Talking Drupal: Talking Drupal #391 - Building Your Career

Planet Drupal - Mon, 2023/03/20 - 7:00pm

Today we are talking about Building Your Career with Mike Anello.

For show notes visit:

  • How we started our careers
  • Broad career opportunities
  • Mentorship
  • Roles
  • First step after graduating
  • First step in switching
  • Common hurdles
  • Resources like Drupal Easy
  • Value of a career in Drupal
  • How do you find jobs
  • How do you build and maintain your Drupal career
  • How about your Drupal resume
  • Any advice
Resources if (class_exists('Kint')) { // Set the max_depth to prevent out-of-memory. \Kint::$max_depth = 4; } Guests

Mike Anello - Drupal Easy @ultimike


Nic Laflin - @nicxvan John Picozzi - @johnpicozzi Jacob Rockowitz - @jrockowitz

MOTW Correspondent

Martin Anderson-Clutz - @mandclu Devel Debug Log Allows developers to inspect the contents of variables. If those are classes you can inspect nested properties and all methods available.


The Drop Times: To Become a Hedgehog

Planet Drupal - Mon, 2023/03/20 - 5:53pm

Last week, TheDropTimes (TDT) was able to publish two interviews. In one of those interviews, Holmes Consulting Group founder Robbie Holmes mentioned a concept. 

Many management professionals might know and practice it. But for me, it was new. I am not a management guy, and such concepts seldom graced my reading list. Listening to what others say has helped me, and I can also say the same about watching Alethia’s interview with Robbie. 

The concept he shared is not new. Isaiah Berlin proposed it in his 1953 essay, ‘The Hedgehog and the Fox: An Essay on Tolstoy’s View of History’; later, Jim Collins developed it in his book, ‘Good to Great: Why Some Companies Make the Leap, and Others Don’t.’ The core theme of this book is that greatness is not primarily a function of circumstance but largely a matter of conscious choice and discipline.

How Jim Collins describes the hedgehog concept intrigued me. He begins with Berlin’s adaptation of the ancient greek parable, “The fox knows many things, but the hedgehog knows one big thing.” Jim tries to teach us how to find that one big thing. It is by placing your business in the intersectional area of three thought circles:

  1. What you are deeply passionate about.
  2. What you can be the best in the world at.
  3. What drives your economic or resource engine. 

Jim explains that transformation from good to great comes about by a series of good decisions made consistently with a Hedgehog Concept, supremely well executed, accumulating one upon another over a long period. 

Pardon my audacity in pushing this concept again. But what I saw after going through it is that we at TDT can excel in creating more and more good-to-great interviews with the fantastic people working around Drupal and related projects with your active help. Also, we urge the Drupal agencies to find their one big thing and excel in it. 

As I mentioned, you can watch our interview video with Robbie Holmes here. The other interview we published last week was with Chris Wells, the co-lead of Project Browser Initiative. Chris is the founder of Redfin Solutions. You can read the interview here. We made both conversations as part of DrupalCamp NJ

As for other stories from last week, here are a comprehensive list:

Drupal Developer Days Vienna has started accepting session proposals. MidCamp is happening next month, and here is how you can help organize the campOpenSource North Conference has announced the lineup of speakers. Drupal Netherlands opened the sale of early bird tickets for Drupaljam 2023 in June. You may submit sessions to DrupalCon Lille until April 24. Drupal Camping Wolfsburg treats all sponsors as gold sponsorsDrupalSouth Wellington has put out a call for volunteers. You can submit sessions for DrupalCamp Asheville 2023 until April 25. Both DrupalCamp NJ and NERD Summit are over. DrupalCon Pittsburgh is looking for a launch sponsor or co-working space sponsor. 

