Drupal 7.11 and 6.23, maintenance releases which fix security vulnerabilities are now available for download.

Drupal 7.12 and 6.24 also fix other issues reported through the bug tracking system.

Upgrading your existing Drupal 7 and 6 sites is strongly recommended. There are no new features in these releases. For more information about the Drupal 7.x release series, consult the Drupal 7.0 release announcement, more information on the 6.x releases can be found in the Drupal 6.0 release announcement. Drupal 5 is no longer maintained, upgrading to Drupal 6 is recommended.

Changelog

Drupal 7.11 only includes fixes for security issues. Drupal 7.12 also includes bugfixes. The full list of changes between the 7.10 and 7.12 releases can be found by reading the 7.12 release notes. A complete list of all bug fixes in the stable 7.x branch can be found in the git commit log.

Drupal 6.23 only includes fixes for security issues. Drupal 6.24 also includes bugfixes. The full list of changes between the 6.22 and 6.24 releases can be found by reading the 6.24 release notes. A complete list of all bug fixes in the stable 6.x branch can be found at git commit log.

Security vulnerabilities

Drupal 7.11 and 6.23 were released in response to the discovery of security vulnerabilities. Details can be found in the official security advisory:

• SA-CORE-2012-001

To fix the security problem, please upgrade Drupal.

What is included with each release?

We made two versions of both Drupal 7 and 6 available, so you can choose to only include security fixes (Drupal 7.11 and 6.23 respectively) or security fixes and bugfixes (Drupal 7.12 and 6.24). You can choose your preferred version. We are trying to make it easier and quicker to roll out security updates by making security-only releases available as well as ones with bugfixes included. We hope this helps you roll out the fixes as soon as possible. Read more details in the handbook.

Update notes

The default.settings.php file was changed in Drupal 7.12, to add documentation about PDO attribute override capabilities that were added as a result of #1309278: Make PDO connection options configurable.

The robots.txt file was changed in Drupal 6.24 to block filter tips from search engines. The .htaccess and (default.)settings.php files were not changed in Drupal 6. Additionally, indexes were added to the node_comment_statistics and comment tables, for performance.

Known issues #

Drupal 7

Bug fixes in 7.12 release cause problems with the Internationalization (i18n) module. Users of these modules are encouraged to update to 7.11 to get the security fixes, and hold off on the 7.12 upgrade until the 7.x-1.4 release.

Drupal 7.12 is also only compatible with Menu Block 7.x-2.3 and higher.

Drupal 6

In Drupal 6.24, if you have the contributed user_delete module enabled on your site, the update will fail with a Cannot redeclare user_delete_access() error. An update of user_delete module is being worked on.

In Drupal 6.24 if you had locale module enabled earlier, but it is not currently turned on, the update will fail with Call to undefined function locale_inc_callback(). A fix is being worked on for Drupal core.

In Drupal 6.24 if you run your updates with Drush, you might experience duplicate entry errors in your system table. See the ongoing discussion at http://drupal.org/node/1425868

Jess (Drupal.org username xjm) is a Drupal developer, core contributor, module maintainer, and mentor, and just plain all-around awesome! She is a web developer for the University of Wisconsin’s Department of Family Medicine. She also volunteers at the University of Wisconsin-Madison Arboretum.

Jess has made many contributions to Drupal, including roles as:

• maintainer of the Taxonomy Access Control and Taxonomy Lineage modules, among others.
• co-maintainer of the Taxonomy module in Drupal core.
• active participant in the API documentation clean-up sprint happening in Drupal 8, as well as efforts to clean up the entity system.
• co-lead of the Clean Up Core community initaitive.
• friendly and knowledgeable mentor to new contributors.
• organizer of the twice-weekly core office hours to help get new core contributors involved.
• inventor of the Issue summary initiative to give new contributors something very valuable but approachable as their first core contribution: reading through and summarizing long, difficult issues to help speed along their review and commit.

