built on top of React with Typescript), a massively expanded client API, simplified internal codebase, and a brand new control daemon, Wings, powered by Go.

Installation instructions for this version can be found on our documentation site. We are specifically not including upgrade instructions at this time since this is a limited alpha release.

This release requires v1.0.0-alpha.1 of the Wings daemon in order to operate.

Known Limitations

• Creating a new server does not execute an installation process, you will have to manually mark a server as being installed and manually upload files.
• The first time a server data directory is created you may get a permissions error in the console, simply restart the daemon to address this.
• Pulling images from registries that require authentication is not currently possible.
• There has been no work on subusers, they most likely will not work correctly with the React frontend.

Current Functionality

• User Authentication
• Account Management -- reset & change password, change account email, configure two-factor authentication
• Server Listing
• Server Specific Functionality:
  • Realtime Server Console (including command sending)
  • Realtime Server Statistics
  • Server start, stop, and kill controls
  • Integrated File Manager (currently missing upload abilities via web)
  • Integrated database management
  • SFTP connection details, and ability to modify server name.

As you can see, a large chunk of previous functionality is currently missing. This is intentional as we will be rolling out those features in the coming weeks and months, but wanted to get an alpha release rolling to begin getting feedback, and real-world testing.

SHA256 Checksum

6ca7e5aaab3c65acff2eb3dfac596888b2f05d060e79e4b0e4658db466367e5d  panel.tar.gz

Fixed

• Fixes support for PHP 7.3 when running composer install commands due to a dependency that needed updating.
• Automatic allocation field when creating a new node (or updating one) should now properly remeber its old value when showing an error state.
• Mass deleting files now executes properly and doesn't result in a JS console error.
• Scrolling on email settings page now works.
• Database host management will now properly display an error message to the user when there is any type of MySQL related error encountered during creation or update.
• Two-factor tokens generated when a company name has a space in it will now properly be parsed on iOS authenticator devices.
• Fixed 500 error when trying to request subuser's from a server in the application API.
• Creating a node allocation via the API no longer requires an alias field be passed through in the request.
• Bulk power management for servers via the CLI no longer fails when servers span multiple nodes.

Added

• Server listing view now displays the total used disk space for each server.
• Client API endpoint to list all servers now supports an additional ?filter=subuser-of|all|admin|owner parameter to return different groupings of servers. The default value is subuser-of which will include all of the user's servers that they are the owner of, as well as all servers they're a subuser of.
• Added back ability to toggle OOM killer status on a per-server basis.
• Added LOCK TABLES permission for generated database users.

Changed

• Updated Paper egg to not download server.properties each time. parkervcp/eggs#260
• Insurgency egg now uses the proper dedicated server ID.
• Teamspeak egg updated with improved installation process and grabbing latest versions.
• OOM killer disabled by default on all new servers.
• Passwords generated for MySQL now include special characters and are 24 characters in length.

SHA256 Checksum

0beb6e5c5056255fc34eb199127a24d412bd66d3a6622b311b763adb14629c4b  panel.tar.gz

Fixed

• [SECURITY] Fixes an XSS vulnerability when performing certain actions in the file manager. GHSA-3q45-4vhr-c7g7
• [SECURITY] Attempting to login as a user who has 2FA enabled will no longer request the 2FA token before validating that their password is correct. This closes a user existence leak that would expose that an account exists if it had 2FA enabled. GHSA-vcm9-hx3q-qwj8

Changed

• Support for setting a node to listen on ports lower than 1024.
• QR code URLs are now generated without the use of an external library to reduce the dependency tree.
• Regenerated database passwords now respect the same settings that were used when initially created.
• Cleaned up 2FA QR code generation to use a more up-to-date library and API.
• Console charts now properly start at 0 and scale based on server configuration. No more crazy spikes that
  are due to a change of one unit.

SHA256 Checksum

9d1402d121ff578629e6bc1e2067a98d7ad6f6323426e2a41a88efb453db4f1d  panel.tar.gz

Fixed

• Fixes a bug with the location update API endpoint throwing an error due to an unexected response value.
• Fixes bug where node creation API endpoint was not correctly requiring the disk_overallocate key.
• Prevents an exception from being thrown when a database with the same name is created on two different hosts.
• Fixes the redis password not saving correctly when setting up the environment from the command line.
• Fixes a bug with transaction handling in many areas of the application that would cause validation error messages
  and other session data to not be persisted properly when using the database as the session driver.
• Fix a bug introduced at some point in the past that causes internal data integrity exceptions to not bubble up to
  the user correctly, leading to extraneous and confusing exception messages.
• Fixes a bug causing servers to not be marked as having failed installation in some cases.

Changed

• allocation_limit for servers now defaults to a null value, and is not required in PATCH/POST requests when adding
  a server through the API.
• The PATCH endpoint for /api/applications/servers/{server}/build now accepts an array called limits to match
  the response from the server GET endpoint.

Added

• The server listing for a node is now paginated to 25 servers per page to improve performance on large nodes.

