Contao news

Read the official Contao announcements.

Contao 2.10.RC1 is available

by – Announcements

Contao version 2.10.RC1 is available. The release candidate includes all new features that have been pre­sen­ted at the Contao conference such as HTML5 and CSS3 support, global style sheet variables, compressed CSS and JS files and much more. In addition, several bugs have been fixed and all plugins have been updated.

The request token system

In version 2.10, the error-prone referer check has been replaced with a request token system. From now on, forms will only be processed if they send a valid token. These are the necessary steps to use this functionality in your own extension:

  1. Search your files for the string FORM_SUBMIT to find all Contao forms.
  2. Insert the following line after the FORM_SUBMIT input field:
<input type="hidden" name="REQUEST_TOKEN" value="{{request_token}}">

The two lines should then look like this:

<input type="hidden" name="FORM_SUBMIT" value=" … ">
<input type="hidden" name="REQUEST_TOKEN" value="{{request_token}}">

In the back end, the line looks slightly different:

<input type="hidden" name="REQUEST_TOKEN" value="<?php echo REQUEST_TOKEN; ?>">

Request tokens and Ajax

Request tokens are also required for all Ajax requests that send POST data. Every Ajax response thereby returns a new request token. To process this data, you have to slightly modify your Ajax requests:

  1. Use the Request.Contao class instead of the MooTools default class.
  2. Send the JavaScript variable REQUEST_TOKEN in your request.


new Request({
    onSuccess: function(txt) {
        $(element).set('html', txt);
}).post({'action':' … '});


new Request.Contao({
    onSuccess: function(txt, json) {
        $(element).set('html', txt);
}).post({'action':' … ', 'REQUEST_TOKEN':REQUEST_TOKEN});

The Request.Contao class automatically takes care of updating the request token. The original JSON object is optionally available as second argument (or third argument in the Request.Mixed class).

New template file extensions

Instead of the previous .tpl file extension, templates in Contao 2.10 either use .html5 for HTML5 templates or .xhtml for XHTML templates. For reasons of backwards compatibility, .tpl files will still be supported in version 2.10, however they are marked as deprecated.

The back end completely switched to HTML5, so you only have to rename the back end templates of your own modules (file extension .html5 instead of .tpl). In the front end, you should duplicate each template and pro­vide both an .html5 and an .xhtml version. In all cases, please adjust the markup if necessary.

TinyMCE in sub-palettes

In the new version it is possible to add TinyMCE input fields to sub-palettes, which will automatically be loaded via Ajax upon certain events. So far, the input fields were loaded correctly but the rich text editor only appeared after a complete page refresh.

Changes to the fe_page template

As part of the update, the default page template fe_page has been modified. The changes mainly include adding the IE6 warning as well as the modified cronjob trigger. If you are using a custom "fe_" page template, you should change it accordingly.

Custom runonce.php files

Onwards it shall be possible to provide a custom runonce.php file in the config folder of an extension, which will automatically be executed and then deleted upon its installation. However, the feature is not yet available in this form in version RC1. The current implementation has turned out to be impractical and will therefore be replaced in the next days.

Find out what has been done

Get an overview of all changes in the ticket system or the changelog.

Download the release from

Back to the news overview.


Add a comment

Please calculate 2 plus 7.