Sites she’s built with Drupal include the UW Department of Family Medicine’s public and intranet websites, an organizational knowledge base, and various small sites.

Jess attended her first DrupalCon in Chicago, and is coming to DrupalCon Denver as well, where she is planning to run an in-person core office hours sprint!

We asked Jess a few questions:

Tell us a bit about yourself! What is your background, or things that interest you outside Drupal?

I love the outdoors. I often bike 30 miles a day in the summer (that’s 50 km for those of you using reasonable systems of measurement). I camp, hike, and do ecological restoration, and I probably can identify more plant species than you. I also have other crunchy pastimes like gardening, cooking, and making candles. (I have not yet attempted to weave my own yogurt.)

I read a ridiculous number of books, and I speak bits of five foreign-to-me languages (though I can only carry on a conversation of any substance in French). I think General Relativity is awesome and I love mathematics and statistics.

I’m also a nerd. You probably got that already.

How and why did you start contributing to Drupal core?

I opened the 7.x-1.x branch of TAC with no knowledge of Drupal 7. 80% of TAC’s upgrade from D6 was straightforward, but then I crashed headlong into the Field API and D7’s entity form handling. I started asking a lot of questions, and catch was incredibly patient and helpful. I connected with someone in IRC who had a similar issue with entity forms, and we came to the conclusion that we needed a hook_field_widget_form_alter(), which did not yet exist in the API. We posted an issue for that, and before I’d finished my lunch, sun had written a patch for it.

Around then two things happened. First, the issue summary functionality was deployed on Drupal.org, and I saw a way that I could actually do something useful in the core queue in exchange for all the help I was getting. My hope was that issue summaries would widen the “review bottleneck” by saving reviewers and core committers time. I started writing an issue summary every day for major and critical core issues. Every summary I wrote also taught me something about Drupal.

A few days later, chx asked in IRC for someone to reroll a patch with a couple of minor fixes. I thought, hey, I can do that, and it ended up being my first core commit credit. For chx, who has written more of core than pretty much anyone, it would have been a triviality, but for me, it was the realization that I was actually capable of contributing, at least in a small way. That opened a door for me.

In the process of writing my once-a-day issue summaries, I came across some issues in subject areas I already understood well, so I worked on the patches as well as the summaries. Then I learned how to write automated tests for TAC, and consequently I was able to start contributing automated tests for core as well. The more issues I worked on, the more I understood, and the more I could do. Kind of an avalanche set off by a pebble, by the fact that people like catch and sun and chx took the time to be supportive and encouraging. So that’s why I have my Drupal.org profile tagged with “full frontal nicety” (cr. webchick). Be nice. Go out of your way to be helpful and kind, because it can make all the difference to a budding contributor.

Can you explain some of the benefits of getting involved with the community and what you get out of it?

The best part is having co-ownership in the software that I use every day in my job. Being able to help resolve problems I encounter is very empowering, as is knowing where I can turn when I get stumped by something. It’s also wonderful to collaborate with talented, engaging people from all over the world.

Now, if I were talking to my boss (hi Justin!), I’d emphasize that being actively involved in the project is good business strategy:

• Filing and participating in issues helps resolve real, production problems for our sites in maintainable ways.
• Contributing code back to the community means that there are thousands of other sites to help debug and test that code.
• Participating in discussions about Drupal core and contributed projects helps us make informed decisions.

What motivates you to help out others to get involved?

Two things:

1. For years, I was active in contributed module queues, but terrified of core. It took meeting a couple of friendly Acquianauts at DrupalCon Chicago to show me that core developers were actually completely approachable human beings. So I’d like to extend that same realization to everyone else who might be in the same place I was.
2. Drupal 7’s fantastic success also means that there are a lot more people using Drupal and filing issues. There’s also a chronic shortage of experienced patch reviewers, which means issues that could well be fixed by an existing patch get stuck and languish. We as a community need to invest in connecting new contributors with the work they can do now.

What’s your advice to new would-be contributors?