SHA256 Checksum

6265e8be53e52e2a790c8edcab3ebac6b6e7c51aa51deb06b7d6567e22ea4277  panel.tar.gz

Fixed

• Fixes an issue with the locations API endpoint referencing an invalid namespace.
• Fixes the store() function on the locations API not working due to an incorrect return typehint.
• Fixes daemon secrets not being able to be reset on a Node.
• Fixes an issue where files were not editable due to missing URL encoding in the file manager.
• Fixed checking of language changes
• Fixed Spigot egg not building versions other than latest.
• Fixed the Forge egg install script.
• Fixes a bug that would ignore the skip_scripts setting when creating or editing a server.

Updated

• Upgraded core to use Laravel 5.7.14.
• Updated Simplified Chinese translation pack.

Added

• Added support for opening and editing Python files through the web editor.
• Adds Russian translation.

SHA256 Checksum

a9cd62d8de0bc44f87bc87d0a4898f298fb74459997b1cb3a96909b7de21867a  panel.tar.gz

Fixed

• Fixes an issue with certain systems not handling an API folder that was named API but referenced as Api in the namespace.
• TS3 egg updated to use CLI arguments correctly and have a more minimalistic installation script.
• Terminal was not properly displaying longer lines leading to some visual inconsistency.
• Assorted translation updates.
• Pagination for server listing now properly respects configuration setting.
• Client API now properly respects permissions that are set and allows subusers to access their assigned servers.

Changed

• Removed PhraseApp integration from Panel code as it is no longer used.
• SFTP login endpoint now returns the permissions for that user rather than requiring additional queries to get that data.

Added

• You can now test your mail settings from the Admin CP without waiting to see if things are working correctly.

SHA 256 Checksum

6a918431608525611f06a91d4bd10917259f19e5328fbc7e14795380d482ef03  panel.tar.gz

Fixed

• Scheduled tasks triggered manually no longer improperly change the next_run_at time and do not run twice in a row anymore.
• Changing the maximum web-based file upload size for a node now properly validates and updates.
• Changing configuration values for a node now correctly updates them on the daemon on the first request, rather than requiring a second request to set them.

Changed

• Egg and server variable values are no longer limited to 191 characters. Turns out some games require a large number of characters in these fields.

Added

• Users can now select their preferred language in their account settings.

SHA256 Checksum

4d1a052e9e0a1fc651388b7d5ca8ec55c380441a1257d6fb0877b70a013df3d8  panel.tar.gz

Fixed

• Fixes a two-factor authentication bypass present in the password reset process for an account.

SHA256 Checksum

acca80528628ad362c5733229203a6c4bb3d648a9c40be318ff9f4f9653d505d  panel.tar.gz

Added

• Nodes can now be put into maintenance mode to deny access to servers temporarily.
• Basic statistics about your panel are now available in the Admin CP.
• Added support for using a MySQL socket location for connections rather than a TCP connection. Set a DB_SOCKET variable in your .env file to use this.

Fixed

• Hitting Ctrl+Z when editing a file on the web now works as expected.
• Logo now links to the correct location on all pages.
• Permissions checking to determine if a user can see the task management page now works correctly.
• Fixed pterodactyl.environment_variables to be used correctly for global environment variables. The wrong config variable name was being using previously.
• Fixes tokens being sent to users when their account is created to actually work. Implements Laravel's internal token creation mechanisms rather than trying to do it custom.
• Updates some eggs to ensure they have the correct data and will continue working down the road. Fixes autoupdating on some source servers and MC related download links.
• Emails should send properly now when a server is marked as installed to let the owner know it is ready for action.
• Cancelling a file manager operation should cancel correctly across all browsers now.

Changed

• Attempting to upload a folder via the web file manager will now display a warning telling the user to use SFTP.
• Changing your account password will now log out all other sessions that currently exist for that user.
• Subusers with no permissions selected can be created.

SHA256 Checksum

29215d7c98fa4fa620742af96ba854eb3848fd4fca1fc8758635385a9bca3d7d  panel.tar.gz

Fixed

• Fixes an issue with the sidebar logo not working correctly in some browsers due to the CSS being assigned.
• Fixes a bunch of typos through the code base.
• Fixes a bug when attempting to load the dropdown menu for server owner in some cases.
• Fixes an exception thrown when the database connection address was not filled out correctly while adding a database to a server.
• Fixes some mistakes in the German translation of the panel.

Added

• Added a new client API endpoint for gathering the utilization stats for servers including disk, cpu, and memory. GET /api/client/servers/<id>/utilization
• Added validation to variable validation rules to validate that the validation rules are valid because we heard you like validating your validation.
• Added German translations for many previously untranslated parts of the panel.

Changed

• Updated core framework from Laravel 5.5 to Laravel 5.6.
• Improved support for Windows based environments.
• Spigot Egg now builds spigot for you rather than requiring a download location be specified.

SHA256 Checksum

fc7eb28cb7944c44606e475ec38d2219186afdb878dbeb55bbe765919b9832ce  panel.tar.gz