Drupal Community Working Group has asked Drupalers to nominate candidates for Aaron Winborn Award 2023, and you have only five more days to do that. Kanopi and Pantheon have announced a joint webinar on Drupal 7 to 10 migration. Salsa Digital has started a blog series on ‘Rules as code insights.’ SFDUG is hosting a Technical Writing Workshop on April 13. We revisited a blog post from HTML Panda from May 2022, comparing WordPress and Drupal. A Drupal distribution focussed on the publishing industry, ‘Thunder CMS 7’ based on Drupal 10, published its beta release. Von Eaton, Director of Programs in Drupal Association, addressed the ‘Back to Work for Women’ program conducted by ICFOSS and supported by Zyxware. 

That is for the week, folks; thank you. 

Sebin A. Jacob


Consensus Enterprises: Kubernetes backend for Aegir5

Planet Drupal - Mon, 2023/03/20 - 3:00pm
Aegir5 and Kubernetes Lately we’ve been working with clients ranging from large Canadian government departments to small commercial SaaS companies, who have asked us to deploy CMS apps to Kubernetes (K8S) clusters running on Openstack. In spite of our continued feeling that most of the time Kubernetes Won’t Save You, we’ve found it to be surprisingly useful in certain contexts. In fact, we’ve started to think that K8S will prove an extremely valuable backend to plug in to our existing Aegir5 front-end and queue system.

Axelerant Blog: 5 Best Test Management Tools For Jira In 2023

Planet Drupal - Mon, 2023/03/20 - 12:47pm

Choosing a team's new Jira test management tool can be challenging, as one needs to consider a few key factors. The ideal test management tool should include test automation and observation testing. It should be easy to use, have robust test management capabilities, and have an efficient user interface.

Categories: Create accessible websites with Drupal

Planet Drupal - Mon, 2023/03/20 - 8:00am
Create accessible websites with Drupal neerajskydiver Mon, 03/20/2023 - 03:00

Use the open source Drupal CMS to create accessible websites that provide open access to everyone.

As the world becomes increasingly digital, it’s more important than ever to ensure that websites are accessible to everyone. Accessibility is about designing websites that can…


Ben's SEO Blog: The Metatag Module

Planet Drupal - Sat, 2023/03/18 - 12:19am
The Metatag Module Set up your Drupal site's meta tags along with specifying how your social media will appear when linking to pages, along with Schema information in one powerful Drupal module. Anonymous (not verified) Fri, 03/17/2023 - 18:19

Ben's SEO Blog: How to Add Default Metatags for a Specific Content Type

Planet Drupal - Fri, 2023/03/17 - 11:43pm
How to Add Default Metatags for a Specific Content Type

So you've got your Metatag module installed and defaults configured for the Global, Front page, and Content. However, you want slightly different meta tags for several of your content types. Here's how you do that.

Tracy Cooper Fri, 03/17/2023 - 17:43

Ben's SEO Blog: How to Add Meta Tag Fields to Your Content Types in Drupal

Planet Drupal - Fri, 2023/03/17 - 10:50pm
How to Add Meta Tag Fields to Your Content Types in Drupal

So you have your Meta tag module installed and all the default meta tags configured. However, you still need to tweak the meta tags for a specific page, but the meta tag fields aren't showing up in the edit interface. Here's how to get those to show up for the various content types.

Go to Manage > Structure > Content Types. This displays the Content types listing page. 

Tracy Cooper Fri, 03/17/2023 - 16:50

Wim Leers: High concurrency Composer

Planet Drupal - Fri, 2023/03/17 - 4:45pm

On behalf of Acquia I’m currently working on Drupal’s next big leap: Automatic Updates & Project Browser — both are “strategic initiatives”.

In November, I started helping out the team led by Ted Bowman that’s been working on it non-stop for well over 1.5 years (!): see d.o/project/automatic_updates. It’s an enormous undertaking, with many entirely new challenges — as this post will show.

For a sense of scale: more people of Acquia’s “DAT” Drupal Acceleration Team have been working on this project than the entire original DAT/OCTO team back in 2012!

The foundation for both will be the (API-only, no UI!) package_manager module, which builds on top of the php-tuf/composer-stager library. We’re currently working hard to get that module committed to Drupal core before 10.1.0-alpha1.