1. Join Drupal IRC channels. Lurk in #drupal-contribute.
2. Check out core office hours or the Novice queue.
3. Try your hand at contributing an issue summary. If you take the time to carefully read and understand an issue, you’ll likely learn a lot about a particular topic, and also get a feel for how the community resolves issues and makes decisions.
4. Code is not the only way to contribute–not even for core. (Just today, a self-proclaimed “not a PHP nerd” unblocked a 4+ year old core issue by doing manual testing.)
5. When someone gives you feedback, embrace it! If code is your thing, learn to love the patch reviews you get. Even if all someone says is that a code comment is unclear, they’re helping your patch move forward.
6. Pay attention to the feedback that experienced contributors give others, as well. You can learn a lot by watching what reviewers look for.
7. Above all, be patient and don’t get discouraged! Sometimes it can take a long time and a lot of iterations for issues to be resolved. And, if you are unsure about anything, ask the nice folks in IRC.

What do you do with Drupal these days?

Well, it looks like I’m finally going to get to upgrade my department’s sites to D7, which is a huge relief. I’m looking forward to experimenting with responsive frontend design and all the cool stuff I missed out on during a decade of supporting pixel-perfect IE6. (We finally decided to drop support this year.)

How did you get started in Drupal? What were your stumbling blocks, and what were the moments that things started to click?

The full version of that story requires a couple drinks, or possibly a therapist. However, I’ll say that cowboy-coding a CMS with 2-3 others back in 2003 taught me the comparative value of open source projects, and that I picked Drupal for a client in 2006 primarily because the Drupal community seemed to be active and thriving.

The thing that stumped me the most in those first few months with Drupal 4.7 was probably access control; I spent weeks of testing and hacking trying to implement the permission scheme I wanted. (I installed TAC very briefly in D4.7… and uninstalled it as fast as I possibly could. I’m not sure if it’s irony or fate that led to me maintaining it.) A few turning points for me were learning firsthand the bad things that could happen if I hacked core; the release of the Zen theme, which brightened my relationship with Drupal’s frontend considerably; and my discovery of hook_nodeapi() and hook_form_alter(). Oh, and when I got over the idea that “I was a developer and knew how to write SQL” and realized that Views was pretty powerful.

What’s your favorite restaurant in Madison?

That might be the toughest question here, because we have a lot of amazing restaurants! In this context, I think the honor must go to Bradbury’s, where I’ve written a whole lot of code, issue summaries, and so on; not to mention papers on topics ranging from the ecological history of Cherokee Marsh to the sociolinguistics of the distinction between Hindi and Urdu. (This is what happens when you go to college for over a decade.) Bradbury’s has the best coffee in town, plus a rotating, seasonal menu of sweet and savory crêpes featuring local produce.

What would Linnaeus do?

Well, I’d love it if he could help me out with the Cyperaceae. If you think Drupal can be confusing, try identifying sedges sometime.

Anything else to add?

t5”””””””’/
(This last contribution is from my cat Auri, who wisely considers my laptop to be her primary competitor for my attention.)

Know of anyone else doing awesome things in the community? Nominate them for Community Spotlight!

Drupal 7.10, a maintenance release with numerous bug fixes (no security fixes) is now available for download. Several major bugs, including one causing errors with the 5.x branch of Drush, have been fixed this release. See the Drupal 7.10 release notes for a full listing.

Upgrading your existing Drupal 7 sites is strongly recommended. There are no new features in these releases. For more information about the Drupal 7.x release series, consult the Drupal 7.0 release announcement.

Changelog

Drupal 7.10 is mainly a bug fix release. The full list of changes between the 7.9 and 7.10 releases can be found by reading the 7.10 release notes. A complete list of all bug fixes in the stable 7.x branch can be found in the git commit log.

Update notes

- None at this time.

Known issues

- None at this time.

Drupal 7.8, a maintenance release with numerous bug fixes (no security fixes) is now available for download. A critical bug with the upgrade path, #1164852: Inconsistencies in field language handling has been addressed in this release, among other critical and major bugs. See the Drupal 7.8 release notes for a full listing.

