Contao Open Source CMS Changelog for the version 5.3

About Contao 5.3 LTS

The first stable version of Contao 5.3 has been released on February 16, 2024, replacing Contao 4.13 as the long term support version. As an LTS version, 5.3 will be provided with bug fixes until February 14, 2027 and security-related updates until February 14, 2028. Contao 5.7 will be the next LTS version of Contao and will be released in February 2026, ensuring a stress-free transition.

Changelog Contao 5.3

Contao 5.3.7 (2024-04-19)

Changelog of the fixed issues in Contao 5.3.7:

#7089 Make the member group voter cacheable (aschempp)
#7129 Make the `PhpTemplateProxyNode` class compatible with Twig 3.9 (ausi)
#7130 Fix the elements check in the `sectionwizard.js` script (qzminski)
#7127 Use `PhpSubprocess` instead of `Process` in the `ProcessUtil` class (Toflar)

Contao 5.3.6 (2024-04-17)

Changelog of the fixed issues in Contao 5.3.6:

#7122 Ensure compatibility with Twig 3.9 (leofeyer)
#7112 Handle empty strings in the `StringResolver` class (qzminski)

Contao 5.3.5 (2024-04-16)

Changelog of the fixed issues in Contao 5.3.5:

#7113 Fix the order of the media block in the text element markup (ausi)
#7107 Use Encore to minify the SVG icons (leofeyer)
#7071 Add the missing styles to the new table element (zoglo)
#7106 Enable the `sortAttrs` option in the SVGO configuration (leofeyer)
#7017 Fix the elements check in the `modulewizard.js` script (qzminski)
#7073 Use `display: grid` in the image gallery preview (zoglo)
#7074 Initialize Handorgel on the element (zoglo)
#7081 Add the missing `WysiwygStyleProcessor ` autowiring alias (Toflar)
#7064 Also unset the `disable`, `start` and `stop` fields when an admin edits themselves (aschempp)
#7057 Cache SQL queries in the page type voter (aschempp)
#7046 Fix some edge cases when parsing HTML style attributes (ausi)

Contao 5.3.4 (2024-04-09)

Security vulnerabilities closed:

Session cookie disclosure in the crawler (CVE-2024-28235)
Cross site scripting in the file manager (CVE-2024-28190)
Insert tag injection via the form generator (CVE-2024-28191)
Remember-me tokens are not cleared after a password change (CVE-2024-30262)
Insufficient BBCode sanitization (CVE-2024-28234)

Contao 5.3.3 (2024-03-22)

Changelog of the fixed issues in Contao 5.3.3:

#7045 Fix a bug in `setIfExists()` with Stringable objects (ausi)
#7044 Fix double encoding/decoding in the `HtmlAttributes` class (ausi)

Contao 5.3.2 (2024-03-21)

Changelog of the new features in Contao 5.3.2:

#7037 Add the `csp_unsafe_inline_style` Twig filter (ausi)

Changelog of the fixed issues in Contao 5.3.2:

#7039 Revert the changes to the "file uploaded" check (fritzmg)
#7032 Harden mime type handling in the `FilesystemItem` class (m-vo)
#7026 Show headlines in article teasers again (zoglo)
#7006 Use the fragment registry in the `debug:fragments` command (bytehead)
#7031 Allow version 5 of lcobucci/jwt (leofeyer)
#7027 Register theme templates in the global namespace, too (ausi)
#7028 Enable collapsible fieldsets without storage (aschempp)
#7021 Override the access decision strategy instead of the manager (aschempp)
#7016 Fix a PHP 8 warning in the `tl_article.getActiveLayoutSections()` method (qzminski)
#7008 Fix the traceable access decision manager (aschempp)
#7007 Return to the list view after adding items to the clipboard (aschempp)
#6996 Use voters for theme permissions (aschempp)
#7002 Add the user access voter (aschempp)
#6993 Fix the front end module permissions (aschempp)
#7005 Make the `ParentAccessTrait::hasAccessToParent()` method private (aschempp)
#7003 Improve permission error message for DCA actions (aschempp)
#6968 Set the email message priority to "high" (Toflar)
#6995 Disable background workers if they are not supported (Toflar)
#6952 Convert protocol-relative URLs in the string resolver (aschempp)

Contao 5.3.1 (2024-03-08)

Changelog of the new features in Contao 5.3.1:

#6954 Register the `dotenv:dump` command by default in the Contao managed edition (Toflar)

Changelog of the fixed issues in Contao 5.3.1:

