When we adopted AGPL 3.0 back in the 1.0 release, we did not fully think through its implications. In practice, AGPL 3.0 turned out to be far more restrictive than we intended - addon and theme developers couldn't legally sell their work, and users couldn't customize the panel for their own needs without publishing their changes. That was never the goal, and it was quietly killing the community we were trying to build.
MPL 2.0 fixes this. It keeps the project open and protected, while giving everyone the freedom they actually need.
As part of this transition, we are also introducing a Contributor License Agreement (CLA) for all future pull requests. Contributors will be asked to sign it when opening a PR. This is part of a broader effort to give CtrlPanel a proper legal foundation - something we should have had from the start.
Before reading further, we recommend taking a quick look at the Mozilla Public License 2.0 itself - it is short, readable, and will make everything in this post much easier to follow and understand.
If you just run CtrlPanel to sell game servers to your customers, not much changes for you.
In short - run it, customize it, build a business on it. You're good.
This is where the biggest change is, and where MPL 2.0 makes things much more practical.
This is the cleanest scenario. If your addon is a separate package or file that does not touch CtrlPanel's existing source files:
This is why we are actively thinking about a more modular extension system - so that addons never need to touch core files in the first place. More on that in the future.
If your work involves editing CtrlPanel's existing source files, MPL 2.0 still allows you to sell it - but with one important condition: the modified core files must remain under MPL 2.0, and you must provide them to anyone you distribute to - which, again, is nothing extra since PHP is already source code.
This does not mean a public release. You are only required to provide source code to the people you directly sell or distribute to - not to the general public. You are not required to publish anything on GitHub or anywhere publicly accessible.
However, keep in mind that once a recipient has that source code, they are legally allowed to share it further. MPL does not restrict what recipients can do with source code they legitimately received. If keeping your modifications private long-term is important to you, the safest approach is to avoid modifying core files and build your addon as a separate package instead.
The safest way to keep your addon code fully closed is to never touch core files at all - and we want to make that possible for every type of addon.
Currently, CtrlPanel has a modular system for payment gateways, and we are ready to expand it further. If you need an internal API or hook that does not exist yet, there are two ways to help make it happen:
Either way, make sure to follow our contribution guidelines before getting started - see the relevant files in the .github directory of the repository.
The more developers build addons the right way, the stronger and more sustainable the ecosystem becomes for everyone.
We ask that you preserve the original CtrlPanel copyright notice in the panel footer. You are welcome to add your own copyright alongside it - just don't remove ours. This is both a license requirement and a matter of respect for the project and its contributors.
MPL 2.0 allows anyone to take CtrlPanel's code, modify it, and redistribute it - including commercially. If you do, here is what the license requires:
Building on open source is fine. Stripping it of its open source nature is not.
| AGPL 3.0 | MPL 2.0 | |
|---|---|---|
| Run the panel commercially | Yes | Yes |
| Customize without publishing changes | No | Yes* |
| Sell closed-source addons (separate files) | No | Yes |
| Sell addons that modify core files | No | Yes** |
| Fork and redistribute | Yes | Yes |
*As long as you don't distribute the code to others.
**Modified core files must remain MPL 2.0 and source must be provided to recipients.
If you have questions about what this means for your specific use case, feel free to join our Discord, we are happy to help. And if you want the full legal text, you can read the Mozilla Public License 2.0 directly.
]]>We want to be transparent with our community: version 1.1 was released prematurely, and we are not proud of that. It shipped with too many rough edges and took far longer to stabilize than it should have. We heard your frustration, and we took it seriously.
With 1.2.0, we made a commitment to not repeat that mistake. This release went through a full beta testing phase before reaching stable, and we are confident it reflects the quality our users deserve.
This update brings a large number of bug fixes, new features, and importantly, patches for several critical security vulnerabilities. We strongly urge every CtrlPanel user to upgrade as soon as possible. Do not wait for themes or addons to be updated first - running an outdated version puts both you and your clients at risk.
Starting with this release, CtrlPanel moves from AGPL 3.0 to the Mozilla Public License 2.0 (MPL 2.0).
We'll be honest - we didn't fully think through the implications of AGPL 3.0 when we adopted it. As we looked closer, we realized it was placing an unreasonable burden on our community - particularly on users running the panel and developers building third-party addons. The license was doing more harm than good, and that was never our intention.
MPL 2.0 is a more balanced license that still protects the project while giving the community the freedom it needs to grow.
As for previous versions - we are not officially relicensing them, but we have no intention of taking any action against AGPL 3.0 non-compliance in older releases. That said, compliance with MPL 2.0 is required for this version and all future releases - no exceptions.
A dedicated blog post covering all the details including what this means for addon and theme developers will be published tomorrow, April 25th.
This release would not have been possible without the help of our contributors and beta testers.
A special thank you to Simba and FerksFK for their contributions to the codebase, and to Maddigan for his invaluable work during beta testing - single-handedly tracking down the vast majority of bugs in this release.
We also want to thank everyone who responsibly disclosed security vulnerabilities that are patched in this release. Your names will be added to the Hall of Fame in our SECURITY.md once the CVE details are publicly disclosed.
Thank you to everyone else who contributed, reported issues, or helped test along the way. You are what keeps this project alive ❤️.
.git directory is missingphp artisan route:cache failing due to duplicate route names0 as a value for unlimited resources?reset to the URL, without needing DevTools or clearing site dataphp artisan make:user) now returns an error if the email or Pterodactyl ID is already in useVulnerability details will be disclosed two weeks after the release date
This release also includes a number of internal bug fixes, performance improvements, and code refactors not listed above.
Full Changelog: https://github.com/Ctrlpanel-gg/panel/compare/1.1.1...1.2.0