SourceBans++

The biggest release in the project's history. Every page in the panel has been rebuilt: a modern look with light, dark and system themes, real mobile support, a player drawer, a command palette, and a long list of fixes and security work underneath.

[!CAUTION]
Read before you upgrade:

• PHP 8.5 or newer is required. A panel on PHP 8.4 or earlier won't boot.
• Your active theme will reset to default. Custom themes need porting against the new templates before you re-enable them.
• Always back up your database first.

Full walkthrough:
Upgrading from 1.8.x to 2.0.x.

What's new

A redesigned panel

The whole chrome was rebuilt. Cleaner layout, modern controls, proper typography, and a real dark mode that follows your operating system if you want it to.

Player drawer

Click any player in the ban list (or the comms list) and a side drawer slides in with their full picture: SteamID / Steam3 / Community ID with one-click copy buttons, ban state, history, admin comments, and admin-only notes, all without leaving the page.

Command palette (Ctrl/Cmd+K)

Press Ctrl+K (or ⌘K on Mac) anywhere in the panel to search players, jump between admin pages, or copy a SteamID without clicking around. The Navigate list only shows what you can actually reach, so no admin entries leak to logged-out users.

Mobile support

The panel works on phones now. The sidebar collapses behind a hamburger, desktop tables turn into stacked cards, the drawer covers the full screen, and every control is sized for touch.

A new admin landing page

Admin Panel is now a card grid of every admin task you can reach, each with a description and icon, so there's no more guessing what a tab does.

Audit log

A new Admin → Admin Panel → Audit log page surfaces every administrative action recorded by the panel, with search and severity filters (Info / Warning / Error).

Ban list polish

• Status filter chips: All / Permanent / Active / Expired / Unbanned
• A Re-apply button to quickly re-ban an expired or lifted ban
• Required reason on unban, behind a confirm dialog so a stray
  click doesn't trash an audit trail
• IP column visible to admins
• Admin-authored comments inline on the row
• Hover tooltips on truncated reason / length text so nothing's lost

Comms list (mutes / gags)

Same drawer-and-filter polish as the ban list, plus row-action parity (Edit / Unmute / Re-apply / Remove) on both desktop and mobile.

Forms rebuilt

Login, lost-password, submit-ban, protest, and every admin-side form (Servers / Mods / Groups / Comms / Settings / Admins / Bans) has been rebuilt with proper inline validation, loading spinners, clear server-side error feedback, and full keyboard / screen-reader support.

Markdown for the dashboard intro

The dashboard intro text now uses safe Markdown, with a live preview pane in Settings. The old WYSIWYG editor that kept introducing stored-XSS bugs is gone.

Security fixes & hardening

A long list of issues closed, plus defense-in-depth added across the
panel:

• Stored XSS in the dashboard intro text (#1113), fixed by
  replacing the WYSIWYG editor with safe Markdown rendering.
• CSRF protection added to every state-changing form and JSON
  call (#1089).
• Smarty escape-by-default turned on globally (#1087).
• utf8mb4 end-to-end so emoji and full Unicode in player
  names round-trip correctly (#1108).
• URL-encoded user-controlled values in generated links (#1085).
• SteamID validation tightened across every add / edit form so
  a typo lands on a friendly error instead of a 500 page (#1420,
  #1423).
• Mail injection tightened by switching to Symfony Mailer.
• Brute-force protection on login (carried in from 1.8.1).
• Search now matches both STEAM_0: and STEAM_1: stored
  authid variants so old / mixed-format records aren't invisible
  (#1130).

