SourceBans++ 2.0.0

The biggest release in the project's history. Every page in the panel has been rebuilt: a modern look with light, dark and system themes, real mobile support, a player drawer, a command palette, an audit log, and a long list of fixes and security work underneath.

Caution

Read before you upgrade:

PHP 8.5 or newer is required. A panel on PHP 8.4 or earlier won't boot.
Your active theme will reset to default. Custom themes need porting against the new templates before you re-enable them.
Always back up your database first.

Full walkthrough: Upgrading from 1.8.x to 2.0.x.

What's new

A redesigned panel

The whole chrome was rebuilt. Cleaner layout, modern controls, proper typography, and a real dark mode that follows your operating system if you want it to.

Player drawer

Click any player in the ban list (or the comms list) and a side drawer slides in with their full picture: SteamID / Steam3 / Community ID with one-click copy buttons, ban state, history, admin comments, and admin-only notes, all without leaving the page.

Command palette (Ctrl/Cmd+K)

Press Ctrl+K (or ⌘K on Mac) anywhere in the panel to search players, jump between admin pages, or copy a SteamID without clicking around. The Navigate list only shows what you can actually reach, so no admin entries leak to logged-out users.

Mobile support

The panel works on phones now. The sidebar collapses behind a hamburger, desktop tables turn into stacked cards, the drawer covers the full screen, and every control is sized for touch.

A new admin landing page

Admin Panel is now a card grid of every admin task you can reach, each with a description and icon, so there's no more guessing what a tab does.

Audit log

A new Admin → Admin Panel → Audit log page surfaces every administrative action recorded by the panel, with search and severity filters (Info / Warning / Error).

Ban list polish

Status filter chips: All / Permanent / Active / Expired / Unbanned
A Re-apply button to quickly re-ban an expired or lifted ban
Required reason on unban, behind a confirm dialog so a stray click doesn't trash an audit trail
IP column visible to admins
Admin-authored comments inline on the row
Hover tooltips on truncated reason / length text so nothing's lost

Comms list (mutes / gags)

Same drawer-and-filter polish as the ban list, plus row-action parity (Edit / Unmute / Re-apply / Remove) on both desktop and mobile.

Forms rebuilt

Login, lost-password, submit-ban, protest, and every admin-side form (Servers / Mods / Groups / Comms / Settings / Admins / Bans) has been rebuilt with proper inline validation, loading spinners, clear server-side error feedback, and full keyboard / screen-reader support.

Markdown for the dashboard intro

The dashboard intro text now uses safe Markdown, with a live preview pane in Settings. The old WYSIWYG editor that kept introducing stored-XSS bugs is gone.

Security fixes & hardening

A long list of issues closed, plus defense-in-depth added across the panel:

Stored XSS in the dashboard intro text (#1113), fixed by replacing the WYSIWYG editor with safe Markdown rendering.
CSRF protection added to every state-changing form and JSON call (#1089).
Smarty escape-by-default turned on globally (#1087).
utf8mb4 end-to-end so emoji and full Unicode in player names round-trip correctly (#1108).
URL-encoded user-controlled values in generated links (#1085).
SteamID validation tightened across every add / edit form so a typo lands on a friendly error instead of a 500 page (#1420, #1423).
Mail injection tightened by switching to Symfony Mailer.
Brute-force protection on login (carried in from 1.8.1).
Search now matches both STEAM_0: and STEAM_1: stored authid variants so old / mixed-format records aren't invisible (#1130).

Behind the scenes

For anyone curious about the internals:

PHP 8.5 minimum (was 8.2).
Smarty 5, league/commonmark for safe Markdown, lcobucci/jwt for sessions, Symfony Mailer for SMTP.
PDO replaces ADOdb entirely; xajax was removed in favour of a clean JSON API.
The ~1,700-line legacy MooTools file (sourcebans.js) is gone; everything is small vanilla JS now.
A local Docker dev stack ships in the repo (./sbpp.sh up) for theme forks and contributors.
Static analysis (PHPStan level 5), PHPUnit, snapshot-tested JSON API responses, and end-to-end Playwright tests cover the chrome.
A production Docker image (ghcr.io/sbpp/sourcebans-pp:2.0.0) is now signed and published. See Quickstart (Docker) if you'd rather run the panel as a container.