Upgrading your existing Drupal 7 sites is strongly recommended. There are no new features in these releases. For more information about the Drupal 7.x release series, consult the Drupal 7.0 release announcement.

Changelog

Drupal 7.8 is a bug fix only release. The full list of changes between the 7.7 and 7.8 releases can be found by reading the 7.8 release notes. A complete list of all bug fixes in the stable 7.x branch can be found in the git commit log.

Update notes

Addresses critical upgrade path issue #1164852: Inconsistencies in field language handling. The 7.8 release notes have more information for site builders who hit this issue in Drupal 7.7.

Known issues

Due to stricter error handling in Drupal 7.8 around entities, users of the Media module are experiencing EntityMalformedException errors. A workaround is posted at http://drupal.org/node/1266620#comment-4941950 and engineers are actively working on a new release.

Denver, CO is hosting the next North American DrupalCon happening on March 19-23, 2012 at the massive, well-appointed Colorado Convention Center. The worldwide Drupal Community is what makes DrupalCon so fun and exciting, and Colorado’s community is thrilled to be the home of “Drupal Elevated” — tickets go on sale soon, so be sure to follow us on twitter and we’ll tell you what’s going on, @drupalcondenver.

DrupalCon is a world-class conference with a world-wide audience. If you or your organization actively use Drupal, or even if you never have but want to learn, DrupalCon is your chance to engage the community, learn from others, and share your experiences.

DrupalCon Denver is now accepting session submissions — go to http://denver2012.drupal.org/ to submit your idea today! If you want to present in Denver, now is the time to start thinking about what this year’s theme, “Collaborative Publishing for Every Device,” means to you, and we’re accepting sessions in the following tracks:

• Site building
• Coding and development
• Design and user experience
• Drupal community
• Business and strategy
• Mobile
• Commerce
• Nonprofit, Government and Education

Read descriptions of each track at http://denver2012.drupal.org/about

Sponsoring DrupalCon is a great way to get your message before a targeted audience of Drupal users, developers, businesspeople, and other Web professionals. And, you earn karma points because your investment helps make DrupalCon passes affordable so more community members can attend.

Sponsor packages provide various levels of lead generation, branding, networking and recruitment opportunities. Contact megan@association.drupal.org with questions or go to http://denver2012.drupal.org/

Follow Drupalcon Denver on Twitter @drupalcondenver, to stay informed on the latest details!

Drupal core needs more eyes and more contributors to decrease the very high amount of unresolved issues.

We hold the first core “office hours” each week in #drupal on freenode:

• Tuesday, 04:00 – 06:00 UTC (convert this to my timezone)
• Wednesday, 16:00 – 18:00 UTC (convert this to my timezone)

Why office hours?

There are currently a large number of unresolved issues in the core queue, and we want to get more organised dealing with the backlog, and encourage new people to help out.

Current numbers:

• Over 2200 open bug reports against Drupal 8 and 7.
• Over 1750 open bug reports against Drupal 6.
• Over 500 patches needing review for Drupal 8 and 7.
• Nearly 200 bug reports against Drupal 6/7/8 have 0 replies.

How will office hours help?

If you’ve been wanting to get involved in Drupal core development, but aren’t sure where to start, coming to the office hours. You will find experienced contributors who will help you find something to work on.

If you have patches or bug reports against Drupal core, and want to get your patch reviewed or figure out where to take the issue next, this should be a good time of the week to trade reviews on IRC.

Things we will do

Office hours are for both experienced contributors and developers as well as newcomers, expect some of the following:

• Triaging the core queue – understanding status, priority of issues, closing duplicates etc.
• Co-writing issue summaries.
• Co-writing change notifications for needs work issues tagged with “Needs change notification”.
• Writing SimpleTests for bug reports that don’t have them.
• Swapping patch reviews.

