Evaluation of Drupal

This is an evaluation of Drupal against GnomeWeb/CmsRequirements, at the test site http://gnomedotorg.ourproject.org/drupal/. Feedback is welcomed, especially from people with Drupal admin experience.

Test

Only testers going through the whole GnomeWeb/CmsRequirements/CmsTest can add their points. You can add your comments on the evaluations made.

Ranks: 0 Not supported - 1 Partially possible - 2 Possible but complex - 3 Possible and easy

Additional comments:

• Explain here anything relevant not covered by the table above.

CMS Platform

• Drupal 4.7.3
• PHP
• Running on MySQL 4.0 based backend
• Architecture
  • runs in mod_php

Security

• robust against attack attempts

Drupal developers seem to take security seriously as the post at http://drupal.org/node/36526 indicates. There have been cases of break in-s at major Drupal powered websites (IIRC, SpreadFireFox was one of them). However, as far as my personal experience goes (there was a time when I was managing around 4/5 drupal powered sites simultaneously), I have not experienced any major security related issues. One just needs to subscribe to the drupal announcement list and upgrade whenever there is a security related release. My only major gripe is that they don't release any patch (in *.diff format, that is) - that would have made my life much easier.

• - This belongs in the "active in releasing security updates" section, and has nothing to do with it being robust against attack attempts which, as far as I know, is not something we can count on with Drupal -- GuilhermePastore - IMO developers taking security seriously says nothing about if the software is currently robust. Patches are workarounds (proper way of working is to prevent them from happening / auditing every change). Security problems should be avoided to appear in the first case. Breakins makes me question robustness -- OlavVitters - I am also reasonably concerned about the upgradability of Drupal. I do not follow the project at all currently, so it would be great if someone more knowledgeable could say a word about this, but I have had headaches because of that in the past. If for some reason we cannot upgrade Drupal immediately or in a reasonable time frame, for example due to outdated software, such as we have been facing with RHEL3, and other Drupal versions are released meanwhile, how easy and reliable is it to upgrade from x.y to x.y+3 skipping x.y+1 and x.y+2 or even x+1.y? -- GuilhermePastore

• - Drupal (since version 4.7) has a good upgrade system in place. You can either apply the patch file to update the php code, or download and unpack the new tarball, and then run update.php which will take care of any database changes that may be required between versions.

• Also, regarding the break-ins ... that was an error in the XML-RPC library that was employed not only by Drupal, but many other PHP based web applications. Since then, the XML-RPC library has been replaced with an in-house version that is better audited and easier to use. -- RowanKerr

• * some features protected by authentication

Drupal has support for user authentication, and the ACL system works fine for most scenarios (You can different classes of users, who can have permissions over different aspects of the site). Details are athttp://drupal.org/handbook/modules/user

• - There are a few places where the ability to finely control permissions is limited. For instance, on FootNotes I have wanted to get a large group of people moderating and approving comments. But I cannot give them this permission without giving then permission to modify/delete all existing comments in the entire system -- LukeStroven

• - The taxonomy_access module might work for your situation. It adds crud permissions to individual taxonomy terms within Drupal. Also, there is the Organic Groups module(s) that might help. -- RowanKerr

• * option to communicate over a secure channel (SSL)

That's more of an apache related issue - right ??

Theres a module to define secured areas like administration. See http://drupal.org/node/65632 -- StefanAuditor

• upstream is active releasing security updates

Releases are made regularly, and the response to vulnerabilities is pretty fast. The issue here is not really upstream, it is more the ability of GNOME sysadmins to quickly and promptly be able to apply these patches. The Drupal project has a security mailing list to help keep us informed as issues arise

URLs

• friendly URLs, see GnomeWeb/PlatformIssues

Drupal can take advantage of Apache's mod_rewrite engine to have support for clean URLs. Example

• http://www.gnu.org.in/node/18

• http://www.gnu.org.in/press

A module to do this is also available http://drupal.org/project/pathauto. Thanks to Tom Chance for pointing it out.