Behind the scenes

For anyone curious about the internals:

• PHP 8.5 minimum (was 8.2).
• Smarty 5, league/commonmark for safe Markdown,
  lcobucci/jwt for sessions, Symfony Mailer for SMTP.
• PDO replaces ADOdb entirely; xajax was removed in
  favour of a clean JSON API.
• The ~1,700-line legacy MooTools file (sourcebans.js) is gone;
  everything is small vanilla JS now.
• A local Docker dev stack ships in the repo (./sbpp.sh up)
  for theme forks and contributors.
• Static analysis (PHPStan level 5), PHPUnit, snapshot-tested
  JSON API responses, and end-to-end Playwright tests cover
  the chrome.
• A production Docker image
  (ghcr.io/sbpp/sourcebans-pp:2.0.0) is now signed and
  published. See
  Quickstart (Docker)
  if you'd rather run the panel as a container.

Plugin

• New SBPP_OnClientPostAdminCheck forward (#1431) for plugin
  authors who need to run code after admin checks complete.
• Connection-loss recovery in sbpp_sleuth and sbpp_checker
  so a database hiccup no longer leaves the plugin permanently
  disconnected.
• Various security fixes, with a plugin version bump (#1398).

[!NOTE]
Crossing from a pre-1.6 install that still has separate
sourcebans.smx / sourcecomms.smx / sbchecker.smx /
sb_admcfg.smx / SourceSleuth.smx files? Delete them
after uploading the new plugin pack. The new
sbpp_main.smx / sbpp_comms.smx / sbpp_checker.smx /
sbpp_admcfg.smx / sbpp_sleuth.smx set replaces them.

How to upgrade

[!IMPORTANT]
Always back up your database first. A mysqldump or your
hosting panel's "Backup database" button takes 30 seconds and
is much easier to recover from than a half-completed migration.

Step-by-step walkthrough:
Upgrading from 1.8.x to 2.0.x

The short version:

1. Upgrade PHP to 8.5 on your host first.
2. Switch your panel theme to "default" before uploading
   (Admin Panel → Settings → Themes).
3. Back up the database.
4. Download sourcebans-pp-2.0.0.webpanel-only.zip, unzip
   it, and overwrite the contents of your existing web/
   directory.
5. Visit /updater/ in your browser and let the wizard run
   every pending schema migration.
6. Delete the updater/ directory when it prints
   "Installation up-to-date."
7. Upload the new plugin pack
   (sourcebans-pp-2.0.0.plugin-only.tar.gz) to your game
   servers and restart them.

If you maintain a custom theme, don't re-enable it until you've ported it against the new template signatures. See the [theme reset(https://sbpp.github.io/updating/1-8-to-2-0/#theme-reset) section of the upgrade guide.

If you already ran composer install from a git pull of the main branch, you'll need to re-run it after upgrading. See PHP version + new dependencies. Tarball downloads ship vendor/ pre-built, so that's the easy path.

Two small things ship on by default and can be turned off. Anonymous telemetry sends one daily JSON ping of categorical counts only (opt out under Settings → Features → Privacy; details). A daily project-announcements fetch feeds the dashboard banner (define('SB_ANNOUNCEMENTS_URL', '') in config.php to disable details).

Download

• Web panel: sourcebans-pp-2.0.0.webpanel-only.zip
• Plugin: sourcebans-pp-2.0.0.plugin-only.tar.gz
• Production Docker image: ghcr.io/sbpp/sourcebans-pp:2.0.0

Find them under Assets below, or on the Releases page.

[!TIP]
RookHelm

RookHelm is a hosted option for operators who would rather not run their own
panel. It handles bans, Discord integration, and a public ban portal across a
whole fleet of servers from one dashboard, with no server to maintain and no
PHP to patch.

You can import your existing SourceBans++ data, including bans, admins, mutes,
and the admin audit log, with no cap on how many bans you bring over. Your
current instance keeps running until you decide to switch.

RookHelm is in private alpha and free for now. Learn more and request access
at rookhelm.com.

Get help / get involved

• Docs: https://sbpp.github.io/
• Issues: https://github.com/sbpp/sourcebans-pp/issues

Thanks to everyone who tested release candidates, filed bugs, ported themes, and waited patiently while v2.0 baked.