#6982 Cache `Image::getHtml()` to speed up the tree view (Toflar)
#6963 Fix the newsfeed migration (aschempp)
#6916 Use `Model::findById()` instead of `Model::findByPk()` (leofeyer)
#6960 Show the route configuration in the news feed page (aschempp)
#6969 Fix the `dotenv:dump` command (aschempp)
#6979 Allow using insert tags in image `alt` and `title` attributes (leofeyer)
#6975 Deprecate inheriting CSS classes in nested elements (aschempp)
#6978 Use `UrlUtil::makeAbsolute()` when converting relative URLs (leofeyer)
#6961 Fix a type error in the login module (aschempp)
#6956 Use `attrs().mergeWith()` in Twig templates (leofeyer)
#6962 Make sure the `.env.local.php` is loaded correctly (Toflar)
#6953 Fix double inheritance of legacy templates in Twig (ausi)
#6950 Correctly register the `AutoRefreshTemplateHierarchyListener` (m-vo)
#6951 Fix that the guests migration only migrates one field at a time (aschempp)
#6943 Correctly generate the URLs to subscribe to comments (leofeyer)
#6946 Improve the performance of the database dumper (Toflar)
#6944 Correctly check if a "jump to" page is set when generating event feeds (leofeyer)
#6919 Make full authentication optional in the personal data module (leofeyer)
#6941 Handle unicode strings in insert tag flags (ausi)
#6938 Add a button to the "invalid request token" template (leofeyer)
#6939 Correctly implement the `ImageFactoryInterface` (leofeyer)
#6936 Fix the Twig loader infrastructure (m-vo)
#6927 Use files instead of `data:` resources to avoid breaking CSP (leofeyer)
#6925 Only make string URL absolute if it does not have a scheme (aschempp)
#6917 Fix two CSS issues (leofeyer)

Contao 5.3.0 (2024-02-16)

Changelog of the fixed issues in Contao 5.3.0:

#6854 Handle routing exceptions during news and event URL generation (fritzmg)
#6900 Improve logging of request parameters (aschempp)
#6898 Add `type="button"` to the accordion toggler (fritzmg)
#6895 Fix the column name in the "remember me" migration (aschempp)
#6893 Move adding the schema.org data to the `_download.html.twig` component (leofeyer)
#6889 Correctly cache Contao translations that only exist as Symfony translations (fritzmg)
#6890 Always allow the "read" action in the front end modules voter (bezin)
#6880 Correctly handle dark icons in `data-icon` and `data-icon-disabled` (zoglo)

Changelog of the new features in Contao 5.3.0-RC4:

#6814 Allow adding a source to multiple CSP directives at once (aschempp)
#6858 Remove the `@internal` flag from the backup manager (Toflar)

Changelog of the fixed issues in Contao 5.3.0-RC4:

#6882 Make the commands lazy again (leofeyer)
#6852 Fix the `TemplateOptionsListener` (fritzmg)
#6867 Correctly initialize multiple accordions on the same page (leofeyer)
#6861 Hide the trail in the SERP preview if no URL can be generated (leofeyer)
#6856 Add the "toggle visibility" button for articles and content elements again (aschempp)
#6857 Fix the "remember me" migration (leofeyer)
#6855 Cast the template identifier to string (leofeyer)

Changelog of the new features in Contao 5.3.0-RC3:

#6819 Focus the first input/textarea after duplicating a wizard row (leofeyer)
#6436 Add a global Twig variable with Contao state (aschempp)
#6742 Add a basic entity for zero-width whitespaces (aschempp)

Changelog of the fixed issues in Contao 5.3.0-RC3:

#6851 Rewrite `Controller::getParentEntries()` (ausi)
#6833 Handle dynamic parent tables in the `Controller::getParentEntries()` method (leofeyer)
#6843 Fix relative front end preview links (aschempp)
#6840 Keep login module errors (aschempp)
#6838 Fix the article content voter (aschempp)
#6841 Remove obsolete hardcoded configuration in the page registry (aschempp)
#6835 Do not require full authentication in the "change password" module (leofeyer)
#6803 Fix the referrer URL if elements are moved inside a nested element (leofeyer)
#6839 Fix routes with parameters in the SERP widget (aschempp)
#6831 Correctly set the target path in the login module (leofeyer)
#6830 Fix the order of the content elements (aschempp)
#6805 Correctly handle denied access in the firewall (aschempp)
#6815 Drop the custom "remember me" implementation (aschempp)
#6807 Improve the debug message for `FigureBuilder` link attributes (aschempp)
#6809 Mark `$secret` as sensitive parameter (aschempp)
#6794 Fix ptable for copyAll and cutAll (ausi)

Changelog of the new features in Contao 5.3.0-RC2:

#6738 Add a Twig function to generate content URLs (aschempp)
#6719 Support CSP on WYSIWYG editors like TinyMCE (Toflar)

Changelog of the fixed issues in Contao 5.3.0-RC2:

#6788 Use the content URL generator in the redirect page controller (aschempp)
#6775 Remove the `@internal` flag from the HTTP cache subscribers (leofeyer)
#6758 Improve how headlines can be adjusted in Twig (m-vo)
#6747 Increase the `z-index` of the jump targets (zoglo)
#6767 Use the `inputUnit` widget for the section headline field (leofeyer)
#6743 Use autoconfiguration where possible (leofeyer)
#6761 Limit the CSP header size to avoid server errors (Toflar)
#6760 Correctly set the link title and text in the downloads controller (fritzmg)
#6759 Normalize the Twig CSP method names (fritzmg)
#6744 Fix the "delete files" button in the file manager (aschempp)
#6740 Add the `TemplateTrait::inlineStyle()` method (fritzmg)
#6737 Properly assign parameters to `contao.crawl.escargot.factory` (zoglo)
#6736 Unify the deprecation messages (leofeyer)

