TYPO3 v10 LTS — Safe and Sound

Let’s have a closer look at what backend users (for example editors) can expect from TYPO3 v10 LTS.

Flexible and expandable Dashboards

The new system extension “dashboard” provides backend users with a quick overview of the current system status. The dashboard can also:

• Show news from external RSS feeds.
• Display statistics.
• Display information as lists, charts, diagrams.
• Engage users with call-to-action buttons.

These are just a few examples. Backend users can not only configure multiple dashboards (and easily switch between them), but they can also add, remove, and even drag-and-drop widgets to any position in their dashboard.

Dashboards feature great flexibility and expandability. We made it super-easy for developers to create their own widgets and publish them as TYPO3 extensions. TYPO3 v10 LTS comes with a selection of widgets already.

Read more about the Dashboard in the TYPO3 documentation.

User-friendly Form Framework Wizard

Forms are an essential part of many websites and web applications. Typical use cases are contact forms, support requests, forms to capture leads on a product site, etc.

The multi-step form creation wizard is newly enhanced for backend users. Now, users navigate through steps with descriptive labels such as “Start” or “Finish” rather than the numerical indicator “Step x of y” previously used.

As only one general configuration file, “FormSetup.yaml” is required, integrators will enjoy a streamlined setup and an optimized configuration structure.

Read more about the Form Framework in the TYPO3 documentation.

Automatic updates for URL segments and redirects

Human-readable URLs were introduced as a core feature in TYPO3 v9. We were able to optimize this feature in TYPO3 v10 LTS further, to make it even simpler for backend users to work with and to update URL segments. Changing a slug automatically updates the segments of subpages now.

This is a great and logical feature, but does it mean that the old URLs become invalid? Don't worry: TYPO3 v10 LTS has you covered! The system automatically creates redirects to the new URLs, so website visitors always end up on the correct page.

But that’s not all: TYPO3 notifies backend users when it automatically executes URL updates. If they need to, users can revert the automated updates and redirects with the click of a button.

Secure password reset/recovery

Another notable new feature in TYPO3 v10 LTS is the “password recovery” function for backend users. Previously, administrators created backend user accounts and assigned passwords. They then had to provide the users with their access details. The same applied to cases where users forgot their passwords. From a security perspective, this is not considered state-of-the-art anymore. Administrators should not need to deal with user passwords at all.

In TYPO3 v10 LTS, administrators can trigger a password reset for users in the TYPO3 backend. Backend users are now also able to request a password-reset email in a secure way.

To ensure a high standard, we have built a number of security features into this function.

• No information about existing users is disclosed.
• The link in the email is only valid for a limited time.
• There is a rate limit on how often a recovery email can be requested.

On systems that have special security requirements, the function can also be deactivated for administrator accounts. Alternatively, the function can be completely disabled for all users. This may become relevant in installations with third-party integrations such as LDAP or OAuth.

Link Validator enhancements

Configured as a Scheduler task, TYPO3’s Link Validator aims to detect broken links throughout the system. This indispensable feature has been extended further and now supports inaccessible pages, files, and even external links. Now, external links can also be validated on-the-fly.

Integrators set up, configure, and maintain TYPO3 instances. In every TYPO3 release, it is a high priority for us to support them in their day-to-day work and to make sure that working with such a powerful and flexible system like TYPO3 is, and remains, straightforward and enjoyable.

Better UX for backend user management

The mechanism for handling user permissions in TYPO3 is known as the most powerful and technically matured access control method you can get from an open-source enterprise CMS. At the same time, backend user accounts are, without question, one of the most important data sets in a TYPO3 system. Managing user accounts, user groups, and their permissions is not easy, if you don’t have a clear and well-curated overview of the data.

We’ve improved the backend user module to make it easier for integrators to manage users and user groups. The updated user detail view now shows:

• User data such as real name, email address
• User start/stop date
• All groups, subgroups, permissions
• DB and file mounts
• Read/write access to tables
• And more!

Integrators also have the option to compare user accounts and user groups, including their permissions and other important data, in a clear and well arranged way.

Attractive HTML-based system mails

The customization options of the TYPO3 backend are exceptional. Extension developers can choose from a vast range of predefined input and control elements when building modules. Integrators can modify, remove, and relabel almost all aspects to meet a client’s specific requirement.

Before, it wasn’t possible to customize system-generated emails that it would send to users, at least not out-of-the-box. Now these emails use the Fluid templating engine to send template-based HTML emails. This feature is especially interesting for agencies as it is now possible to customize the design of these emails or even replace them completely. You can, for example, place a company logo or adjust the colors to make them more attractive with just a few simple steps.

Several TYPO3 system emails use this new format with customizable HTML-based Fluid templates, for example:

• Email notifications that a user has logged into the backend.
• Email notifications when an element changes its workspace stage.
• The password-reset email.
• The test email that can be triggered in the Install Tool (see screenshot above).

Frontend login improvements

The frontend login functionality provides a simple way for users to log in and access restricted areas of a website. The feature has been migrated and uses the Extbase programming framework and the Fluid templating engine in TYPO3 v10 LTS.

This solution offers developers and integrators a few advantages:

Customize the appearance: Update or completely change appearance by simply modifying the Fluid templates. This includes not only the login form and other functions visible at the frontend, but also emails that go out to end-users, for example password recovery emails.

More strict security: Another exciting effect of the switch to Extbase applies to so-called “validators” — a piece of PHP code that is used to validate if a password meets certain security requirements. Developers and integrators alike can now adjust and modify these validators and enforce strict password restrictions.

This enhanced flexibility in TYPO3 v10 LTS allows agencies to highly customize the login functionality for frontend users.

Read more about the Frontend login in the TYPO3 documentation.

Automatically detect conflicting redirects

We mentioned URL segments and redirects above. The backend module “Redirects” was introduced with TYPO3 v9 and lets site administrators add and configure redirects. The source path can be an arbitrary name or it can be represented as a regular expression. This provides great functionality but what if a redirect has the same name as an existing page URL?

Configuration mistakes like this can happen and TYPO3 now offers a simple solution to detect conflicting redirects: a CLI command that shows a list of clashes (if any exist). This command can also be configured as a scheduler task and the results are shown in the “Reports” backend module.

This command can also be configured as a scheduler task and the results are shown in the “Reports” backend module.

Translations with Crowdin

TYPO3 is famous for its multi language capabilities. This not only applies to content that is visible in the frontend, but also to labels used in the backend user interface. There are not many content management systems on the market that allow users to work in the administrator area in their native language, no matter which language this is — as long as a translation exists.

TYPO3 now uses Crowdin to take translations of backend labels to the next level. The modern SaaS solution is used as the localization/translation management platform for TYPO3 v10 LTS by default and comes as the successor to Pootle, which was used by the TYPO3 community for many years.

In addition to translating the backend, you can also use Crowdin to translate user interface text in custom developed TYPO3 extensions.

Read more about the localization initiative in Georg Ringer’s article “Better Multilingual Support”.

Browser-native lazy-loading for images

Of the resources needed to serve up a modern web page, images pack the biggest punch in terms of file size. To help, lazy-loading for images has been adopted as a standard to improve load-times, reducing the burden on both servers and users. TYPO3 is the first major content management system that offers lazy-loading out-of-the-box.

Lazy-loading defers loading images, starting with a lightweight placeholder image, and only serving up the higher resolution when it’s needed. For example, if a visitor doesn’t scroll all the way down the page, that media won’t even load. This reduces the amount of data transferred and the processing time. This helps both at the server and client side to make for a faster site and better user experience.