Drupal

FOSS Project Spotlight: Drupal

Lizz Troudeau — Fri, 19 Apr 2019 12:30:00 +0000

Drupal is a content management framework, and it's used to make many of the websites and applications you use every day. Drupal has great standard features, easy content authoring, reliable performance and excellent security. What sets Drupal apart is its flexibility; modularity is one of its core principles. Its tools help you build the versatile, structured content that ambitious web experiences need. With Drupal, you can build almost any integrated experience you can imagine.

Drupal Is for Ambitious Digital Experiences

Dries Buytaert, founder of the project, provides the vision for Drupal. Managing content for ambitious projects that aim to transform digital experiences for their organizations is what Drupal does best. Drupal goes beyond browser-based websites and reaches all digital platforms to provide a flexible, robust and innovative experience.

How to Get Started

Get started by downloading the official Drupal core files and reading the quick-start installation guide.
Or you can try Drupal with hosted solutions.
Or spin up the Umami demonstration profile in Drupal core with a service such as simplytest.me.
You can download many additional modules and themes from the Drupal.org website.

Figure 1. Umami Magazine Demo in Drupal Core

What's in Drupal Core

The base Drupal download, known as Drupal Core, contains the PHP scripts needed to run the basic content management functionality, several optional modules and themes, and many JavaScript, CSS and image assets.

Drupal 8's core platform has more than 200 features built in. For an up-to-date list of features, see Drupal.com.

Drupal 8.6.0 was the most significant update to Drupal 8. Expect Drupal 9 to release in June 2020, and if you're already using Drupal, it is expected to be the easiest major version upgrade yet. For the most current information on Drupal's latest version, visit Drupal.org.

Go to Full Article

Promote Drupal Initiative Announced at DrupalCon

Katherine Druckman — Wed, 11 Apr 2018 16:03:17 +0000

by Katherine Druckman

Yesterday's Keynote from Drupal project founder, Dries Buytaert, kicked off the annual North American gathering of Drupalists from around the world, and also kicked off a new Drupal community initiative aimed at promoting the Drupal platform through a coordinated marketing effort using funds raised within the community.

The Drupal Association hopes to raise $100,000 to enable a global group of staff and volunteers to complete the first two phases of a four-phase plan to create consistent and reusable marketing materials to allow agencies and other Drupal promoters to communicate Drupal's benefits to organizations and potential customers quickly and effectively.

Convincing non-geeks and non-technical decision-makers of Drupal's strengths has always been a pain point, and we'll be watching with great interest as this initiative progresses.

Also among the announcements were demonstrations of how easy it could soon be to manipulate content within the Drupal back end using a drag-and-drop interface, which would provide great flexibility for site builders and content editors.

We also expect to see improvements to the Drupal site-builder experience in upcoming releases, as well as improvements to the built-in configuration management process, which eases the deployment process when developing in Drupal.

See the full keynote to get inspired by what's to come in the Drupalverse.

And also see the DrupalCon Nashville Playlist!

Go to Full Article

Drupal and Alexa: The Next Big Thing?

Katherine Druckman — Wed, 11 May 2016 16:00:00 +0000

by Katherine Druckman

DrupalCon is underway in New Orleans, Louisiana, and it kicked off with the always energetic keynote from Drupal project founder, Dries Buytaert. While these regular keynotes, known as "DriesNotes" in the Drupal Community, tend to focus on the state of the Drupal project, with updates on the development cycle and community interests, there is frequently also a particularly inspiring look toward the future. This year, Dries wowed the audience with a quick demo of a Drupal site communicating with an Amazon Echo to provide a personalized shopping experience via Echo's conversational interface. And perhaps most interesting was Buytaert's take on conversational interfaces as the next big shake-up for developers and content creators, much like mobile interfaces changed the way we approach web development in the recent past.

The integration is achieved via the recently released Alexa Module for Drupal, and should be exciting for developers anxious to experiment with the Amazon Echo as well as generally exploring the concept of a conversational interface and all its possibilities.

You can watch the Dries Note below, and you'll find the Echo demo around 41:00.

You may also want to check out the Ultimate Guide to Drupal 8 for more info on the latest version of Drupal. It's written by one of our favorite Drupalers, Angie Byron.

Go to Full Article

Drupageddon: SQL Injection, Database Abstraction and Hundreds of Thousands of Web Sites

Shea Nangle — Wed, 15 Apr 2015 18:27:21 +0000

by Shea Nangle

Drupal is a very widely used open-source content management system. It initially was released in 2001, and recent statistics show Drupal as the third-most popular content management system, with just less than 800,000 Web sites utilizing Drupal as a content management system.

