Planet Drupal

With some recent security advisories for Cross Site Scripting (XSS), it feels like an opportune time to remind those who author Twig templates for Drupal:
If you're using Twig's |raw filter, you're probably doing it wrong
 

by lee.rowlands / 7 September 2026Background

Let's cast our minds back to Drupal 7. A time before twig. We had .tpl.php templates with PHP template as the default templating engine. Every variable available in your template had to be carefully sanitized before being printed to avoid XSS.

This meant remembering to call check_plain or check_markup in preprocessing hooks on every variable.

Not surprisingly security advisories for Cross Site Scripting (XSS) were the the number one vector in Drupal contrib security advisories for Drupal 7 and below.

The release of Drupal 8 saw the adoption of Twig as the default templating engine. With auto-escaping by default, Twig promised to provide enhanced security against XSS vectors. No more needing to remember to call check_plain or check_markup - any variable available to Twig was escaped on output!

Using raw bypasses Twig's protection

Which brings us to using the |raw filter. When you use it you're saying to Twig - actually, don't auto-escape this variable, I know better.

But there are very few cases where this is the correct approach.

And in reaching for |raw you're most likely opening an XSS vector.

What to use instead

If you're looking at a template and you're finding that a variable is being double-escaped. E.g. instead of Mathematics & Data Science you're seeing Mathematics & Data Science you might be tempted to reach for raw to fix it.

Read more

Rebuilding a data-driven Drupal site: Page templates with Layout Builder

In the previous post in this series, I described how we migrated existing page elements from Panels to Layout Builder.

Pages on this site are assembled from configurable page elements implemented as block plugins. These elements display data managed by an external system. Drupal stores their arrangement and configuration, but not the underlying data.

berliner Sun, 09/06/2026 - 21:59

Tags

• layout builder
• frontend editing
• architecture
• config

Drupal 11 is on 36% of reporting Drupal sites — and climbing at roughly half the speed Drupal 10 managed at the same age. On 9 December 2026 Drupal 10 reaches end of life, and the share of the Drupal web running unsupported code nearly triples overnight. The live numbers, the method, and what the curve actually says. Updated quarterly.

Author: Will Huggins

Imagine asking an AI assistant:

"Show me waterproof jackets under £150, in size M, available for delivery tomorrow".

Today, the assistant might search the web, read several retail websites and summarise what it finds. But what if, instead of reading pages, the agent could ask retailers directly which products matched those requirements?

With that information, you could fast-track your shopping journey and ask:

"Add [my chosen product] to my basket"

The important change here isn't the chatbot; it’s what sits behind it. A traditional website can tell an AI agent what products it has and provide the details. Tomorrow’s website will give the agent a controlled way to buy it.

That is the shift from publishing pages to publishing capabilities. It fundamentally changes what we expect a CMS to do.

Ever since the early days of the internet, content management systems have had a fairly straightforward job: someone creates a piece of content, the CMS publishes it as a page, a person finds that page, and then reads it and decides what to do next.

Over time, CMS capabilities developed around improved findability of content and the experience humans have when they land on a page. AI agents are now changing that equation, introducing a different type of interaction that moves beyond pages altogether, in search of capabilities that solve a problem rather than pages to read.

Read more

Someone told me this week, correctly, that ClaudeBot and GPTBot respect robots.txt, so there is no need to block them by other means, and that the really bad bots disguise as Chrome anyway, so a user-agent is useless; watch behaviour, get a WAF. Every fact in that is right and the conclusion is still wrong, and the gap between the two is the story of why the old ways of guarding a Drupal or Backdrop site have quietly stopped working. Not one of the seven stock robots.txt files a Drupal or Backdrop site ships names a single AI agent, and on a core past its end of life that file will never change again; one vendor honours your notice for its crawler and waives it for its assistant in the same document; a hand-kept blocklist goes stale in a month, and a WAF only ever refuses what someone already knew how to describe. What holds is a server which says no cheaply for what it can recognise, and judges the rest by what it does today.

DrupalClaw pushes AI assistance beyond code suggestions into setup, debugging, database work, and repeatable Drupal operations. Paulo Maia Carvalho’s testing also shows where that delegation can fail and why version context, approval gates, and human review still matter.

The 52-step checklist tells you what to do. This is the calendar those steps actually run against — a realistic 90-day plan broken into three phases, with the milestones that decide whether you finish on time and the resourcing map showing who's busy when.

Today we are talking about Drupal Performance, Rapid Development, and Drupal Canvas Maturity with our hosts. We'll also cover Microsoft 365 FullCalendar as our module of the week.