New contributors should already be prepared to do the following:

• Have a local environment to review and test core patches.
• Get familiar with the documentation at http://drupal.org/patch

Mentors/co-ordinators possibly available

We’ll try to make sure at least one person is online during each slot.

catch
sun
linclark
Dave Reid
marcingy
cweagans
xjm
beejeebus

See you there!

See the original proposal for more discussion, and to volunteer for helping out with office hours on a regular basis. Comments have been disabled on this post to keep discussion in one place.

Drupal 7.5, a maintenance release which fixes security vulnerabilities is now available for download. Drupal 7.6 7.7 also fixes other issues reported through the bug tracking system.

Note: Drupal 7.7 is just Drupal 7.6 with a fixed VERSION string (7.6 was reporting itself as 7.5). No other changes.

Upgrading your existing Drupal 7 sites is strongly recommended. There are no new features in these releases. For more information about the Drupal 7.x release series, consult the Drupal 7.0 release announcement.

Changelog

Drupal 7.5 only includes fixes for security issues. Drupal 7.6 also includes bugfixes. The full list of changes between the 7.4 and 7.7 releases can be found by reading the 7.6 release notes. A complete list of all bug fixes in the stable 7.x branch can be found in the git commit log.

Security vulnerabilities

Drupal 7.5 was released in response to the discovery of security vulnerabilities. Details can be found in the official security advisory:

• SA-CORE-2011-003

To fix the security problem, please upgrade Drupal.

What is included with each release?

We make two versions of Drupal core available, so you can choose to only include security fixes (Drupal 7.5) or security fixes and bugfixes (Drupal 7.7). You can choose your preferred version. We are trying to make it easier and quicker to roll out security updates by making security-only releases available as well as ones with bugfixes included. We hope this helps you roll out the fixes as soon as possible. Read more details in the handbook.

Update notes

• (#634616) AJAX now responds to ‘click’ instead of ‘mousedown’. Testing was performed to make sure this doesn’t affect major contributed modules, but could cause issues.
• (#1164852) The ‘translatable’ flag on fields added via the UI now defaults to FALSE, same as fields added via the API do. Contrib modules such as Entity Translation can allow toggling this back for sites that need it. An upgrade path will be included in a future release to bring all legacy fields into compliance.
• (#1083982) Remote streamwrappers are now supported, because of fixes to where drupal_realpath() is called.

Known issues

Drupal 7.6 and 7.7 introduced an issue in node data migration in the Drupal 6 upgrade path for foreign language sites that migrates node bodies as untranslatable but assigns language to the data which makes nodes appear in an unsupported state. If you are looking to upgrade a foreign language Drupal 6 site, use Drupal 7.5 for now, and track progress on the issue at http://drupal.org/node/1164852#comment-4807524

Drupal 7.3, a maintenance release which fixes security vulnerabilities is now available for download.

Drupal 7.4 also fixes other issues reported through the bug tracking system.

Upgrading your existing Drupal 7 sites is strongly recommended. There are no new features in these releases. For more information about the Drupal 7.x release series, consult the Drupal 7.0 release announcement.

Changelog

Drupal 7.3 only includes fixes for security issues. Drupal 7.4 also includes bugfixes. The full list of changes between the 7.2 and 7.4 releases can be found by reading the 7.4 release notes. A complete list of all bug fixes in the stable 7.x branch can be found in the git commit log.

Security vulnerabilities

Drupal 7.3 was released in response to the discovery of security vulnerabilities. Details can be found in the official security advisory:

• SA-CORE-2011-002

To fix the security problem, please upgrade Drupal.

What is included with each release?

We make two versions of Drupal core available, so you can choose to only include security fixes (Drupal 7.3) or security fixes and bugfixes (Drupal 7.4). You can choose your preferred version. We are trying to make it easier and quicker to roll out security updates by making security-only releases available as well as ones with bugfixes included. We hope this helps you roll out the fixes as soon as possible. Read more details in the handbook.

Update notes

The robots.txt file was changed in Drupal 7 to disallow crawlers from the filter tips pages.

