Skip to main content

CtrlPanel 1.3.0 is now in open beta

· 8 min read
1Day2Die
1Day2Die
Project Manager
MrWeez
MrWeez
Contribution Director & Maintainer

CtrlPanel 1.3.0 is ready for public beta testing, and it is one of our biggest updates yet.

We want to be upfront: 1.2.0 took us nearly ten months to reach a stable release, and that hurt. We over-promised, under-delivered, and then spent months stabilizing what we should have gotten right the first time. 1.3.0 went the other way. Development started right after 1.2.0 shipped in April, and the beta is here roughly six months later - and it is still a larger update in every measurable sense.

More than 300 commits. Over 50 pull requests. Two-factor authentication, a rebuilt payments flow, reversible server cancellations, a redesigned settings page, database snapshots, and a long list of fixes for bugs you told us about. This is also the first release standing on the new modular extension system we promised when we moved to MPL 2.0 - the groundwork for the addon ecosystem we keep talking about.

But this is a beta, so let's be clear about what that means.

danger

Do not run this on a production instance. This build may contain bugs we have not found yet, and rolling back after an update is not possible. If you want to test it, clone your database and set up a second instance on a separate domain. Always back up first.

Getting the Beta​

The beta documentation is live and versioned. Before you use it, make sure the version selector in the top-right of the docs is set to 1.3.0 (Public Beta).

  • Updating from 1.2.x? Follow the beta update guide. It covers the maintenance window, pulling the development branch, updating dependencies, running migrations, and the new permissions:sync step. Updating to the beta is only supported from the latest stable release, so make sure you are on 1.2.x first.
  • Installing fresh? Follow the installation guide for Debian and Ubuntu.
  • Not sure what to test? The beta testing checklist lists the features and fixes most worth your attention.
  • Want the full details? Read the changelog.

What's Changed​

New Features & Improvements​

  • Two-factor authentication. TOTP with QR setup and recovery codes, built as a module so additional methods can be added without touching core files.
  • Reversible server cancellations. Canceled servers now show a Resume button instead of Cancel.
  • Reworked payments. Admins get manual controls on every payment - confirm, recheck, cancel, reopen, and a one-way refund. Credits are granted only on the transition to paid, so a payment can never be granted twice.
  • Per-gateway handling fees. None, percentage, or fixed, with an optional minimum and maximum - shown at checkout, in the order total, in the admin payments table, and on invoices.
  • Smarter checkout. Gateways that do not support your currency or fall below their minimum are disabled with the reason. Totals recalculate live, and coupons now apply before tax.
  • More currencies, matching what the payment gateways actually accept.
  • Redesigned settings page. Grouped and described sections, conditional fields, unit labels, a fixed mobile layout, and masked secrets.
  • Clearer server status badges and a sort control on the server creation page.
  • Ticket priority and category can now be changed by staff, and the admin ticket list sorts by priority.
  • Better admin UX. Delete confirmations on every delete button, single-target mass notifications, and a settings page that enforces its own permission.
  • Optional protection. A minimum Discord account age for linking, and a verified email before referral rewards - both off by default.
  • Privacy Policy / Terms checkbox on registration, shown when configured.
  • Database snapshots with one command - create and restore without mysqldump or any external tool.
  • Log rotation. Daily compression with retention, so single log files no longer grow out of control.
  • Redis is now the default store for cache, sessions, queues, and settings (still configurable).