For show notes visit: https://www.talkingDrupal.com/568

Topics

• Deprecating Module Theme Files
• Migrating Hooks to Classes
• Why This Change Matters
• Drupal Performance Gains
• Performance Audits and Lighthouse
• Automating Checks and Spreadsheet Rant
• AI Spreadsheet Cautionary Tale
• Privacy Concerns with AI
• Freelancer Pressure
• Rapid Change Reality
• Canvas Release Risks
• Community Support Needed
• AI For Documentation
• Canvas Production Readiness
• Canvas Architecture Debate
• AI For Voting Research
• LLM Bias And Sources

Resources

• Rebrickable
• Webpagetest
• Lighthouse
• Tugboat
• Drupal canvas

Guests

Martin Anderson-Clutz - mandclu.com mandclu

Read more

The phpstan-drupal playground exists to reproduce bugs. You paste PHP, run PHPStan with phpstan-drupal against a real Drupal core install, and share the result link in an issue.

It never quite worked right, and I never got around to fixing it. The bugs were small, individually boring, and always someone else's turn on my list. What finally cleared them was working through them with an agent, which is also how the rest of this post happened. The workflow still assumed a person in a browser. Now it works for an agent too.

Two things I wanted:

Author: Martin Anderson-Clutz. Originally posted on The Acquia Blog.

Two GovCon keynotes came at disruption from opposite ends. Read them together and you get a map of the moment Drupal is in.

Earlier this month, I spent some time at Drupal GovCon, and a striking element was how well the two keynotes fit together. They were pitched under the same banner — "Building Through Disruption" — but they came at it from opposite ends. Mike Madison talked about how disruption can be something you do, on purpose, to make your team better. Kerry Greer reminded us that disruption is also something that happens to people, and that holding a team together through it is real work that rarely shows up on a ticket. Put those two talks side by side and you get something close to a complete picture: the courage to lead change, and the care to make sure nobody gets left behind while you do it.

I want to walk through both, because I think the Drupal community needs both right now.

Mike Madison: disruption is a verb

Mike (a former Acquian, now Senior Director of Global Web at Zscaler) has spent much of his career being paid, in his words, to "professionally disrupt organizations." His whole framing was a permission slip. When we talk about disruption in business we tend to reach for the giants: Netflix, Airbnb, Uber. And that framing is paralyzing, because none of us is going to reinvent a multibillion-dollar industry over lunch. So Mike flipped it. Think small. Disruption, boiled down, is just "replacing an old way of doing something," and every person in the room already has the standing to do that on their own team.

Every person in this room has the ability to go and disrupt your team or your organization in a meaningful way — and you can do that without pissing everybody on your team off, if you do it right.

Read more

Beyond Table-Based Nightmares: A Technical Deep Dive into Drupal's MJML Render Engine admin Thu, 09/03/2026 - 17:12 The Legacy Email Problem: Broken Layouts and Fragile Twig Templates

Within modern web development, generating layouts has transitioned into an era of clean, semantic structures powered by CSS Grid and Flexbox. However, the world of HTML email design remains anchored to late-1990s markup methodologies. This structural regression is driven by the vast rendering discrepancies across various email clients.

While web browsers adhere closely to standardized layout engines, email clients parse markup through vastly different systems. For instance, desktop applications of Microsoft Outlook rely on the Microsoft Word rendering engine, which strips away essential styling rules, including margins, padding, flexbox properties, and media queries. Consequently, developers are forced to design emails using highly nested table structures, inline styles, and obscure conditional HTML elements to ensure layouts do not break upon delivery.

Somewhere out there a vanilla Ægir server is still quietly serving its Drupal sites, years after the person who set it up moved on. The aegir2boa toolset gives these classic estates a supported road into BOA: a read-only preflight which grades your box, an in-place Apache to Nginx flip proven on a scratch port before any handover, and a remote adoption which pauses, dumps, ships and registers each site while the old box becomes a small proxy where putting a site back is one file move. Every acting verb rehearses first, one clean rehearsal buys exactly one live run, and until DNS moves there is a drilled way back from every step; drilled meaning drilled: four full runs on throwaway boxes, an HTTPS estate with a composer platform, a mixed Drupal 6 and 7 estate, an Ubuntu source carried into Percona 8.4, then all of it again into both database generations, on the very tool bytes you would download. Free and open source, and it never asks for root database access on the box it is rescuing.

A weekend fix built for The DropTimes now supports sites its maintainer may never see, bringing the responsibilities of public module maintenance into focus.

A perfectly completed ticket can still solve the wrong problem. Tom Hollevoet argues that better Drupal delivery begins with understanding the need behind the request.

The Drupal Business Survey investigates the trends in the digital market, in particular from service providers involved with the open source Drupal CMS and enterprise platform. Digital agencies from all over the world participate in the yearly survey and the business insights on market share and growth opportunities gained are shared with those who’ve submitted responses. 

Begun many years ago by Drupal Business Network with Janne Kalliola, Michel Van Velde, and Imre Gmelig Meijling, the survey is now administered by the Drupal Association to promote global reach and protect the confidentiality of the information. Moving forward, the Drupal Association will handle the analysis and reporting of the anonymised data from the survey. We're grateful to Janne, Michel, and Imre for their many years of work in shaping and running the survey.