Known issues

#1204648: Tests added for SA-2011-CORE-002 broke testbot causes node access tests to fail, for people running the full core test suite in the Testing module. Fixed in 7.x-dev, and will be included in the 7.5 release.

From May 17 – 19, 2011, in advance of DrupalCamp Twin Cities, several Drupal community members met at the University of Minnesota usability lab in Minneapolis to perform a round of formal usability testing on Drupal 7. This is the fourth major usability testing for Drupal, and the first targeting the new Drupal 7 release.

People who were familiar with building websites (but not with Drupal) were observed while they worked through a number of site building tasks. This report contains a summary of the results.

Summary

The good news is that most of the changes that were put in Drupal 7 tested well. Compared to Drupal 6, Drupal 7 no longer confuses new users with basic conceptual hurdles like where the front-end vs. back-end of their site is and how to create an “About us” page, and for the most part the administrative interface is clear.

The bad news is that now that some of these basics have been dealt with, we’ve uncovered a whole new layer of challenges for first-time Drupal site builders, some of which were pretty surprising. Finding modules, creating and placing blocks, and creating content types were difficult tasks for participants to understand, and it’s these site builder tools we’ll want to improve for Drupal 8.

Who did we test, and how did we test them?

Eight participants (a typical number for this kind of study) evaluated Drupal by working through a series of real world tasks over a 75 minute period, “thinking aloud” while the team observed and took notes from behind a one-way mirror. The participants could phone a “help desk” (staffed by a member of the team) if they ever got stuck and needed a nudge in the right direction, and a number of open-ended questions were asked throughout the test session.

All eight of our participants are people directly in Drupal’s target audience. They are site builders, already using tools such as Dreamweaver and WordPress. They know HTML and understand how the web works. All but one had no prior experience in Drupal.

What did we ask them to do?

First, we gave participants a couple of minutes to click around the interface and provide their initial impressions. Then, we provided them with a series of tasks (see the scenarios covering basic things site builders do from day-to-day, including:

• Content creation
• Appearance settings
• Block management
• Installing a module
• Creating a new content type

Test Results

In previous usability testing against Drupal 6 and early Drupal 7, we had intended to test things such as CCK, users and permissions, taxonomy, and so on. What we ended up testing instead was how horrifically confused new users were performing even basic tasks within Drupal 6’s administrative interface: the separation of front end/backend, the overwhelming number of options at /admin, confusion between Page and Story, and more all stopped people from using Drupal successfully.

Based on this testing, we made a number of changes to Drupal 7 to try to combat these conceptual problems. And in short, all of the major usability problems found in Drupal 6 and attacked in Drupal 7 appear to be either vastly improved or non-existent in Drupal 7. Hooray!

What tested well?

• First impressions: After some initial exploration (around 2 minutes), participants had a favorable response to Drupal 7 and thought it was:
• “very simple”
• “clearly laid out”
• “there is a lot you can do”
• “not very cluttered”
• Creating content: All participants—but one—were able to add content (using different links from the homepage) without difficulty. Participants thought it was “pretty simple”, “straightforward” and “easy to find ‘add content’”.
• Basic Page vs. Article: Participants understood the difference between “Basic Page” and “Article”. All the participants who tried to add an “About us” page to the main menu chose “Basic Page”.
• Changing the color of their site: Participants instantly knew to go to “Appearance” to change the color of their site. Although some participants had minor issues finding the theme settings page, they were eventually able to complete the task. Participants also liked how of color changes were previewed live on the affected area itself.
• Toolbar: Participants found the toolbar quickly and had a fair understanding of what it did.
• Toggle between the administrative overlay and site: All but one participant had a clear understanding of how to toggle between the overlay and the site. Participants understood when they were performing administrative activities and frequently used the overlay’s “close” button to return to their previous location or before preparing to start a new task.

What tested poorly?

Now that people can actually navigate and do basic content creation tasks without much difficulty, they encounter other parts of Drupal’s administration that are still utterly baffling. This section covers the major issues, though there are many more, some of them quite easy to fix!