Over the last few weeks, we managed to solve almost all of the remaining alpha blockers (which block the core issue that will add package_manager to Drupal core, as an alpha-experimental module. One of those was a random test failure on DrupalCI, whose failure frequency was increasing over time!

A rare random failure may be acceptable, but at this point, ~90% of test runs were failing on one or more of the dozens of Kernel tests … but always a different combination. Repeated investigations over the course of a month had not led us to the root cause. But now that the failure rate had reached new heights, we had to solve this. It brought the team’s productivity to a halt — imagine what damage this would have done to Drupal core’s progress!

A combination of prior research combined with the fact that suddenly the failure rate had gone up meant that there really could only be one explanation: this had to be a bug/race condition in Composer itself, because we were now invoking many more composer commands during test execution.

Once we changed focus to composer itself, the root cause became obvious: Composer tries to ensure the temporary directory is writable and avoids conflicts by using microtime(). That function confusingly can return the time at microsecond resolution, but defaults to mere millisecondssee for yourself.

With sufficiently high concurrency (up to 32 concurrent invocations on DrupalCI!), two composer commands could be executed on the exact same millisecond:

// Check system temp folder for usability as it can cause weird runtime issues otherwise Silencer::call(static function () use ($io): void { $tempfile = sys_get_temp_dir() . '/temp-' . md5(microtime()); if (!(file_put_contents($tempfile, __FILE__) && (file_get_contents($tempfile) === __FILE__) && unlink($tempfile) && !file_exists($tempfile))) { $io->writeError(sprintf('PHP temp directory (%s) does not exist or is not writable to Composer. Set sys_temp_dir in your php.ini', sys_get_temp_dir())); } }); — src/Composer/Console/Application.php in Composer 2.5.4

We could switch to microtime(TRUE) for microseconds (reduce collision probability 1000-fold) or hrtime() (reduce collision probability by a factor of a million). But more effective would be to avoid collisions altogether. And that’s possible: composer always runs in its own process.

Simply changing sys_get_temp_dir() . '/temp-' . md5(microtime()); to sys_get_temp_dir() . '/temp-' . getmypid() . '-' . md5(microtime()); is sufficient to safeguard against collisions when using Composer in high concurrency contexts.

So that single line change is what I proposed in a Composer PR a few days ago. Earlier today it was merged into the 2.5 branch — meaning it should ship in the next version!

Eventually we’ll be able to remove our work-around. But for now, this was one of the most interesting challenges along the way :)


Axelerant Blog: How To Run Multiple Instances Of Mautic For Marketing Automation Needs

Planet Drupal - Fri, 2023/03/17 - 4:12pm

Mautic is the world's largest free, open-source marketing software that automates marketing tasks like segmentation, lead scoring, campaigns & journey builders, and contact list management. It supports integration with all popular social media platforms like Twitter, LinkedIn, and Facebook and has integrations to connect with other marketing automation tools.


Golems GABB: A Glance at Tome - Drupal static content generator

Planet Drupal - Fri, 2023/03/17 - 2:13pm
A Glance at Tome - Drupal static content generator Editor Fri, 03/17/2023 - 15:13

Creating a completely static HTML website is quite a challenging process unless you use a static content generator. Tome is developed to make it as easy as possible with any site on Drupal.
Like any CMS, it provides a set of templates and automatically helps to create pages, avoiding a long and complicated manual setup. You don't even need to know Java to use it. Just a perfect match if you're creating content based on raw data and a website template set.
Static sites are perfect for SEO and SEA. Using a static content generator gives some severe benefits to your site, including better performance, a lighter backend, and multiple options for customization. Moreover, static sites are more flexible, secure, and scalable than dynamic types. Let's learn more about static website generators and Tome with our Drupal development team.


Axelerant Blog: Why Did We Choose Enthusiasm As A Core Axelerant Value

Planet Drupal - Fri, 2023/03/17 - 1:44pm

This article explores why "enthusiasm" is a core organizational value within a fully remote company like Axelerant.


