Pterodactyl Daemon Versions Save

Fixed

• [Security] Fixes a bug in the websocket authorization process that could allow a malcious authenticated user to connect and send commands to a server they do not have permission to access.
• Fixes utilization metrics to send the correct CPU and memory usage calculations for servers. This now matches the logic used by docker stats.
• Files with a colon in their name can be properly decompressed.

Added

• Installation docker images can now be prefixed with ~ to use a local image.

Changed

• General dependency upgrades to reduce the number of audit warnings on installation.

SHA256 Checksum

836ad8946a270df012c00d2ad504fff6705dc536696c52f6cf72002f22c692b0  daemon.tar.gz

Fixed

• Fixes a bug with the packs system that would not properly handle an error response from the panel resulting in the server getting stuck in a hung installation state.
• Fixes a bug with how packs were downloaded and decompressed that resulted in them properly downloading but an error cropping up when decompressing their contents.

Changed

• Install logs are no longer deleted when a server fails it's installation and is removed.

Added

• Dockerfile for building an official docker image for the daemon. (uses the golang sftp-server)

SHA256 Chcecksum

aef507f4b9f1272b678cf8b23c0cf0db58d1bba4e8a02d6744018f63db4ff66a  daemon.tar.gz

Fixed

• [Security] Addresses one remaining issue with the previous security fixes to completely isolate the host system from malicious users.

SHA256 Checksum

13fbc2f45bf02576bd95f6f114739efa931f8efeab82b7b40b7721fedda891ae  daemon.tar.gz

Fixed

• Fixes a path resolution bug introduced in the previous version of the panel that was causing files and folders that did not exist to return the wrong resolved path.

SHA256 Checksum

16e2cc22491a136ea9f77d35c921f2ea7ec24b1535475f06270591568af164a7  daemon.tar.gz

Fixed

• [Security] Fixes an unauthorized file read outside of server directory vulnerability when working with the built-in filemanager or SFTP server.

Fixed

• Updated diagnostics script to have a proper fallback domain to handle Hastebin outages.
• [Security] Fixes an unauthorized file read outside of server directory vulnerability when working with the built-in filemanager or SFTP server.

Changed

• Bumped internal thresholds for memory management in containers to provide slightly more overhead to avoid OOM issues.
• Added support for disabling the built-in SFTP server to allow for standalone options.

Fixed

• Fix a bug that would cause a server to silently get stuck while in preflight if a config file couldn't be parsed. Now the process will continue forward and just emit a notice into the console.

SHA256 Checksum

14bb6c16e173d06806b31b77a1236aaa93419191f88aa8a79fee3e3d17fd125f  daemon.tar.gz

Fixed

• Fixes an issue with the mmmagic dependency not installing correctly when using Nodejs v10.
• Close the server logs correctly when a server is deleted.
• Fixes a bug causing servers to hang in the 'Starting server container' state if there was an error with the container.
• Fix a bug in the SFTP system that would cause a request failure if a file didn't return a valid time created/modified.
• Handle an unknown flag sent from Cyberduck when creating a file.

Changed

• A non-zero response code from an installer script will now mark a server as having failed installation.
• Less confusing error output when the SFTP subsystem encounters an issue. Will now properly log the error rather than cause a second error that covers up the initial error.

Added

• Adds initial beta support for defining custom CA stores that the daemon will use when making HTTPS requests. These can be set by defining an array of file locations using internals.ca_stores in the Daemon configuration.

SHA256 Checksum

b454c5f482887fc8121c9c7bcab8a1a7e8df5044a3f5d3565dcf1a977e276bad  daemon.tar.gz

Changed

• A server that stops cleanly (ExitCode: 0) will still trigger crash detection by default. In a previous release we changed this behavior, and while a logical change, it has caused issues with a larger chunk of users than anticipated. This setting is now configurable at a global level with internals.clean_exit_is_crash setting which defaults to true.