Drupal is written in PHP, and it is architected to use a database back end to store Web site content and settings, whether a full-fledged database management system (such as MySQL) or an embedded DBMS (such as SQLite). In recent versions, Drupal has provided a database abstraction layer in order to facilitate the use of any of a number of database management systems to support a given Drupal installation. Database abstraction layers provide a consistent programming interface that can be used to communicate with a variety of database systems without development of code specific to a given database management system.

Due to vulnerabilities in the database abstraction layer introduced in version 7 of Drupal, Drupal 7 prior to version 7.32 was vulnerable to an SQL injection attack. This article provides an introduction to SQL injection attacks, an examination of the Drupageddon vulnerability specifically and an explanation of a number of potential defenses against SQL injection attacks.

SQL Injection

SQL injection is an attack methodology in which malicious SQL code is included in user input, leading to the execution of said SQL code as part of SQL statements used by an application. SQL injection attacks can lead to privilege bypass and/or escalation, disclosure of confidential information and corruption of database information, among other effects.

Command injection attacks, such as SQL injection, routinely place at or near the top of the OWASP (Open Web Application Security Project) Top Ten List of Web application security risks. SQL injection attacks are likely the most well-known type of command injection attacks, but injection attacks can occur any time data is supplied to an interpreter by an application. The recent Bash vulnerability known as Shellshock is an example of a command injection attack that is not related to SQL injection.

SQL Injection Example

An example SQL injection attack starts with code utilizing an SQL statement, such as:


$db_statement = "SELECT COUNT(1) FROM `users` WHERE 
 ↪`username` = '$username' AND `password` ='$password'";

In an SQL injection attack against code such as this, the attacker supplies input, such as the following, to the application:


$username = "badUser";
$password = "' OR '1'='1";

Using this example, the SQL statement executed becomes the following:

Go to Full Article

Achieving Continuous Integration with Drupal

Barry Jaspan — Fri, 13 Sep 2013 17:43:08 +0000

by Barry Jaspan

In the early 1990s, my first job out of college was as a software engineer at a startup company. We were building a commercial product using a well-known open-source network security project. In those days, Agile software development practices (not to mention the World Wide Web, or even widespread public awareness of the Internet) still were in the future. My fellow engineers on that project (who had just graduated with me and to this day are the best programmers I know) and I were taught what we now call the Waterfall method. We thought we were invincible.

We had no idea what was coming. After consultation with potential customers, we wrote a Requirements document describing what the product needed to do, a Functional Specification that described how the product would look and behave, a Design document that described the technical architecture and internals of how we would build it, and even a Test Plan that described the automated tests we would build to ensure the product worked. We had a release deadline, declared by management, of "before Christmas". Good thing we were so young! We engaged in our Death March. The local Chinese delivery place got to know us well. I got home around 1am every morning for months. We finally finished and shipped version 1.0 of the product on December 18. It took me a few weeks to remember what normal humans did when they were not at work.

What Did I Learn from This Experience?

What we did wrong: basically, everything about the software engineering methodology we used was completely stupid. We shipped a working product on time, but we started with the benefit of a working open-source project. We made essentially every mistake that Agile development was invented to prevent.

What we did right: we actually implemented our Test Plan. Since the tests were automated, the build process had to be automated. It certainly added a lot of "extra work" to the project, but the payoff was huge. Before we left for the day, we would kick off the build script. When we came in the next morning, if the last line of output said PASSED, we felt confident and ready to ship. We didn't know it at the time, but we were on the path of what eventually would be called Continuous Integration (CI).

Go to Full Article

Drupal Is a Framework: Why Everyone Needs to Understand This

Diana Dupuis — Wed, 15 May 2013 18:07:44 +0000

by Diana Dupuis

Everyone planning and building Web solutions with Drupal benefits from understanding what a "hook" is—and why Drupal is not a CMS.

One of the greatest challenges that Drupal adopters face, whether they are new site owners or beginning developers, is figuring out what is easy and what is hard to do with Drupal. As a developer, solution architect, technical strategist and even as the friend who knows stuff about Web sites, 60% of my discussions revolve around three questions: how long will it take, how much will it cost, and can my site do [insert cool new thing]?

Sometimes, these are easy questions to answer. Many content-related tasks can be accomplished simply by logging in to Drupal, visiting the /admin page and clicking on menu links until you land on the necessary administration page.

More often though, there are complicated questions to answer. Some tasks can be accomplished by adding contributed modules that easily "plug in" to Drupal core, as it comes "out of the box", and expand a site's functionality. Contributed modules are created and shared by the Drupal community and can be added to any Drupal site.