The Drop Times: Von Eaton Addresses 'Back to Work for Women'

Planet Drupal - Fri, 2023/03/17 - 10:44am
International Centre for Free and Open Source Software (ICFOSS), Kerala partnered with Zyxware Technologies to offer Drupal training for women who had career breaks owing to various reasons. This was the fifth edition of the program titled Back to Work for Women. The 15 day program started on March 01 and will end on March 19, 2023.

Droptica: Drupal for professional publishing - Thunder CMS overview

Planet Drupal - Fri, 2023/03/17 - 9:41am

Nowadays, software has become crucial for the functioning of large publishers. It supports the process of creating, publishing and distributing content, and also allows monitoring and analyzing users and market data. In the following article, we would like to introduce you to one of the available tools that improve the process of creating a website and increase the quality of daily work on content. This solution is the Thunder distribution based on Drupal CMS.

What is Thunder?

Thunder is an open source content management system aimed at professional publishers. The tool is also one of Drupal's free distributions, i.e. its version enriched with additional modules and extensions, which are available out of the box and are targeted at facilitating user work in specific aspects.

In the case of Thunder, we are dealing with a tool for all kinds of publishers. Both small and large information portals, publisher websites, and even blogs can benefit from its functionalities. Popular magazines such as Elle, InStyle, and Playboy use it in everyday work. Further down the article, we'll present details about the distribution itself and some of its most interesting and useful options.

Popularity and authors

Currently, over 800 websites report using Thunder, and the distribution itself is regularly developed and supported by the authors and users. As a result, the stability and community support for this solution are at least at a satisfactory level.

The author of Thunder is Hubert Burda Media - a German media group that has been developing this project since 2016 (the first version was released in January 2017). Their experience allowed them to tailor a tool to the needs of the industry they are members of. Thunder was designed to solve real problems and facilitate the daily work of other publishing or media companies.

Thunder download and installation

Thunder as a project is available at: and we can find complete installation instructions in the documentation.

To install Thunder, we need a server with access to PHP, a database and Composer. The article with tips on how to generate a local development environment will help us prepare these elements.

The latest version of Thunder 6, which we recommend, is based on Drupal 9, therefore it shares the hardware requirements with it. These include: PHP in at least 7.3 version (although the recommended version is 8) and Apache in at least 2.4.7 version. In the case of the database, the values will vary depending on which database we decide to use. We can find a full list of hardware requirements in Drupal's documentation.

Once we deal with the necessary preparation, the distribution installation requires only two commands:

1. Project creation and installation

2. Quick start

And that's basically it. After following these steps, we have our first Thunder instance on the local environment ready for work.

We recommend delving deeper into the above-mentioned installation documentation available on Drupal’s website. There we’ll find more details and additional information that will help us launch a new project.

Thunder CMS - review and functionalities

As we mentioned above, Thunder is a distribution aimed at publishers. Its main and most commonly used functionality will therefore be the article creation window. We'll go through the process of adding content, indicating the elements that streamline and improve our work. We'll take up the topic in two parts: article creation and additional functions, in order to separate these aspects from each other.

Article creation

To Drupal users, this window may seem both familiar and foreign. The longer we look at this screen, the more we'll be surprised by the solutions not accessible in the standard version of Drupal. Let's go through all sections to see what possibilities Thunder offers us.


Source: Thunder CMS

In addition to the standard Title field to complete the title, there are also several new features here.


The Channel field allows us to assign an article to one of the main channels. The list of available channels can be configured and extended at: /admin/structure/taxonomy/manage/channel/overview


This function allows us to organize the content and its purpose. In the example above, we see a standard division into events and messages. This type of solution enables us to easily and effectively distribute the content within specific channels. On our test web page, this helped us create separate subpages presenting content from these two categories.


SEO Title

This is the title that isn't visible to the user but is read by robots crawling and indexing our website. Its quality and compliance with certain rules are crucial to strengthen the web page’s position in Google or Bing search engines.