I18N

• ways to translate CMS strings

Drupal is localisable - but I have no first hand experience - feel free to populate this section

• It supports PO file import/export: http://drupal.org/handbook/modules/locale, http://drupal.org/node/11130 (DaniloSegan)

• ways to translate content

There is a module for Internationalization. See http://drupal.org/project/i18n -- StefanAuditor

• Not using PO files which means we can't use our status pages and existing tools (DaniloSegan)

• Asked them about PO Files and revision control: http://drupal.org/node/75364

• preferably show translators what changed and what needs updating
• preferably get language settings from browser (Accept-Language) and session (cookies)
• have URLs to translated pages, so they can be directly referenced

Authoring

• a comfortable framework for editing content
  • can be wiki style, but does not have to

There are multiple input filters and editors. See http://drupal.org/project/Modules/category/63 -- StefanAuditor

• "draft" content, which is already managed in the system, but not yet published
  • translators can do their job before content appears to the public
  • pre-edit text to be published at a specific date and time

There is some kind of workflow integrated in core. Additionally you may define your own by using http://drupal.org/project/workflow -- StefanAuditor

• perhaps automatically publish on a specific date and time

See http://drupal.org/project/scheduler -- StefanAuditor

• track who has rights to edit a page

There are different possibilities to do that. See http://drupal.org/project/Modules/category/74 -- StefanAuditor

• track who did edit a page
• can display when a page was last updated

This is possible too. -- StefanAuditor

• perhaps change management, so older version of a page can be recalled

Some kind of revision-system is integrated, theres also a module to show diff http://drupal.org/project/diff -- StefanAuditor

• copyright and licensing information can be displayed on the pages

See http://drupal.org/node/17497 -- StefanAuditor

Markup

• the served html should be accessible
  • with a wide range of browsers (desktop and mobile)
  • for people with disabilities
• the markup should primarily capture content structure not representation
  • (i.e. "heading" versus "big bold font")

This is more of a theme issue. See http://drupal.org/node/44661 for more on this.

Navigation

• support hierarchical URLs (subdirs)
• support hierarchical navigation (submenus)

Above two issues are probable addressed viaTaxonomy and the related modules. - Could also be done with the menu module, or ook pages -- RowanKerr

• preferably have a site map

Have a look at http://drupal.org/project/site_map -- StefanAuditor

Feeds

• shall provide feeds (RSS, Atom, etc)
  • news (for visitors)
  • site updates (for content authors)

Drupal generates feeds for almost all content it provides. There is module with a centralized view on all feeds http://drupal.org/project/syndication

• peferably shall integrate external feeds (e.g. from gnomefiles.org)

Check http://drupal.org/handbook/modules/aggregator

Theming

• shall be themeable to adopt the gnome look

Drupal is themable - and it supports a number of theme engines. We ported the Box Grey theme to look like the older version of www.gnu.org.in and it took us around one hour to do so.

Drupal offers several different theming engines (http://drupal.org/node/509).

• PHPTemplate - PHPTemplate is the standard being shipped with the latest stable (4.7). PHPTemplate uses PHP as the template language.

• XTemplate - XTemplate was the standard engine previous to 4.7. It will not supported in future releases.

• SmartyTemplate - Uses Smarty.

PHPTemplate in particular is very powerful b/c it allows overloading. Each module defines overloadable functions by labeling the function with the "theme_" prefix. These "theme_" functions can be overloaded by defining an equivalent "phptemplate_" function which provides callbacks. Once you create a callback function (there are several defined by default), you can simply create a template file with the node/field/view prefix and PHPTemplate will use the newly created template to display the content.

Issues - Comments

Just thought I would share some of the issues and experiences I have had with drupal on FootNotes over the last few years. - LukeStroven

• It's dynamic CMS, with it does have a very good caching system, it still generates many pages on the fly which requires a certain amount of horse power to weather the traffic spikes without falling down.
• It creates a new session everytime someone logs in or for every anonymous visit. I had problems with the database table that stores these sessions growing extremely large within a few days and crashing the table. I ended up adding a cron job to clear these sessions out every few hours for anonymous users and every few days for logged in users.

Session lifetime is easy adjustable via .htaccess or php.ini. See http://php.net/session for this. -- StefanAuditor

• The cache system works good, but as the cache database grows large, its performance decreases. Here I also had to add a cron job to clear the cache out every few hours so that the performance benifit was still good.

- There are solutions being discussed to improve caching performance in the next version of Drupal. Code freeze is in September. -- RowanKerr

• Comment Spam - hasn't been a major issue by using captchas and holding anonymous comments for moderation.

  • Do we need to allow comments in the usual GNOME.org sites ?? - SayaminduDasgupta

There's a nice AntiSpam module, which work for every note-type and uses learning algorythms. See http://drupal.org/project/spam for this. -- StefanAuditor

• As you add more an more modules to drupal the administration tends to get cluttered. Many modules spread the settings pages under numerous areas in the drupal menu sometimes making it difficult to find the option you are looking for.

- The administration area has been redesigned and will be more task-oriented and clearly organized in the next version. -- RowanKerr

• The drupal API is very good.
• Many CMS have horribly designed comment systems that make hundreds of sql queries for each page, killing performance. Not drupal, a page with a comment structure is pulled in one query.