Some tasks require writing custom code, and new modules must be built. Layers of potential functionality are involved in custom features. Some features require communicating back and forth with other sites via an application programming interface (API). Bigger Web sites often require the creation of small applications that accomplish tasks in the background, outside Drupal's usual workflow. In many cases, multiple solutions exist, and choosing one involves giving something up to get something else. As a developer or a stakeholder, finding the best solution that meets business goals and stays in scope depends upon cooperative discussions.

That is where communication often breaks down. Developers are speaking one language while site owners, project and account managers, stakeholders and others involved in the decision-making process speak another language. When people first learn about Drupal, their initiation often focuses on what a node is, what blocks, content types and views are, and how to create SEO-friendly URLs. These concepts are important, but they frequently fail to answer the essential "how hard is this to do" question or provide a strong foundation for collaborative planning of more complex functionality. Everyone involved needs to understand that they can architect a Drupal site that offers a more-sophisticated set of features than a WordPress site, because Drupal is not a content management system (CMS); it is a content management framework.

Conceptualizing Drupal as a framework does not require years of programming experience; rather, it simply requires understanding what a "hook" is and finding out whether the one you need exists and already is able to do the thing you want done.

Go to Full Article

Speed Up Your Drupal Development Using Installations and Distributions

Oliver Davies — Tue, 19 Mar 2013 16:31:28 +0000

by Oliver Davies

Do you find yourself repeating the same steps whenever you start a new Drupal project? Do you always download and enable the same modules, and make the same configuration changes every time? As we start doing more and more Drupal projects at Nomensa, I noticed that we were doing exactly this, so I started to look into ways to streamline our initial project setup process. My solution was to create my own custom installation profile that provides me with a template to start each project, and this article outlines the steps I took to create it. The code outlined in this article has been committed into GitHub at https://github.com/opdavies/linuxjournal_demo, and it's available for you to download and re-use as needed.

What Are Installation Profiles?

Installation profiles are a combination of modules and themes and predefined configuration. A great example of an installation profile that I use regularly is called Commerce Kickstart (https://drupal.org/project/commerce_kickstart). It provides a version of Drupal 7 along with the Drupal Commerce suite of modules that have been preconfigured to have the correct content types, rules, views and so on. Once an installation profile has been uploaded onto drupal.org as a project, it gets bundled with Drupal core, is available as a packaged download, and is known as a distribution. See https://drupal.org/project/distributions for a list of existing distributions.

Figure 1. The Commerce Kickstart Project Page

How to Install an Existing Installation Profile

There are two different ways to download an existing Drupal installation profile. The first (and easiest) method is to download it as a distribution from drupal.org. To do this, go to the project page for the installation profile (for example, https://drupal.org/project/commerce_kickstart), scroll to the bottom of the page, and download a release in the same way that you would download a module or theme. The resulting file will be named something like commerce_kickstart-7.x-1.10-core.tar.gz, and this file will contain both Drupal core and the Commerce Kickstart installation profile. The other option is to download a fresh copy of Drupal core, and then download the installation profile seperately, either using a drush command like drush dl commerce_kickstart, or clone it directly from its Git repository, and then place it within the Drupal's profiles directory.

Go to Full Article

Creating and Theming a Custom Content Type with Drupal 7

Danny Englander — Fri, 08 Mar 2013 18:00:47 +0000

by Danny Englander

One of the great new things about Drupal 7 is that it's now easier to customize your site content. In Drupal 6, you typically had to use the CCK (Content Construction Kit) module for fine-grained control in customizing content, but that has been folded into core for Drupal 7. Drupal 7 is now a true content management framework (CMF).

Drupal 7: It's All about Fields

When you customize content in Drupal 7, it involves creating or modifying what's often referred to as a content type. Drupal 7 comes with two defaults: Page and Article. When building a site, you often need additional content types. These might include events, press releases, FAQ, staff, photo gallery and more. What makes these unique? It's all about the Fields that you add to your content type.

A Field is an attribute for the content type, and these attributes are types of information associated with your content. If you have an Event content type, you might need to add date, location and link attributes. Each of those can be realized through the use of Fields.

Theming and Nodes

A Drupal 7 Node is simply an individual page with content that's rendered using a specific content type that contains all of your fields. Fields are extremely flexible, and there are many possibilities for display and theming them, depending on what you want to do. Theming, in regard to Drupal, is the presentational layer of the code and content, and there are various ways to achieve theming from some simple changes in the Drupal Admin UI to more complex custom node templates—for example, node--custom.tpl.php. In this tutorial, I use the Display Suite module for theming our node. It's a visual interface that allows for custom layouts without really needing to know too much code. There also are other ways to theme a node, including custom node templates and the Panels module.