This title is also used to automatically generate the address of our article, so it's a good idea to keep it in mind and include the keywords for our content here.

This field is also enriched with a "validity indicator" oscillating between the colors: red (bad), yellow (correct), and green (good). The dynamic bar illustrates whether we stick to the set rules, such as the length of the title. This indicator updates automatically when filling out the title, so there's no need to refresh the web page.


These are the keywords that allow us to group the content. This is one of the integral elements of contemporary content creation. Thunder CMS treats this matter seriously and proposes a simple but complementary way to generate and add tags. The Tags field lets us choose the predefined tags and create new ones on the fly.

All the tags we defined are available here: /admin/structure/taxonomy/manage/tags/overview. Here we can edit, remove and add new ones.

Example of creating tags in Thunder CMS:


In addition to the name itself, tags may also contain additional, extensive information, thanks to using Paragraphs, which actions we present later in the article.

In this way, we can easily search for the prepared tag and add it to our article.


That's not all, though. If a tag is missing from the list, we don't have to leave the article editing window in order to add it. We just enter a new expression in the TAGS field, and the right tag will be created in the background.


Teaser text

This is an introductory text that aims to familiarize the user with the topic of our article. It usually displays at the very beginning of the content and is separated from the rest of the post. Teaser text is also used as a teaser on article testing web pages and when sharing the content within such channels as Facebook and Google.


Thunder CMS provides the ability to easily add and edit graphics.

First of all, we can add photo in two ways:

  • We choose a photo from among the files already added to the system. Filtering them by status and the ability to search by name helps here. It's also a good way to use the graphics prepared and processed earlier by a graphic designer, and add them to the system ​​for later convenient use of the ready files. This creates the opportunity to build our own media collection, which can be used many times in different ways, without having to fill up disk space with the same images.


  • We import photos. Here we can upload a photo from our computer.

However, the possibilities don't end with adding a photo. Each image can be described by using a number of fields, such as:

  • name: main name of the photo, by witch we’ll be able to search for it in the future,
  • tags: created exactly on the same principle as described above,
  • alternative text: photo description used by screen readers for blind people, and also important for the website's SEO,
  • title: title of our photo,
  • description: description of the photo and its content,
  • credits: author and source, if the image doesn’t belong to us,
  • expires: date indicating when the picture will no longer be valid - a field used for more complex cases, such as purchasing rights to a photo for a specific period.

An additional feature in Thunder CMS, invisible at first glance, is the ability to select a "point of focus" in the photo, symbolized by the cross icon. By clicking anywhere on the graphic, we can choose its most important point. This is used when framing and cropping the photo. By indicating this point, we can be sure that regardless of how the image is displayed, the most crucial element will always be visible.

Under the thumbnail image, we can also find a magnifier icon, which when clicked will show us how the photo will be displayed in various cases:


Paragraphs are a key functionality used to build an article. It's a system for creating content using separate blocks (paragraphs) that can be one of many types of content. All paragraphs - once added - we can freely edit and change their order, like laying "blocks" of various types. 

The basic paragraphs built into Thunder CMS, from which we may build an article, are:

1. Text

The fundamental tool for writing the content itself. With the support of the extremely popular CKEditor module it becomes an extensive editor that meets even complex requirements.

For more advanced users, it's also possible to edit content directly in the HTML code field:

2. Image

The option of adding and editing a photo that works on exactly the same principle as we described above in the TEASER section.

3. Gallery

It allows creating photo galleries. The process itself is very simple and similar to what was presented above in the image section. The only difference here is the ability to add many photos at once.

An example of adding a photo gallery in Thunder CMS:

The gallery created in this way will be displayed on the web page in the form of a slider, with the possibility to switch photos, as in the picture below:

4. Instagram

In this field, we can provide the URL of an Instagram post to embed on the website. Unfortunately, using this option requires additional work from us. For security reasons and due to the requirements arising from Meta's policy, authentication is necessary. We can do this by completing the configuration: /admin/config/media/instagram-settings.