Changelog of the new features in Contao 5.3.0-RC1:

#6606 Generate newsletter URLs using the content URL generator (aschempp)
#6597 Generate FAQ URLs using the content URL generator (aschempp)
#6604 Generate news URLs using the content URL generator (aschempp)
#6607 Generate event URLs using the content URL generator (aschempp)
#6596 Implement the content URL generator (aschempp)
#6631 Add the ability to set Content Security Policies (fritzmg)
#6672 Add a Stimulus controller to handle scrolling in the back end (zoglo)
#6392 Implement the redirect page as page controller (fritzmg)
#5424 Add a description list content element (aschempp)
#6215 Add canonical links to news and events (aschempp)
#6675 Add the page permission voters (aschempp)
#6232 Implement front end module permissions (bezin)
#6646 Add an image size voter (aschempp)
#6584 Add enum support for DCAs and models (SeverinGloeckle)
#6683 Add more database indexes (Toflar)
#6650 Decouple the calendar, FAQ and news bundles from the comments bundle (zoglo)
#6639 Allow adding a "lost password" page to the login module (zoglo)
#6529 Add the DNS mapping migration (fritzmg)
#5810 Add a VFS decorator that supports user permissions (m-vo)
#6605 Optimize the MySQL indexes (leofeyer)
#6652 Sort options by key if they use language references (leofeyer)
#6558 Inline the CSS from a newsletter template before sending (leofeyer)
#6626 Add a modern content slider element (leofeyer)
#6673 Properly name the worker supervision cron (Toflar)
#6669 Use the `attributes_callback` to make the logout redirect mandatory (aschempp)
#6661 Add a z-index to the limit toggler (zoglo)
#6668 Sync the logic to generate multiple aliases (aschempp)
#6516 Implement worker supervision (Toflar)
#6651 Do not load style sheets lazily by default (leofeyer)
#6648 Add a modern accordion element (leofeyer)
#6615 Automatic login for cross-domain preview links (aschempp)
#6643 Add a voter for tl_newsletter_recipients (aschempp)
#6642 Add a voter for tl_undo (aschempp)
#6638 Add the onpalette_callback (aschempp)
#6553 Automatically enable the Strict Transport Security (HSTS) header (Toflar)
#6620 Rename "childs" to "children" (leofeyer)
#6521 Nested content elements (ausi)
#6469 Add more security voters (leofeyer)
#6614 Sort the tables in the database backup (de-es)
#6603 Unify the deprecation messages (leofeyer)
#6594 Remove column from articles URL (aschempp)
#6353 Add a tab menu to jump to palette sections (leofeyer)
#6583 Make Symfony 6.4 the minimum version (leofeyer)
#6569 Show the back end header on scroll-up (leofeyer)
#6557 Make the back end header sticky on all devices (leofeyer)
#6551 Use the picker to select article target in news and calendar (aschempp)
#6518 Populate `contao_` Symfony translations into `$GLOBALS['TL_LANG']` (fritzmg)
#6527 Rewrite tree mode toggling to Stimulus controller (aschempp)
#6303 Implement a global "expand/collapse elements" button (aschempp)
#6533 Register a web processor to add log extras (aschempp)
#6528 Automatically generate the global operations (aschempp)
#6206 Make the downloads controller more flexible for own sources (Toflar)
#6494 Automatically translate the default maintenance template (Toflar)
#6485 Add schema.org support to the virtual file system (Toflar)
#6513 Automatically load routes in app controllers (aschempp)
#6465 Allow to re-use the ProcessUtil data (Toflar)
#6496 Add the event end date to the schema.org data (leofeyer)
#6506 Add a maximum duration for the back end crawler (leofeyer)
#6495 Make the back end crawler configurable (leofeyer)
#6497 Wrap the news date and author in a template block (leofeyer)
#6498 Replace insert tag flags based on the context (leofeyer)
#6477 Clean up a TODO (Toflar)
#6429 Deprecate the `MergeHttpHeadersListener` class (leofeyer)
#6446 Rename the `templates/_new` folder to `templates/twig` (leofeyer)
#6404 Remove the BC layers in the `ContaoCache` class (fritzmg)
#6386 Deprecate the `System::setCookie()` method (Toflar)
#6236 Allow array for page parameters (aschempp)
#6337 Upgrade the Symfony contracts (leofeyer)
#6338 Remove the "roave/better-reflection" dependency (leofeyer)
#6336 Make doctrine/dbal 3.6 the minimum version (leofeyer)
#6339 Upgrade doctrine/collections and doctrine/persistence (leofeyer)
#6335 Make Symfony 6.3 the minimum version (leofeyer)
#6289 Set auto password hasher for all user classes (fritzmg)
#6324 Always set the `JSON_THROW_ON_ERROR` flag (leofeyer)
#6157 Use createElementNS for namespaced XML elements (ausi)