feat: update

- Added configurable default avatar provider in admin settings, supporting multiple options including Gravatar and custom URLs.
- Introduced admin SSO token settings to configure default token lifetime and expiration parameters.
- Enhanced admin list pages to remember search, filters, sort, and pagination using localStorage.
- Implemented configurable default Docker image for spells, ensuring correct runtime on server installs.
- Updated server startup image selection to lock to spell-configured images by default, with an option for custom input.
- Improved admin user edit page with a Potential Alts tab to identify accounts sharing IP addresses.
- Added functionality to block new registrations based on device/browser limits and allow admins to clear device fingerprints.
- Enhanced CHANGELOG to reflect these updates.

Author: NaysKutzu

.github/README.md

@@ -47,19 +47,19 @@ For installation instructions, system requirements, and complete guides, please
 
 <!-- COUNT-STATS:START -->
 
-_Last updated: 2026-06-07T11:19:53.648Z_
+_Last updated: 2026-06-07T20:45:33.009Z_
 
 | Extension | Files | Lines |
 | --- | ---: | ---: |
-| `.php` | 519 | 132,432 |
-| `.tsx` | 368 | 118,265 |
-| `.ts` | 78 | 9,438 |
+| `.php` | 525 | 133,954 |
+| `.tsx` | 374 | 119,816 |
+| `.ts` | 81 | 9,861 |
 | `.yaml` | 3 | 5,908 |
 | `.rs` | 16 | 3,395 |
-| `.sql` | 140 | 2,403 |
+| `.sql` | 142 | 2,454 |
 | `.yml` | 18 | 1,877 |
-| `.css` | 7 | 445 |
-| **Total** | 1,149 | 274,163 |
+| `.css` | 7 | 459 |
+| **Total** | 1,166 | 277,724 |
 
 <!-- COUNT-STATS:END -->
 

CHANGELOG.md

@@ -4,6 +4,12 @@
 
 ### Added
 
+- Configurable default avatar provider in admin settings (Gravatar by default, with panel logo, UI Avatars, RoboHash, DiceBear, and custom URL template support). by @nayskutzu
+- Admin SSO token settings: configure the default token lifetime in App settings, and optionally pass `expires_in` (minutes, 1–1440) when calling `POST /api/admin/users/{uuid}/sso-token`. by @nayskutzu
+- Admin list pages (users, servers, VDS nodes, nodes, VM instances, spells, roles, tickets, and others) now remember search, filters, sort, and pagination in localStorage. by @nayskutzu
+- Spells now support a configurable default Docker image (star icon on the spell Docker tab) so new servers use the correct runtime on first install when game images are updated. by @nayskutzu
+- Server startup Docker image selection is locked to spell-configured images by default; admins can enable custom Docker image input under Settings → Servers (`server_allow_custom_docker_image`, default off). by @nayskutzu
+- Admin server edit now configures Docker image on the Startup tab; create validates the selected image on submit so spell defaults (e.g. Java 25) persist correctly. by @nayskutzu
 - Admin settings to configure the login page default sign-in method, display order of authentication options, and hidden methods (local, LDAP, passkey, email code, Discord, OIDC). by @nayskutzu
 - Admins now get clearer notifications (including email notifications) when there are open support tickets; the ticket section can show all open tickets if the user is an admin. by @nayskutzu
 - Users now receive an email notification when their support ticket is replied to, closed, or reopened. by @nayskutzu
@@ -17,11 +23,20 @@
 - Styles for the auth LDAP button were improved. by @nayskutzu
 - Improved the amazing new role editor page that allows you to edit roles and permissions and thats idiot proof (I HOPE). by @nayskutzu
 - Timezones were missmatched into the server backups page. by @nayskutzu
+- Now you can sort users by newest and oldest and by username. by @nayskutzu
+- Now you can click on the owner's name in the server details page to view the user's profile. by @nayskutzu
+- Admin user edit page now includes a Potential Alts tab that finds other accounts sharing IP addresses with the viewed user. by @nayskutzu
+- Potential alt detection now also compares server activity IPs and hidden browser sync identifiers (localStorage + cookie) collected across the panel. by @nayskutzu
+- Registration can block new accounts when a browser/device already has the maximum allowed panel accounts, pointing users to their main account or support. by @nayskutzu
+- Admins can clear device fingerprint records per user or globally from the Users admin area. by @nayskutzu
 