Drupal’s open source ecosystem is supported by a strong community of tens of thousands professionals worldwide, working together on the popular digital experience platform. Because Drupal is open source, anyone can work with Drupal or make changes to it. An important part of this community are the agencies that provide Drupal services to end users and drive Drupal’s market. The Drupal Business Survey seeks the input from these agencies so that meaningful data for business owners and decision makers can be built into their business strategies. 

The Drupal Business Survey has been a valuable guide for digital service providers, even to those working with other technologies than Drupal.

Take the survey here!

Read more

DDEV v1.25.4 is here: 142 PRs from the entire DDEV community. Your suggestions, bug reports, code, and financial support made it possible.

The theme of this release is doing less by hand. A new project can start with a "seed" database you already have, and image and environment customizations can be set globally instead of in every project.

:::note[Linux and WSL2: new package repositories] DDEV's apt and rpm packages are now published to Cloudsmith at packages.ddev.com. Gemfury (pkg.ddev.com) keeps working, so switch over whenever it suits you by re-running the Linux installation steps.

Package repository hosting is graciously provided by Cloudsmith. :::

Table of Contents Database Seeding and Reset

Until now, a fresh project always started with an empty database, and getting your data back in there meant importing a dump or snapshot every time. DDEV can now automatically use a snapshot, which is far quicker than importing a SQL file.

Read more

Missing image alt attributes cost accessibility and SEO points

Empty alt attributes are an accessibility and SEO killer, and the cost is measurable. Google Lighthouse flags the error on both of its audits: up to 6 points subtracted from the Accessibility score and 8 points from the SEO score.

The impact on real users is worse than the score. A screen reader completely ignores an image with no alt text, so blind users never know the image was there, which makes the experience disruptive and confusing. It also violates WCAG Success Criterion 1.1.1: Non-text Content, the baseline requirement for accessible non-text content.

That is why we had to act when a migration project resulted in thousands of images without an alt attribute.

A Drupal migration left 12,000 images without proper alt text

A Drupal 9 to Drupal 11 migration for a multilingual sports news project surfaced around 12,000 images with missing or incorrect alt attributes, found via Screaming Frog tool. Some images had no alt attribute at all, while others had alt text in the wrong language, with English alt text appearing on the /es version of the site.

The obvious next step was to look for a pattern. Was the issue tied to a specific content type, such as Articles? Was the wrong-language text caused by untranslated Media content? Answering these questions turned out to be surprisingly hard: Drupal provides no default mechanism, no view…

AI traffic is not one thing, and a policy which treats it as one thing gets the answer wrong in both directions. Here the decision is written down, class by class: the crawlers which harvest sites to train models are turned away at the edge before a single line of Drupal or Backdrop runs, while AI search indexers, and the fetch a real person triggers by asking an assistant, stay open and rate-limited per vendor, not per address, because one prompt fans out across dozens of addresses. Every layer ships with the platform and runs on your own server; nothing is rented, and no rule lives somewhere you have no login for. Changing it for one site is one line in a file you own, live in about two minutes, deleted to restore the defaults; and your own policy goes out at /llms.txt straight from the site's files folder. The honest part is the best part: a user-agent can be forged, the maps fail open on purpose, and the docs say where each shield stops and the next one begins.

Who Owns the Icon? Building Author-Friendly Icon Systems in Drupal Joel Steidl Tue, 09/01/2026 - 11:34 Drupal

Icons seem like a small implementation detail until a site has a large design system, multiple authoring workflows, and content that changes independently of the theme.

Then a basic question becomes important: who owns the icon?

For some parts of an interface, the answer is clearly the theme. Alert states, event metadata, and other stable UI patterns should remain predictable.

Other icons behave more like content. Authors may need to choose an icon for a navigation item, card, banner, or other component. In those cases, hardcoding the choice in the theme creates a dependency between content and code that becomes difficult to maintain.

The goal is not to move every icon into Drupal. It is to give the right people control over the right decisions.

Start with ownership

I generally think about icons in two groups: icons whose meaning belongs to a fixed interface pattern, and icons whose meaning belongs to authored content.

An alert is a good example of the first group. Drupal or an author might determine that an alert has a warning status, but the theme should decide which icon represents “warning.”

Event metadata works the same way. Date, time, and location have stable meanings within an event teaser. Those icons belong to the component, not to an individual event.

Hardcoding those relationships protects consistency.

Read more

Rebuilding a data-driven Drupal site: Migrating page element configuration from Panels to Layout Builder

In the previous post in this series, I described how we rebuilt our ctools page elements as block plugins.

That gave us the new implementations, but not the pages that had already been assembled in Drupal 7. Recreating them manually would have taken a long time and risked losing existing configuration along the way.

We did not want to migrate complete Panels displays. The rebuilt site had its own Layout Builder sections and layouts. We wanted to preserve the page elements, their order and as much of their configuration as the new block plugins could still use.

berliner Tue, 09/01/2026 - 17:39

Tags

• layout builder
• blocks
• plugins
• config
• migrations