by Marcus Lelle
Contao 6.0 heralds the start of a new era – as befits a major release. It’s already been four and a half years since Contao 5.0. If you’d like to take a moment to look back, have a look at Bjarke’s 20-year retrospective (2022).
The core team and many other developers have once again processed just under 150 pull requests.
Contao 6.0 will receive updates until February 2027, when it will be succeeded by Contao 6.1.
You can find out which Contao versions are currently supported in the Contao release plan.
The biggest feature of the new version of Contao is actually something that has been removed: Contao no longer uses input encoding at all.
Up to now, Contao has been storing certain characters that you enter (i.e. during input) in an encoded form in the database.
A few examples:
| Your input | What is saved in the database |
< |
< |
( |
( |
& |
& |
' |
' |
Among other things, this prevents code that doesn’t belong there from accidentally finding its way into your content.
As long as you’re simply entering data into Contao and outputting it via Contao, you may never have noticed this. But if you’ve ever exported data from the database – for example, via phpMyAdmin or using an extension that does this directly from the Contao backend – you’ve no doubt come across this encoded text before. Perhaps it’s even driven you nutr at times, like me.
From now on, the characters you enter will be stored in the database without being converted. A ( remains a (.
This means the content stored there can be used in multiple contexts without having to reverse any encoding that may not have been necessary for a specific purpose. It can be output as HTML, JSON-LD, XML, etc.
It can also be used for (external) searches or in API calls.
To ensure that Contao remains secure, it now uses output encoding – always precisely in the context in which it is required.
Spoiler alert: An important feature for this is covered in the next section of this article.
Important for you: If you write your own code or customise templates, you must ensure that you encode the content provided by the database correctly. The great thing about Twig is that encoding or escaping is always carried out by default. Wherever you may have used raw up to now, you should check in future what data you are expecting. With the filter sanitize_html("contao"), for example, only those HTML tags are permitted that you have authorized in the backend under System Settings.
The easiest way to achieve this is to use Twig. And that’s why, in Contao 6, we now say:
Contao now operates entirely without HTML5 templates and relies solely on Twig.
We have been following this approach for several years now, starting with the content elements. From now on, this will also apply to news, events, navigation, etc.
This also means that the Templates menu item has been removed from the backend.
By the way: to make the switch to Contao 6 easier for you, without having to use the new slot layout, even the old fe_page template is now available as a converted Twig version.
The database-driven file system uses a new file hash (xx128).
Before updating to Contao 6.0, the file system should be synchronised, and a further synchronisation should be carried out after the update. You can do this either in the backend or using the contao:filesync command in the terminal.
From now on, Contao will no longer support the option to have multiple backend themes. The "flexible" theme becomes the default, and the "system/themes" folder is removed. This makes it easier to implement new features without causing any compatibility issues.
Do you want or need to customise the theme? Nothing could be simpler. It has long been very easy to make customisations to the backend.
# config/config.yaml
contao:
backend:
attributes:
app-name: 'MyApp'
app-version: 1.2.3
custom_css:
- files/backend/custom.css
custom_js:
- files/backend/custom.js
badge_title: develop
route_prefix: '/admin'The {{file::*}} insert tag now supports the Virtual File System and can therefore also handle versioning.
Contao now automatically generates temporary URLs for files stored in restricted folders. This means that, in addition to the download elements, you can now also use the video element to display specific data only to certain member groups.
And to top it all off: this also applies to the {{file::*}} insert tag, meaning it’s available to you almost everywhere.
If you add your own CSS classes to form fields, these will now only be added to the enclosing wrapper. Previously, these classes were added in several places within the widget.
You can now set the JSON-LD type for each news archive. Choose between NewsArticle, Article or Blog.
You can now assign an image to each page in the page structure. This is used in the page’s JSON-LD as the so-called primaryImageOfPage.
This image also appears in the Contao search results.
Christian explains how you can also use it as a page image in his Contao 6 video (German only).
You can now insert elements directly into nested elements without first having to move down a level. This applies to the element group, the core Slider and the accordion.
In addition to "real" database fields, Contao has also supported "virtual" fields since version 5.7, which are grouped together in a single JSON field in the database. This is intended to prevent the maximum number of fields in MySQL from being reached when using a large number of extensions.
The core includes an AbstractColumnToVirtualMigration class, which extension developers can use to convert their own fields into virtual fields.
From version 6.0 onwards, this field will also be used in the core.
The Twig filters simple_token and simple_token_html have been added to replace simple tokens in Twig.
The Twig filter insert_tag_raw has been renamed to insert_tag_html. The old syntax still works, but is deprecated.
If you previously wrote something like foo|insert_tag_raw|raw, the raw filter must now come before the insert_tag filter: foo|raw|insert_tag_html.
Important: If you wish to update an existing Contao 5.x installation to Contao 6.0, please ensure you first update to the latest version of Contao 5.7 so that all migration tools are available.
As usual, the first release of a new major version isn’t exactly packed with new features.
Countless hours were spent switching from input to output encoding and completing the transition to Twig. This has laid important technical foundations – and the way is now clear for what comes next.
Although Contao 6.1 won’t be released for another six months, the first improvements for it are already complete and merged: tree views are up to four times faster, menu rendering has also been significantly sped up, and the building blocks for a new API are in place.
And that’s just the beginning: further features are already in the pipeline and development is really picking up pace.
Contao 6.0 lays the foundations. With 6.1, things are really taking off. Stay tuned!
You can read about all the changes in detail in the changelog. Christian Feneberg has also produced another video on Contao 6.0 (German language only) that’s well worth watching.
Contao 6.0 is compatible with
See also:: Tickets | Compare changes to 5.7 | Changelog
Marcus has taken on the project coordination of Contao, trying to untie the Gordian knot. Since 2003 he is self-employed as BIADES and since 2005 he is project manager and numbers person at ANTWORT:INTERNET in Berlin. Through his spare time he is accompanied by Jupe, Pete and Bob as well as his family.
Add a comment