Plugin

New SBPP_OnClientPostAdminCheck forward (#1431) for plugin authors who need to run code after admin checks complete.
Connection-loss recovery in sbpp_sleuth and sbpp_checker so a database hiccup no longer leaves the plugin permanently disconnected.
Various security fixes, with a plugin version bump (#1398).

Note

Crossing from a pre-1.6 install that still has separate sourcebans.smx / sourcecomms.smx / sbchecker.smx / sb_admcfg.smx / SourceSleuth.smx files? Delete them after uploading the new plugin pack. The new sbpp_main.smx / sbpp_comms.smx / sbpp_checker.smx / sbpp_admcfg.smx / sbpp_sleuth.smx set replaces them.

How to upgrade

Important

Always back up your database first. A mysqldump or your hosting panel's "Backup database" button takes 30 seconds and is much easier to recover from than a half-completed migration.

Step-by-step walkthrough: Upgrading from 1.8.x to 2.0.x

The short version:

Upgrade PHP to 8.5 on your host first.
Switch your panel theme to "default" before uploading (Admin Panel → Settings → Themes).
Back up the database.
Download sourcebans-pp-2.0.0.webpanel-only.zip, unzip it, and overwrite the contents of your existing web/ directory.
Visit /updater/ in your browser and let the wizard run every pending schema migration.
Delete the updater/ directory when it prints "Installation up-to-date."
Upload the new plugin pack (sourcebans-pp-2.0.0.plugin-only.tar.gz) to your game servers and restart them.

If you maintain a custom theme, don't re-enable it until you've ported it against the new template signatures. See the [theme reset(https://sbpp.github.io/updating/1-8-to-2-0/#theme-reset) section of the upgrade guide.

If you already ran composer install from a git pull of the main branch, you'll need to re-run it after upgrading. See PHP version + new dependencies. Tarball downloads ship vendor/ pre-built, so that's the easy path.

_{Two small things ship on by default and can be turned off. Anonymous telemetry sends one daily JSON ping of categorical counts only (opt out under Settings → Features → Privacy; details). A daily project-announcements fetch feeds the dashboard banner (define('SB_ANNOUNCEMENTS_URL', '') in config.php to disable details).}

Download

Web panel: sourcebans-pp-2.0.0.webpanel-only.zip
Plugin: sourcebans-pp-2.0.0.plugin-only.tar.gz
Production Docker image: ghcr.io/sbpp/sourcebans-pp:2.0.0

Find them under Assets below, or on the Releases page.

Tip

RookHelm

RookHelm is a hosted option for operators who would rather not run their own panel. It handles bans, Discord integration, and a public ban portal across a whole fleet of servers from one dashboard, with no server to maintain and no PHP to patch.

You can import your existing SourceBans++ data, including bans, admins, mutes, and the admin audit log, with no cap on how many bans you bring over. Your current instance keeps running until you decide to switch.

RookHelm is in private alpha and free for now. Learn more and request access at rookhelm.com.

Get help / get involved

Docs: https://sbpp.github.io/
Discord: https://discord.gg/tzqYqmAtF5 (#help-support)
Issues: https://github.com/sbpp/sourcebans-pp/issues
AlliedModders thread: https://forums.alliedmods.net/showthread.php?p=2303384
Sponsor the project: https://sbpp.github.io/sponsor/

Thanks to everyone who tested release candidates, filed bugs, ported themes, and waited patiently while v2.0 baked.

rumblefrog/sbpp-v2-release-notes.md

Select an option

No results found