New in Craft CMS 2.2

CSRF protection

The biggest new feature is CSRF protection. Cross-site request forgery attacks are a common problem for web apps, and now Craft includes built-in protection. The enableCsrfProtection setting and getCsrfInput() template function make it simple to secure forms. Back in 2014, this was not standard in most CMS platforms.

Session management in the control panel

Session management got a major update. Now, two minutes before you're logged out, you'll see a warning and can extend your session with one click. If your session does expire, a dialog pops up on the page so you can enter your password and pick up right where you left off.

If you've ever lost work because your session timed out before you could save, this one's for you. That's no longer a problem.

Position field

The new Position Select field is a button group for choosing element positions: left, center, right, full, drop-left, and drop-right. Useful when editors need layout control without touching HTML.

Singles get an upgrade

Singles now offer the same settings as Channels and Structures, including "Show the Title," "Title Field Label," and "Title Format." There's also a new Status setting. Singles didn't get much attention in Craft 2.0, but with 2.2, they're finally equal to the other entry types.

Security: HTML Purifier

Rich Text fields now have a "Purify HTML" setting. When this is turned on, content is cleaned by an HTML Purifier before it's saved, removing any harmful code. This is especially useful for sites with multiple editors.

Automatic transform generation

Image transforms now generate automatically in the background after the page has been served. The generateTransformsBeforePageLoad setting from 2.1 is effectively obsolete after just one release – no configuration needed.

Cache tag improvements

The {% cache %} tag now has two new options: using key for targeted cache busting and if for conditional caching. Before, handling cache invalidation took some creative workarounds, but that's no longer needed.

For developers

bootstrap.php makes it possible to load Craft from an external application without Craft taking over the HTTP request. Useful for CLI scripts, cron jobs, or integrations with other PHP frameworks, an early step toward more flexible use of Craft outside the standard request cycle.

There's also Craft::dd(), which stands for dump and die. With one line, it outputs a variable and stops the request. It quickly became the most popular debug tool in the Craft community.

Pixel & Tonic also teamed up with Mijingo to create videos about Craft's key features. The first video, which covers Matrix, is already out. Another new addition is the class reference at buildwithcraft.com, which updates automatically with each release.

My take

Not every release deserves a conference talk. Craft 2.2 is the quiet one – CSRF protection, session warnings, background transforms. You stop noticing it because nothing breaks anymore.