Drupal 7 comes with basic default fields, such as Text, Long text, File, Image and List. There also are many additional Field types that can be added via contributed (contrib) modules.

Manage and Edit

To gain insight into existing content types and Fields on your site, navigate to /admin/structure/types, or use the admin toolbar: Structure→Content types. Figure 1 shows the administrator toolbar at the top of the Admin Drupal UI in the browser. You'll use this a lot to navigate the admin area for various tasks. This assumes you have admin access to a Drupal site or at least have been given the proper permissions by an admin to see and use the toolbar.

Figure 1. Drupal 7 Administrator Toolbar

On the content type landing page, as shown in Figure 2, you can see existing types, and you would add new ones here.

Go to Full Article

The Path to Commerce Kickstart 2.0

Ryan Szrama — Fri, 21 Dec 2012 17:06:47 +0000

by Ryan Szrama

Editor's note: Drupal Commerce Kickstart 2.0 was released yesterday after much testing and perfecting, and the article below describes part of that path in the words of its lead developer, Ryan Szrama. Commerce Kickstart is a bundled Drupal solution that allows a site builder to get up and running with an ecommerce site fairly quickly, including Drupal core, Drupal Commerce and dependent modules, and pre-configured options.

“Commerce Kickstart 2.0 takes all of the core strengths of our flexible eCommerce framework, Drupal Commerce, and makes it easier to use and quicker to deploy for e-retailers,” said Mike O'Connor, president for North America of Commerce Guys. “Leveraging an open-source technology with an engaged community like Drupal was a huge asset when shaping the beta product into what Commerce Kickstart is today.”

With more than 2650 reported active sites just since the August beta release, you'd be in good company giving Drupal Commerce Kickstart a try. And, now that the world isn't going to end, what better time is there to launch that online store you've always wanted?

One of the challenges we faced early on in Drupal Commerce’s development was a complicated installation process. Drupal Commerce was developed on Drupal 7 during its "unstable" tag cycle and depended on three other major contributed modules—Entity API, Rules, and Views—that were still in development. Drupal Commerce was also the first major contributed project to put the new entity and fields systems in Drupal core to the test. Using these systems during an ad hoc installation to define data types often failed.

Our solution to the difficulties developers faced was to introduce an installation profile called Commerce Kickstart that simply installed Drupal 7, Drupal Commerce and all its dependencies during the normal Drupal installation process. Kickstart performed a minor amount of store configuration and demo content creation, but it was still largely a tool for developers. It made it simple to test a barebones installation of Drupal Commerce, which accelerated the project's adoption by seasoned Drupal developers and companies.

Go to Full Article

Drupal Special Edition

Katherine Druckman — Wed, 03 Oct 2012 20:34:42 +0000

by Katherine Druckman

As Linux Journal's resident Drupal nerd, I could not be more pleased to bring you this special Drupal issue. Drupal really is everywhere these days, and it's available in more "flavors" than most people in the Open Source community are aware of. So in the interest of spreading awareness about my favorite and ever-growing open-source project, we hope you'll find this special issue both informative and inspiring.

I see a lot of parallels between Drupal and Linux, and not just because "distributions" are such a significant part of Drupal's current landscape. Like Linux and the Linux community, I see both the Drupal software and the Drupal community embracing the fact that no one solution is right for everyone's problem. By maintaining the flexibility of the platform, scratching one's own itch can have tremendous benefits for all. To illustrate this, we've put together an issue full of information about some products that have come to fruition as a direct result of Drupal's flexibility, as well as information on how you can take advantage of the same flexibility to put Drupal to work for your specific use case.

Jeffrey McGuire starts off the issue with some opinions on selling the solutions Drupal can provide rather than selling Drupal itself. In the process, he describes some of the products that illustrate Drupal's potential. Diana Dupuis continues by showing how Drupal is much more than just a CMS, and she explains the hook system that makes the magic happen.

Forest Mars walks through the evolution of Drupal distributions, highlighting the struggles and breakthroughs that have led us to the current set of development tools that make packaging specific configurations possible and portable. He then describes the process of making a distribution, so you can all dive in and get your hands dirty.

One of the most popular Drupal distributions is the friendly and useful Open Atrium (https://www.openatrium.com), which is a project management software that, according to the Open Atrium Web site, provides "an intranet in a box with: a blog, a wiki, a calendar, a to-do list, a shoutbox and a dashboard to manage it all". Patrick Settle's tutorial shows off Open Atrium's best feature—the customization made possible by using open-source software.

Readers who have struggled with their testing and deployment workflow will find some comfort in learning from the struggles of others. Barry Jaspan will help you follow continuous integration best practices with Drupal development, a potentially resource- and time-intensive task that can be made easier.

Go to Full Article