• Drupal terminology is obscure.
  Terms like “Block” and “Module” and “Content types” and “Triptych” either have no meaning, or a preconceived meaning that is different from what Drupal uses these words for. For example, some think of “module” as a block.
• The distinction between “sidebar” content and content made absolutely no sense. Content is content.
  When asked to create a sidebar block, every single participant went for the “Add content” link. Unsure which option to choose, they went for either “Article” or “Basic page” and scoured the vertical tabs options for a way to add it into the sidebar.

  

• The lack of a visually obvious way to place content on the page was a huge detriment
  People really craved some sort of “edit in place” mode as a visual way of controlling their site layout. They tried to click on region names in the block demonstration page to add content there. They tried to take a node that was outlined with the contextual links border and drag it to the sidebar. They tried to click and drag to resize sidebars. The lack of this functionality made Drupal appear extremely clunky.
• Lack of realistic previews makes building sites in Drupal extremely challenging
  The preview as provided by Color module is what participants really were craving to see absolutely everywhere.

  Menus have no preview either, only text descriptions that give no visual clue to where on the page they will appear. Content can be previewed, but this preview is shown in the administration theme and overlay, not in the context of the actual user-facing site. This was frustrating and confusing.

  

• While Drupal takes a “content-first” approach to site building, many people take a structure- and/or appearance-first approach.

  When looking at a mockup of the website they were trying to build, the natural inclination for several participants was to start setting up the navigation structure first. They ran into issues when doing this, because they were required to enter something for the “Path” field of the menu item they were creating, and they had no idea what that could be.

  

• These Drupal evaluators did not realize you can extend it, and so Drupal is seen as limited in functionality.
  If users found their way to the modules page at all, they did not see that they could add new options there.

  Given that the entire point of using Drupal is that you can easily extend it with modules, making this fact more discoverable should be a primary objective of Drupal 8.

  

• The workflow of finding and adding a new module from Drupal.org is overwhelming.
  Once a help desk call pointed them at the “Install new module” link, new problems began. Being taken off-site to Drupal.org was extremely jarring, as was the (apparent) requirement to download a module to the desktop and then upload it to the server to install it. People suggested an in-app browser for modules from Drupal.org. Additionally, the filtering options on drupal.org for modules are overwhelming. The search box, arguably the most valuable tool for when you have a general idea of what you’re looking for, is located far down the list and was missed by most participants. Instead, they honed in on the “Categories” drop-down, which was completely useless to them.

  

• People were unable to make the connection between a module’s version number and modules listed on Drupal.org
  They generally just picked the first thing in the list, which happened to be 7.x for Webform, but wasn’t for “Announcements”, which another participant searched for. (Another issue is that once people know modules exist, they want to use them for absolutely everything, including things that could be accomplished through blocks and content types.)

  

Overall Results

After 75 minutes of using Drupal 7, participants were asked about their overall expressions. Participants commented:

• “This was just hard. I struggled with it. I will have my sister help me.”
• “If you know what are you doing, it’s okay. But for the first time user, it is a little shaky.”
• “A little confusing at first … but I think you need to toy around with it … get familiar with it.”
• “Not as user friendly as I thought.”

When the participants were asked to select five words they associated with their Drupal 7 experience, 60% of their comments were positive. The most prominent word was “Customizable”. (See the complete results.)

Participants were also asked to rate their experience on a 5 point Likert scale in terms of ease of use and value. Half of the participants thought Drupal was “Difficult to use”, and all the participants thought it was “Completely valuable” or “Somewhat valuable”. (See the complete results for ease of use and value.)

Finally, it is important to note that none of the participants were able to make it through their session without needing at least some assistance from the “help desk”.

Next steps

We found over 100 issues during this testing round, some of them major, and many more minor ones. These are captured in raw form in the “Issues Analysis Matrix” spreadsheet, and in the issue queue under the “UMN 2011″ tag. We will discuss, design and code changes for these, involving the larger community on what it means to fix them, and how. You are most welcome to join the effort!