It's required to create an appropriate account here to obtain the indicated data. We can find full configuration instructions on the official Facebook documentation web page.

5. Twitter

The field for embedding Twitter posts. Unlike Instagram, it works straight away and doesn't require any additional actions.

6. Pinterest

As with Twitter, in this field we embed a link to a Pinterest post.

7. Video

As with the photo editor, we have the ability to select a previously added movie from the media library or create a new video.

When adding a new video, we can also insert it using a link from portals such as YouTube, Vimeo, or Tiktok. Such a movie, depending on the selected source, is embedded on the web page with the appropriate player.

8. Link

This field lets us insert a link with an optional anchor text. It should be displayed as:

9. Quote

This option allows for creating a quote.

Note that we mentioned above only those paragraphs that are built directly into the Thunder distribution. They fulfill most of the basic needs arising from creating an article. However, the system itself doesn't limit us to using these options only.

For more advanced users or developers, Thunder CMS makes it possible to build custom paragraphs that meet any requirements. Thus, this tool in the right hands is extremely powerful, and the number of possibilities - is virtually unlimited.

Publication options

Another important element of any content creation tool is the ability to configure and manage the publication. Thunder CMS also provides us with extensive and adjustable functions here.

What catches our eye is the publication bar "fixed" to the bottom of the screen.

With its help, we're able to save or delete the article at any time, as well as change its status to one of the following:

  • draft: rough version, not visible to users,
  • unpublished: finished but unpublished article, not visible to users,
  • published: published article available to everyone.

Another vital element is the side menu for more complex operations.

Here we can find information about the date of the last saved version of the document, the possibility of creating a new revision during saving, or leaving information when making such a revision.

Let's stop for a moment to take a look at the concept of revision. What does it mean? Thunder, by default, provides versioning for every change in our article. Using the REVISIONS item in the menu, we are able to view all saved versions of our document:

It allows us to compare the differences between versions and restore previous versions.

This is a handy and simple solution ensuring that no changes will be lost, and in case of any mistake, it'll be easy to restore the last correct version of our website.

Among the available options of our sidebar, we can also find:

  • Meta tags: an extensive tool enabling customization of the default meta values of our website. A beneficial and comprehensive solution for SEO specialists.


  • Simple XML Sitemap: the configurations concerning the website regarding its existence within the sitemap. We can decide here whether the article is to be indexed and what priority it should have. And yes – Thunder includes an automatically generated XML sitemap by default.


  • URL alias: as we mentioned above, the alias of our website is automatically generated based on the SEO title, but to leave us complete freedom and configurability, Thunder’s creators also allow editing the alias from this position.


  • URL redirects: enables creating and managing the redirections on our website.


  • Scheduling options: an extremely useful option that allows scheduling the article publication. From here, we can also set the end date of the publication - this option can be helpful, for example, in the case of a sponsored article, which is to be displayed on our website only for a certain time period.


  • Authoring information: fully editable information about the author and the creation date of the article.


This concludes our adventure with the article creation window. It’s an essential part of Thunder CMS and the place where editors and content creators spend the most time. The comprehensive solution proposed by Thunder is one of the best on the market because it combines ease of use with the complexity of possibilities.

Additional functionalities

In addition to the core Thunder’s functionality, i.e. the editor, with which we spend most of our time, this system also has a number of other useful elements. We would like to present some of these and show you how to use them.

Mobile preview

The creators of Thunder are aware that we live in a world dominated by mobile devices. Therefore, they provide us with a content management system which allows us to check whether articles display properly on smartphones and tablets.

When logging in as an administrator, we can find a phone icon in the admin bar anywhere on the web page. Clicking it allows us to select the model of a mobile device for simulation. As a result, our website will go into mobile version inspection mode, visible only to us. It's a great and simple tool that enables finding any irregularities on our web page in the blink of an eye.


The name of this module already describes its use. Liveblog allows us to create dynamic, real-time changing articles. It's an ideal solution for reporting sports events or dynamically evolving crisis situations. There are many ways to use it, and we're sure that already while reading this paragraph, you'll come up with at least a few new ones.