Bug Fixes​

  • Fixed installations failing on MySQL/MariaDB due to incompatible migrations.
  • Fixed customised default roles being overwritten by updates and reseeds.
  • Fixed a successful Stripe payment being marked as failed when tax was enabled.
  • Fixed invoices not being generated - they now generate reliably and are emailed to the customer as a PDF.
  • Fixed incorrect checkout totals when coupons and partner discounts were involved.
  • Fixed payment emails and payment lists showing a hard-coded "Credits" instead of your configured name.
  • Fixed upgrades and downgrades ignoring per-product server limits, charging before success, and double-charging on retries.
  • Fixed the allocation limit being treated as per-location instead of per-node, which blocked server creation on healthy nodes.
  • Fixed servers with no Pterodactyl ID breaking the server list and settings page - they can now be managed and deleted cleanly.
  • Fixed server sync deleting servers on any error instead of only on a confirmed removal.
  • Fixed server creation failing when a required egg variable defaulted to 0.
  • Fixed the credit run-out estimate on the home page getting stuck at a fixed ceiling.
  • Fixed the Pterodactyl installer dropping a custom port from the panel URL.
  • Fixed a broken extension or seeder being able to take down the whole panel on startup.
  • Added friendly error pages across server, payment, and registration flows, and stopped leaking Pterodactyl details to users and API clients.

Security​

  • Sanitised rich content submitted through TinyMCE forms - legal pages, MOTD, notifications, and more - against script injection. This one is non-critical, since only privileged users could submit such content.
  • Sanitised Pterodactyl and provider errors so internal addresses, credentials, and response bodies never reach users or API clients.
  • The settings page and admin endpoints now enforce their permissions, and secrets are masked in the UI.

For Developers​

  • Reworked extension system. Extensions can now ship their own database seeders, sidebar pages, middleware, routes, migrations, and Artisan or scheduled commands, all following standard Laravel conventions.
  • New permissions:sync and permissions:cleanup commands keep permissions and roles in step across updates.
  • OpenAPI specification generation with Scribe - php artisan scribe:generate.
  • Laravel 12 under the hood.
  • The user API can now filter by linked Discord account.

A Note on AI​

We want to be upfront about something, the same way we were about the license change and about 1.1.

AI tools are part of our development process now, and you deserve to know how we use them - and how we do not.

To be clear: AI is a tool, not a replacement for developers. Every line that lands in CtrlPanel is reviewed, tested, and owned by a human maintainer. We do not merge code simply because a model produced it, and we never will.

What AI does is take the busywork off our plate. A task that takes a model two minutes - a repetitive test, a boilerplate migration, a scaffolded file - can eat twenty minutes of a maintainer's time. Delegating that routine work is what lets us spend the hours where they actually matter: architecture, security, reviewing contributions, and supporting users.

Our quality standards have not moved, and we are not lowering them to ship faster. If anything, they are going up, and the extra time AI frees up goes straight back into review and testing. The extended beta you are reading about is exactly that standard in practice.

We know "AI" is a divisive topic. We are not here to sell it to you, and we are not hiding it either. We will keep telling you when and how it is used, and everything we ship will keep being held to the same bar it always has been.

Help Us Test​

This is an open beta, and it only works if you help. The features most worth your attention are the ones with the most moving parts - payments, server upgrades, and two-factor authentication - but everything is fair game.

If you find something broken, report it in the #🧪┃beta-feedback channel on our Discord server, or open a GitHub issue.

For any major security risk, please create a GitHub vulnerability report and DM 1day2die on Discord. Do not discuss vulnerabilities in public chats, and do not post them on public trackers.

Acknowledgements​

A beta like this is built by more than the core team, and we owe a real thank you to the people who helped get it here.

  • Simba and KroZen for their contributions to the codebase and the server and billing work in this release.
  • Lezetho for the Discord account age requirement.
  • Every beta tester who installs this build, breaks it, and tells us how - that is the work that turns a beta into a stable release. ❤️
  • And everyone who filed issues, joined discussions, or just kept running CtrlPanel while we worked.

Thank you. You are what keeps this project alive.

This beta also includes a number of internal refactors, performance improvements, and smaller fixes not listed above.

Full changelog: https://ctrlpanel.gg/docs/beta/changelog
Compare on GitHub: https://github.com/Ctrlpanel-gg/panel/compare/1.2.0...development
Beta testing checklist: https://ctrlpanel.gg/docs/beta/beta-testing