 ### Fixed
 
+- User server startup page now shows admin-assigned Docker images (e.g. Java 25) even when they are not in the spell image list, matching admin server edit behavior. by @nayskutzu
+- Admin spell export now downloads the PTDL_v2-compatible export file instead of the raw database record, and legacy raw exports can still be imported. by @nayskutzu
 - Admin Updates page plugin bulk updates now call the correct online install API (`/api/admin/plugins/online/install`) instead of a non-existent route. by @nayskutzu
 - Issues related to Discord OAuth2 account linking and registration were fixed. by @nayskutzu
+- Small issues regarding spells export behavior were fixed. by @nayskutzu
 
 ## v1.3.7.3 STABLE
 

backend/app/Chat/Activity.php

@@ -102,6 +102,21 @@ public static function getActivitiesByContextLikeAndNameIn(string $contextLike,
         return $stmt->fetchAll(\PDO::FETCH_ASSOC);
     }
 
+    /**
+     * @return string[]
+     */
+    public static function getDistinctIpsByUserUuid(string $userUuid): array
+    {
+        $pdo = Database::getPdoConnection();
+        $stmt = $pdo->prepare(
+            'SELECT DISTINCT ip_address FROM ' . self::$table
+            . ' WHERE user_uuid = :user_uuid AND ip_address IS NOT NULL AND ip_address != \'\' ORDER BY ip_address'
+        );
+        $stmt->execute(['user_uuid' => $userUuid]);
+
+        return array_column($stmt->fetchAll(\PDO::FETCH_ASSOC), 'ip_address');
+    }
+
     public static function getCountByUserUuid(string $userUuid, ?string $search = null): int
     {
         $pdo = Database::getPdoConnection();

backend/app/Chat/ServerActivity.php

@@ -203,6 +203,25 @@ public static function getActivitiesByEvent(string $event, int $limit = 100): ar
         return $stmt->fetchAll(\PDO::FETCH_ASSOC);
     }
 
+    /**
+     * @return string[]
+     */
+    public static function getDistinctIpsByUserId(int $userId): array
+    {
+        if ($userId <= 0) {
+            return [];
+        }
+
+        $pdo = Database::getPdoConnection();
+        $stmt = $pdo->prepare(
+            'SELECT DISTINCT ip FROM ' . self::$table
+            . ' WHERE user_id = :user_id AND ip IS NOT NULL AND ip != \'\' ORDER BY ip'
+        );
+        $stmt->execute(['user_id' => $userId]);
+
+        return array_column($stmt->fetchAll(\PDO::FETCH_ASSOC), 'ip');
+    }
+
     /**
      * Get activities by user ID.
      *

backend/app/Chat/Spell.php

@@ -599,6 +599,73 @@ public static function count(array $conditions): int
         return (int) $stmt->fetchColumn();
     }
 
+    /**
+     * Parse docker_images JSON into a list of image tags.
+     *
+     * @return list<string>
+     */
+    public static function parseDockerImages(?string $dockerImagesJson): array
+    {
+        if ($dockerImagesJson === null || trim($dockerImagesJson) === '') {
+            return [];
+        }
+
+        try {
+            $dockerImages = json_decode($dockerImagesJson, true);
+            if (!is_array($dockerImages) || $dockerImages === []) {
+                return [];
+            }
+
+            return array_values(array_filter(
+                $dockerImages,
+                static fn ($value) => is_string($value) && trim($value) !== ''
+            ));
+        } catch (\Exception $e) {
+            return [];
+        }
+    }
+
+    /**
+     * Resolve the default Docker image for a spell.
+     * Uses default_docker_image when set and valid, otherwise the first docker_images entry.
+     */
+    public static function resolveDefaultDockerImage(array $spell): ?string
+    {
+        $dockerImages = self::parseDockerImages($spell['docker_images'] ?? null);
+
+        if (!empty($spell['default_docker_image']) && is_string($spell['default_docker_image'])) {
+            $default = trim($spell['default_docker_image']);
+            if ($default !== '' && ($dockerImages === [] || in_array($default, $dockerImages, true))) {
+                return $default;
+            }
+        }
+
+        return $dockerImages[0] ?? null;
+    }
+
+    /**
+     * Ensure default_docker_image references a value from docker_images when possible.
+     */
+    public static function sanitizeDefaultDockerImage(?string $defaultDockerImage, ?string $dockerImagesJson): ?string
+    {
+        $images = self::parseDockerImages($dockerImagesJson);
+        if ($images === []) {
+            return null;
+        }
+
+        if ($defaultDockerImage === null || trim($defaultDockerImage) === '') {
+            return $images[0];
+        }
+
+        $defaultDockerImage = trim($defaultDockerImage);
+
+        if (!in_array($defaultDockerImage, $images, true)) {
+            return $images[0];
+        }
+
+        return $defaultDockerImage;
+    }
+
     /**
      * Sanitize data for logging by excluding sensitive fields.
      */