Demo Content and Guided Tour

By installing these additional modules (they are already included with the system, we only need to turn them on), we get Thunder with basic configuration and sample content. This allows us to get used to the system faster and understand specific dependencies. All screenshots in this article come from Demo Content. In addition, the admin bar is enriched with the Tour icon, and after clicking it, we're guided through the possibilities and functionalities of Thunder. It's a great way to start the adventure with this system.

CMS Thunder for the Zawsze Pomorze news magazine

One of our projects created with Thunder is the website of the Pomeranian regional portal Zawsze Pomorze. The client wanted an easy-to-use, yet a sufficiently extensive system that would allow many journalists to work on several articles at the same time and to manage the publication efficiently.

The website includes an extensive category system, allows for leaving comments, creating "live" articles, and has a complex system of adding and editing sections for individual categories on the home page. The layout can be dynamically edited without any technical knowledge. The system also includes a window for supporting the authors with donations, visible directly on the article page.

Thunder CMS review – summary

From the developers’ perspective, we have to admit that working on projects using Thunder is extremely pleasant. The number of possibilities this tool provides out of the box meets most of the requirements. As programmers, we can create and develop CMS systems for media and publishers, focusing only on individual needs and solutions. This greatly shortens the development process and allows building even large-sized websites in a relatively short time.

From the publisher point of view, it's also a very decent system that meets many needs. It maintains the perfect balance between the number of possibilities and their simplicity of use - we are never overwhelmed with a large number of often redundant options. The reduced development time also allows investing in additional functionalities, as the very core on which Thunder is based is a robust and comprehensive solution.


Chromatic Insights: Why is Drupal 7's End-of-Life a Big Deal?

Planet Drupal - Thu, 2023/03/16 - 4:00pm
There has been quite a bit of talk about what it takes to upgrade to 'modern Drupal,' but less ink has been spilled painting a picture of what it will actually be like to still be responsible for a Drupal 7 site after that date.

Drupal Association blog: The Drupal Association Supports ICFOSS/Zyxware Back-to-work Programme

Planet Drupal - Thu, 2023/03/16 - 3:00pm

The Drupal Association is honored to be included in this month’s cycle of the Back-to-work Programme, an initiative by the International Centre for Free and Open Source Software in collaboration with Zyxware Technologies. Zyxware Technologies is one of our amazing Drupal Certified Partners, and we are excited to contribute to the success of this program for many cycles to come.

The Back-to-work Programme provides Drupal training to women professionals who have been on a career break due to various reasons. This program not only aims to induct them into the talent pool of Drupal developers but also provides an opportunity to reintroduce them to the Free Software community.

The Drupal Association is committed to ensuring that the Open Web thrives and to providing talent and education opportunities to communities who need them most. It is our hope that by supporting ICFOSS, Zyxware, and the Back-to-work Programme, we can continue to expand access to the Drupal community and professional opportunities in the Drupal ecosystem and empower women everywhere in their pursuit of professional equity.

Von R. Eaton, Director, Programs for the Drupal Association, will present to this current cohort on the work being done at the Drupal Association in Open Source, DEI, and talent cultivation on Thursday, 16 March.

We are so excited about this collaboration and are very grateful to have been invited to participate. We look forward to working with Zyxware and ICFOSS to make a positive impact on women in the Drupal community.


Jacob Rockowitz: Providing JSON:API and GraphQL support for the Blueprints module

Planet Drupal - Wed, 2023/03/15 - 5:56pm

The Blueprints module builds content models based on's specification for structured data. The generated content models are understandable, shareable, and reusable by people, machines, and search engines. To share these content models, we need to expose our data using an API. This post will explore reasonable recommendations for exposing our based content inside Drupal to decoupled front-ends and machines.