• Keep tabs on high-impact issues at the Usability Community Initiatives page.
• Participate in larger discussions in the Usability group.
• Provide and review patches for issues with the “UMN 2011″ tag.
• Help us create Drupal.org issues for the remainder of the issues found in testing. (Ping someone in #drupal-usability for edit access)
• Help with uploading and splicing videos of participants’ experience to illustrate issues to developers in the issue queue. (Ping someone in #drupal-usability for more info)
• Chat with the team in #drupal-usability and #drupal-contribute on IRC.

We also encourage you to help with further usability testing, both formal and informal. What we tested at University of Minnesota only scratches the surface of what Drupal core can do (for example, we didn’t cover Taxonomy, Search, adding themes from Drupal.org, etc.). We need further testing to verify if our changes are actual improvements, and there are many contributed modules out there that would benefit from usability testing as well.

Join us and help make Drupal 7 and 8 a joy to use!

Sponsors

A sincere thank you to our many sponsors :

And our many individual sponors; Marilyn Langfeld, zerolab, Walter Ebert, Jacine Luisi, Miles Worthington, Nate Haug (Lullabot), Yashesh (Venuslabs Web Solutions), Stein Bjørklund, Brian Link, Greg Dunlap, Wunderkraut, and others. Without you, this testing, and gathering together all who took part, would not have been possible!

Resources

• Drupal Usability Resources
• Summary Report (odt file)
• Issues Analysis Matrix
• Scenarios (odt file)
• Participant videos

Drupal 7.1 and 6.21, maintenance releases which fix security vulnerabilities are now available for download.

Drupal 7.2 and 6.22 also fix other issues reported through the bug tracking system.

Upgrading your existing Drupal 7 and 6 sites is strongly recommended. There are no new features in these releases. For more information about the Drupal 7.x release series, consult the Drupal 7.0 release announcement, more information on the 6.x releases can be found in the Drupal 6.0 release announcement. Drupal 5 is no longer maintained, upgrading to Drupal 6 is recommended.

Changelog

Drupal 7.1 only includes fixes for security issues. Drupal 7.2 also includes bugfixes. The full list of changes between the 7.0 and 7.2 releases can be found by reading the 7.2 release notes. A complete list of all bug fixes in the stable 7.x branch can be found in the git commit log.

Drupal 6.21 only includes fixes for security issues. Drupal 6.22 also includes bugfixes. The full list of changes between the 6.20 and 6.22 releases can be found by reading the 6.22 release notes. A complete list of all bug fixes in the stable 6.x branch can be found at git commit log.

Security vulnerabilities

Drupal 7.1 and 6.21 were released in response to the discovery of security vulnerabilities. Details can be found in the official security advisory:

• SA-CORE-2011-001

To fix the security problem, please upgrade Drupal.

What is included with each release?

We made two versions of both Drupal 7 and 6 available, so you can choose to only include security fixes (Drupal 7.1 and 6.21 respectively) or security fixes and bugfixes (Drupal 7.2 and 6.22). You can choose your preferred version. We are trying to make it easier and quicker to roll out security updates by making security-only releases available as well as ones with bugfixes included. We hope this helps you roll out the fixes as soon as possible. Read more details in the handbook.

Update notes

The .htaccess file was changed in Drupal 7.2 to allow for simpler server configuration, while the (default.)settings.php just got a minor documentation fix that should not affect any copies. The robots.txt file did not change in Drupal 7.

The robots.txt file was changed in Drupal 6.22 to allow crawlers to index the contact page. The .htaccess and (default.)settings.php files were not changed in Drupal 6.

Known issues

When updating to Drupal 6.22, you might loose some of your block configuration. Follow #1173012: Blocks lose settings during update.php and cache clears for more information. If you need to update to Drupal 6.22 and experience this issue in testing, you can roll back the patch from #235673: Changes to block caching mode not caught.