Currently, in the Drupal community there are two popular API specifications/web services implementations: JSON:API and GraphQL. JSON:API is included in Drupal core and GraphQL is built and maintained as a contributed module. To understand the current state of these different web services implementations, it helps to look back at the history of the decision to include JSON:API in Drupal core and why GraphQL is a contributed module.

In 2019, Dries Buytaert, Drupal's project lead, thoroughly compared REST vs JSON:API vs GraphQL. Dries summarizes the goal of the post.

Dries' conclusion led to the JSON:API module being added to Drupal core.

Philipp Melab, for Amazee Labs, wrote a thoughtful response re-examining the value of GraphQL even though it is not included in Drupal core.

One of Philipp's concerns about exposing Drupal data structure via JSON:API is that the API will contain a lot of Drupal'ism.

Philipp ends his response by stating.

The decision to include JSON:API into Drupal core is very sound. As a backend developer, I found...Read More


Security advisories: Drupal core - Moderately critical - Access bypass - SA-CORE-2023-004

Planet Drupal - Wed, 2023/03/15 - 5:26pm
Project: Drupal coreDate: 2023-March-15Security risk: Moderately critical 14∕25 AC:Complex/A:Admin/CI:All/II:All/E:Theoretical/TD:UncommonVulnerability: Access bypassAffected versions: <7.95 || >=8.0.0 <9.4.12 || >=9.5.0 <9.5.5 || >=10.0.0 <10.0.5Description: 

Drupal core provides a page that outputs the markup from phpinfo() to assist with diagnosing PHP configuration.

If an attacker was able to achieve an XSS exploit against a privileged user, they may be able to use the phpinfo page to access sensitive information that could be used to escalate the attack.

This vulnerability is mitigated by the fact that a successful XSS exploit is required in order to exploit it.


Install the latest version:

All versions of Drupal 9 prior to 9.4.x are end-of-life and do not receive security coverage. Note that Drupal 8 has reached its end of life.

Reported By: Fixed By: 

Security advisories: Drupal core - Moderately critical - Information Disclosure - SA-CORE-2023-003

Planet Drupal - Wed, 2023/03/15 - 5:24pm
Project: Drupal coreDate: 2023-March-15Security risk: Moderately critical 13∕25 AC:None/A:None/CI:Some/II:None/E:Theoretical/TD:UncommonVulnerability: Information DisclosureAffected versions: >=8.0.0 <9.4.12 || >=9.5.0 <9.5.5 || >=10.0.0 <10.0.5Description: 

The language module provides a Language switcher block which can be placed to provide links to quickly switch between different languages.

The URL of unpublished translations may be disclosed. When used in conjunction with a module like Pathauto, this may reveal the title of unpublished content.

This advisory is not covered by Drupal Steward.


Install the latest version:

All versions of Drupal 9 prior to 9.4.x are end-of-life and do not receive security coverage. Note that Drupal 8 has reached its end of life.

Drupal 7 core does not include the Language module and therefore is not affected. The contributed modules for translation do not have the same code for language-switching links, so they are not affected, either.

Reported By: Fixed By: 

Security advisories: Drupal core - Moderately critical - Information Disclosure - SA-CORE-2023-002

Planet Drupal - Wed, 2023/03/15 - 5:21pm
Project: Drupal coreDate: 2023-March-15Security risk: Moderately critical 14∕25 AC:None/A:None/CI:Some/II:None/E:Theoretical/TD:DefaultVulnerability: Information DisclosureAffected versions: >=8.0.0 <9.4.12 || >=9.5.0 <9.5.5 || >=10.0.0 <10.0.5Description: 

The Media module does not properly check entity access in some circumstances. This may result in users seeing thumbnails of media items they do not have access to, including for private files.

This release was coordinated with SA-CONTRIB-2023-010.

This advisory is not covered by Drupal Steward.


Install the latest version:

All versions of Drupal 9 prior to 9.4.x are end-of-life and do not receive security coverage. Note that Drupal 8 has reached its end of life.

Drupal 7 core does not include the Media Library module and therefore is not affected.

Reported By: Fixed By: