Mar 19 2020
Mar 19

Drupal 9 is expected to be released on time in June 2020. Are the most popular modules ready? How are we at MD Systems helping in the D9 readiness effort?

It’s more and more likely that Drupal 9 will be released on the first possible date: June 3rd 2020. After the extensive work done before the initial beta deadline, it has been extended by two weeks and that has paid off. The community has made impressive progress in the last three weeks, managing to fix almost 50 beta blockers. This means that Drupal 9.0.0-beta1 will be released this week and we will most likely see a stable Drupal 9.0.0 release on the 3rd of June this year.

What about modules and themes?

The contrib space is not lagging much behind. Looking at the 20 most used modules, half of them have either a stable or a dev version that is Drupal 9 compatible and almost the entire other half has a working patch. 

10 have compatible stable or dev versions: 

  • Admin toolbar, 
  • Token, 
  • Ctools, 
  • Pathauto, 
  • Entity Reference Revisions, 
  • Paragraphs, 
  • Redirect,
  • Inline entity form, 
  • Simple sitemap,
  • Mailsystem

Video embed field is now compatible as well but encourages migrating to core provided solutions.

The other 10 have either a patch ready to be committed or need additional work:

Note: this is the status as of 17th March, with the beta release almost upon us, we expect that most of these modules will soon be ready as well.

The Global contribution weekend organized in January helped move things forward, with the Swiss community playing an important role adding almost 20% of the contributions.

Helping with Drupal 9 readiness

At MD Systems we maintain multiple internal install profiles that cumulatively rely on more than 120 contrib modules. This means that we have been actively working on, or at least closely monitoring, the progress of those modules.

If we look for example at the state of our Primer distribution we see that 44 of the 75, or 58% of the modules used now have either a stable or a development release that is D9 compatible. 31% of the modules have patches that are waiting to be committed. And work is needed on only 11% of those modules. These numbers are based on deprecation inspection tools and automated tests, so it’s likely that new issues will surface with manual reviews after the update. 

We maintain or help maintain 5 of the 10 most used D8 modules, therefore we have focused especially on those. All of these 5 modules are now Drupal 9 compatible. Besides that, almost half (49%) of the 47 modules we maintain are D9 compatible and 21% have issues ready, leaving 30% needing additional work. 

Next steps

We are committed to pushing the D9 readiness effort further on both the modules we help maintain and the ones we use. 

We already started testing with the current Drupal 9 branch and identifying various issues that didn't surface from either drupal-check or simpletest runs. That already lead to fixing multiple issues in the install profile itself, as well as some issues in the modules we use.

We are also available for consulting with updating sites to Drupal 9 as well as working on specific contributed projects.

When can projects use Drupal 9?

As we’ve explained in a previous blog post, most projects will likely be able to update to Drupal 9 quite soon after the initial release. Still, many projects use dozens to a hundred or more contributed projects and every single one of them will need to be Drupal 9 compatible (at the very least, that involves defining that in its .info.yml file).

Until that is the case for all dependencies of a project, we recommend to build projects based on Drupal 8.8 and 8.9 once it is released. Ensure not to use any deprecated APIs in custom code, keep an eye on Drupal 9 compatibility when deciding on which modules to use and update once it is possible. Almost all APIs from Drupal core are also available in Drupal 8.8 and 8.9, with the exception of the underlying frameworks like Symfony, Twig and JS libraries.

Drupal 9 testing for early adopters

To start testing Drupal 9 in our projects, you can use an alias to install it as Drupal 8 for the modules that do not yet declare themselves as compatible with Drupal 9:

composer require "drupal/core:9.0.0-alpha2 as 8.8.4"

However, be prepared to also require a lot of development versions and extra patches in the current state.

Jan 30 2020
Jan 30

Every year, the last weekend in January is reserved for a global Drupal contribution weekend. Community members and contributing organizations from over 30 world cities volunteered to organize a local Drupal contribution weekend. Zurich was one of these cities and the full team of MD Systems was there.

Global Contribution Weekend 2020 - Zurich happened from Friday, 24th January to Sunday, 26th and took place at Unic offices. The contributors joined the event already at 9 AM on Friday and outlined plans for the next 2 days on how we can contribute and collaborate. 

Since Drupal 9 is getting closer, one of our main goals for this weekend was to push forward core issues and contrib modules that we use in Primer distribution and get them ready for Drupal 9. We started the weekend by making a spreadsheet with contrib modules we use and assess their Drupal 9 status.

Additionally, Paragraphs, one of the most used Drupal modules, received several accessibility and user experience improvements. The team collaborated with other contributors and made progress towards making Paragraphs compatible with the Claro theme. 

The Swiss community leads finalized the constitution for Drupal Switzerland and reviewed the well progressed proposal from the Splash Awards 2020 from the project team. Both important pieces for the Swiss Drupal Community.

From Friday 24th January 2020 to Sunday 26th January 2020 during Global Contribution Weekend 2020 - Zurich there was a total of 24 people who contributed to 66 issues in 27 projects with 67 patches posted out of total 261 comments. Together with the rest of the local community, we were involved in fixing 26 issues!

The aggregated numbers above show how big impact the Swiss community has on the Drupal ecosystem since our contributions made almost 20% of total world contributions during the last weekend. A very impressive result!

As part of our weekend goals, we were also working on pushing forward Drupal 9 core issues in order to reduce the number of deprecated APIs. The progress during the sprint can be seen on the Drupal core 9.x-dev @deprecated mentions graph below.

We continued to work on Drupal 9 issues during the week and 30 projects used by our install profiles are now fully compatible with current Drupal 9 codebase. Another 25 modules have patches prepared to make them ready. 

To wrap it up, we really enjoyed the Global Contribution Weekend 2020 - Zurich and looking forward to the next Drupal contribution event! 

We would like to thank Josef Dabernig for organizing the contribution weekend, Unic for hosting the event, MD Systems for allowing us to spend two full days on Friday and Saturday working on contributions and all the people who joined the contribution weekend! contributors at the #ContributionWeekendCH: mbovan, Berdir, znerol, sasanikolic, dasjo, miro_dietiker, saschaeggi, grahl, pivica, fhaeberle, mathilde_dumond, Siegrist, isabrenner, spitzialist, roy.voggenberger, signalwerk, waluigi, sarahsarah, jzech, malte.koelle, dermario, lsmith77, Jos Doekbrijder, Primsi.

* Statistics covers contributions made on between Friday 24th January 2020 and Sunday 26th January 2020 tagged with #ContributionWeekendCH and #ContributionWeekend2020 issue tags.

Jan 20 2020
Jan 20

Drupal 9.0.0 is scheduled to be released in 2020. There are 3 possible release dates, depending on when the requirements are going to be met. The earliest possible date is June 3, see for details as well as the overview below.

Drupal 9 Scenarios draft

First, the most important fact is that Drupal 9.0.0 will be a very different release compared to Drupal 8, Drupal 7 and so on. Before Drupal 8 has been released, the community has been working for years on a new version, with a lot of new functionality and major changes that required huge efforts to update or migrate sites to a new major version.

However, since Drupal 8.0.0, the Drupal community has released a new minor version roughly every 6 months with new functionality and improvements. That means that maintaining Drupal 8 sites is a continuous process that requires regular updates. Drupal 9.0 will then not provide any new features, it will instead just update all its third-party dependencies (like Symfony) as well as remove the so called backwards-compatibility (BC) layers, which allowed it to keep existing modules working while making a lot of changes to improve and modernize the code base.

There are no content structure changes planned between Drupal 8.9 and 9.0 which means that updating will only be about updating code and - to a lesser degree - configuration.

For sites that are still using Drupal 7 or even earlier, no longer officially supported versions, it makes sense to start the migration to Drupal 8 now instead of waiting for Drupal 9 to be released, as that gives them a longer time period to finish this process.

That means:

  • Predictability: Drupal 9 will be released on one of those 3 dates, unlike earlier major versions which were often delayed by months or years.
  • Lessened burden on maintainers: Contributed modules will be able to support Drupal 8.8+ and Drupal 9+ in a single release, with a limited amount of necessary adjustments. In turn, that will result in modules being Drupal 9 ready earlier than with previous releases.
  • Seamless update: Once all modules that are used by a project support Drupal 9 and its own custom code and themes are updated, the project can be updated to Drupal 9.0 just like updating from Drupal 8.7 to 8.8.
  • Shorter window of support for previous versions: Drupal 7 and 8 support will end in November 2021, due to support for third party components ending.

So how is MD Systems dealing with this major transition as a responsible and active major contributor in the ecosystem?

Primer will be Drupal 9 ready

All our customers who are using our install profile Primer and have an active maintenance contract with us will have their sites updated to Drupal 9.0 once it is ready, as part of our regular Primer updates. Likely without even noticing it, thanks to our extensive automated test coverage and visual regression tests.

MD Systems is also available to consult with updating sites to Drupal 9 as well as working on specific contributed projects.

Read on to learn more about the background, technical processes and tools to prepare for Drupal 9 as well as our contributions.

Drupal Core and Tooling Status

Preparations in Drupal core are ongoing for Drupal 9. There has been a lot of progress already, but there is still a lot to do. Drupal 9.0.0-alpha1 is expected to be released very soon.

The following graph shows the remaining work in the progress on removing the mentioned backwards-compatibility layers around deprecated code:

Drupal core 9.x-dev @deprecated mentions graph

Once this is done as well as the other required preparations, then Drupal 9.0.0-beta1 will be released and the release date of Drupal 9.0.0 will be set. MD Systems is actively involved in removing these BC layers.

Beside Drupal core itself, a lot of work is also going into the infrastructure on, which will for example allow contributed modules to adopt semantic versions (1.2.0 instead of 8.x-1.2) as well as tooling to support contributed project maintainers as well as custom code in sites in updating their modules to Drupal 9.

For example, inspects the whole ecosystem of contributed modules in regular intervals to identify the progress in becoming Drupal 9-ready. Drupal-check is a CLI tool that allows to check the status of one or multiple modules and Upgrade Status is a Drupal module that can check all or some of the installed modules that a site uses and display a report of the Drupal 9-readiness of a site.

Some deprecations can not be identified with static code analysis, the best way to identify these is to have automated test coverage with phpunit tests which can report issues based on runtime calls to deprecatd methods.

There is also a weekly meeting in #d9readiness in Slack on Monday 7pm UTC where the progress is discussed.

Collaboration for Contrib readyness

Drupal 8.8, released back in December, is the last minor Drupal 8 release with additional Drupal 9 deprecations. Drupal 8.9, will focus on stability instead.

This allows most contributed modules to be compatible with Drupal 8.8+ and Drupal 9 in the same release and makes it a perfect time to start preparing for Drupal 9.

And while the community has been preparing for Drupal 9 for some time already, there has been a flurry of activity since the release of Drupal 8.8.0 and improved tooling. Maintainers of large distributions and ecosystems like Thunder, Lightning and Commerce have committed to making their projects available to Drupal 9 as early as possible and have committed a lot of time already to work on the modules they use.

MD Systems maintains multiple internal install profiles and supports almost 100 projects on We are committed to prepare all modules that we maintain for Drupal 9 and have already been working actively on that in the last weeks and months. Many of our modules now require at least Drupal 8.7 and only have a few remaining deprecations left to be fully ready for Drupal 9. Resolving these means requiring Drupal 8.8, which we’ll start doing in a few weeks.

In the upcoming Global Contribution Weekend, a key focus will be to prepare modules for Drupal 9 and our team will join the local sprint in Zurich. If you have any questions about our projects or need help in preparing your own, talk to us in person or Slack.

Custom transition

Typically, Drupal sites also have custom code that might need to be updated as well. The same tools that can be used for contributed modules can also be used for these custom modules. 

If a site has kernel or functional phpunit tests then these are a great way to test for deprecations in custom code as well as contributed modules as well.

To be able to test a site on Drupal 9, all used modules need to have a release that supports Drupal 9. Once that is the case, it is also possible to do manual tests as well as running automated test suites like Behat.

Making legacy projects ready

Some projects that were released early in the Drupal 8 cycle might be using legacy contributed modules that have been abandoned or have been merged into Drupal core or other modules might face some challenges.

Examples include the Media Entity project (8.x-1.x, including its large ecosystem), the Workbench Moderation modules as well as File entity. While some of these projects might still receive Drupal 9 compatibility releases, they only receive minimal maintenance.

These sites will either need to find ways to migrate away from these old modules or new maintainers need to step up and make the module available for Drupal 9.

MD Systems is available to consult with updating sites to Drupal 9 as well as working on specific contributed projects.

Nov 21 2019
Nov 21

This year, Amsterdam, Netherlands celebrated its third time as a home city for the biggest European Drupal conference - DrupalCon. My overall experience was great and I am going to provide you with more insights in the next paragraphs below.

Group picture Hearts - DrupalCon Amsterdam 2019

Monday mornings on DrupalCons are usually reserved for travelling to the host city, meeting Drupalers and visiting training opportunities. This time it was no exception. I spent the morning travelling to Amsterdam. After 2 hours of pleasant flight, I headed to the venue for check-in and straight to the Mentoring Orientation session. Since my main goal for this DrupalCon was to contribute by mentoring others, this was a first must-see session. We spent a good hour meeting other mentors and outlining plans for the week. The idea was to discuss how we can assist people who are interested in contributions. Mentoring process is one of key Drupal values & principles that we as a community strive to. Its goal is to encourage others to get involved and to help our community.

The other part of the day was reserved to catch up with people from the community and meet newcomers. In the evening, attendees could join the International Splash Awards 2019 event which announced the best Drupal projects in Europe in 2019 or participate in “Dinner with a stranger” organized by the Dutch Drupal community in a local karaoke bar.

State of Drupal

On Tuesday morning, attendees gathered in a big auditorium to see the first keynote at the conference. Drupal founder, Dries Buytaert held a talk about the State of Drupal. The presentation started by outlining the new features in the upcoming Drupal 8.8 release. This is one of the richest minor Drupal releases feature-wise. Here are some of the highlights of the upcoming Drupal 8.8 release:

  • Media Library module became stable in Core, it adds CKEditor integration

  • New modern looking experimental administration theme (Claro) with better accessibility features

  • Official support for creating Composer-based Drupal projects

  • Experimental support for Automatic updates

  • Improved JSON:API support, JSON:API Explorer, auto-generated documentation, performance improvements

The Drupal 8.8 release was built with various contributions coming from 641 individuals and 243 organizations with MD Systems as always being among the top contributors.

Drupal 8.8 contributors

Contributing organizations to Drupal 8.8 release

As the next major Drupal release (Drupal 9) is going to be released in June 2020, this was a perfect time to start thinking about new initiatives. Dries has proposed 4 tracks as possible directions where the contributions should go:

Track 1 - Do More with Less; The focus is on reducing costs and efforts when using Drupal. Effective tool support allows us to reduce operation costs with better automation. Some of the suggestions were to improve Configuration management, advance Automatic Updates, improve Composer support and better integrate with Symfony components.

Track 2 - Ease of Use; the session presented a Content Management System User Experience study which compares Drupal, Wordpress, SiteCore, Adobe Experience Manager by five criteria. The criteria were Modern/Outdated, Premium/Basic, Empowering/Constraining, Clear/Confusing, Would recommend/Would not recommend. The study shows that beginner users evaluate Drupal as a confusing and not recommendable CMS while the same metric drastically changes with advanced users. In relation to the results of the study, Dries has proposed to prioritize improving the beginners' experience with Drupal. Besides improving the current system, one of the interesting new ideas was to introduce the paid marketplace of themes similar to Wordpress Marketplace. It is important to mention that our company has been focusing on this topic for the past 3 years with many contributions that went into Drupal Core and Paragraphs.

Track 3 - The Open Web; Taking into account that there are 1 in 40 websites on the Internet running with Drupal and 4 billion people joining the Internet in the coming years, the proposed idea of the track 3 was to make Drupal more accessible and interoperable.

Track 4 - The explosion content + data; Improving Drupal to be a better data engine. The ideas covered introducing GraphQL support, Native DAM, Privacy, better content creation experience etc.

Despite Drupal 8 not yet being ready out of the box, our product is removing those barriers already with a modular design, better content creation experience, default accessibility support and structured data. Check out Primer in case you are looking into solutions for building the fastest prototype for your next project.

I spent the rest of the day on visiting sessions I have already outlined before.

Robin held a session about Drupal Commerce - Under the hood. He presented an overview of Drupal Commerce with a focus on its plugins that cover orders, adjustments, prices and gave insights and best practices on how to customize already feature-rich Drupal Commerce. The majority of the presentation was spent with showing useful practical examples and doing the live demo.

The similar presentation was held at Zurich Drupal Meetup October 2019 by Sascha Grossenbacher. If you are interested in this topic checkout his slides too.

Mentoring is fun - DrupalCon Amsterdam 2019

Contribution Day

The Contribution day traditionally happens on the closing day of the conference where people meet with a common goal - to contribute. We had two contribution areas: General contribution area where people were working on things they were already familiar with and Mentored contribution area where mentors tried to help newcomers how contribution process works.

On Thursday morning, around 30 mentors showed up at the beginning of the Contribution day. We split up into several roles with people volunteering at the booth, greeting newcomers and letting mentors introduce them with the tools and processes.

Together with Kevin Wenger from the Swiss Drupal community, I mentored around 10 people during the whole day. In the beginning, we spent time getting everybody’s local environments ready and afterwards started the real work. Our work consisted of multiple phases that are part of the Drupal contribution process. We started with the issue triage in order to pick up the most appropriate issue for our mentees which guaranteed a good start. The first thing was to discuss the issue, describe the problem and outline our goals. We used the pair programming technique to kick off the implementation phase. The process covered patch creation, understanding the issue metadata options and describing the next steps. That resulted in the express fixing of the core issue Fix usage of unsupported !title placeholder in Translation.php we were working on.

As an outcome, 115 people received a credit on their profiles because they decided to spend hours working with mentors on their first contributions! The contribution day took a lot of energy but since we had more than 300 people in total contributing to various areas, it was well worth it!

All in all, DrupalCon Amsterdam fulfilled my expectations which were set high since last year’s Drupal Europe. The DrupalAssociation has already confirmed DrupalCon will happen in Europe in 2020 while the host city will be announced later.

I hope you enjoyed reading my report from the conference and look forward to seeing you in the next Drupal event!

Nov 05 2018
Nov 05

Last year, Drupal Association has decided to take a break to consolidate and not organize an official DrupalCon Europe in 2018. Twelve community members stepped in and developed a plan to organize a DrupalCon replacement − named Drupal Europe. The final result was outstanding.

More than 1000 Drupalers from all over the world gathered in Darmstadt, Germany from 10th to 14th September 2018 to attend the yearly biggest European Drupal event. The new event brought a new concept. It featured 10 amazing tracks that guaranteed high-quality content for all of the Drupal target groups − developers, marketers and agencies. Additionally, it created more room for contribution and collaboration outside session slots.

Official Group Photo Drupal Europe Darmstadt 2018

We supported the event by giving three talks in two different tracks.

Miro Dietiker - Connecting media solutions beyond Drupal

On Tuesday, Miro Dietiker, founder of MD Systems, gave an interesting talk about integrating Digital Asset Management systems with Drupal. He compared the benefits of existing solutions and provided a practical guide what kind of solutions you could use to fulfill your media management needs.

More information about the session and slides can be found on while the session recording is available below.

[embedded content]

On Wednesday, Miloš Bovan held a session about Paragraphs module and its best practices. The full room of people proves that people love and use Paragraphs a lot. The talk focused on answering frequently asked questions when it comes to working with Paragraphs. Those covered some of the new features that are not well known as well as ideas on how to improve the editorial experience easily.

Miloš Bovan - Enrich your Paragraphs workflow with features you didn’t know about

The session summary is available at

The conference featured many interesting sessions that provided ideas and actual implementations on how to make the Paragraphs user interface better (Creating an enterprise level editorial experience for Drupal 8 using React, Front-end page composition with Geysir, Improving the Editor Experience: Paragraphs FTW). The discussions about Paragraphs continued during all the conference and resulted in a BoF that happened on Thursday where Drupalers have discussed the future of Paragraphs UI. We look forward to fruitful collaboration.

John Gustavo Choque Condori - Drupal PKM: A personal knowledge management Drupal distro

John Choque, our colleague, gave a talk about the personal knowledge management distribution he has created as part of his bachelor thesis. The talk gathered people interested in education to get ideas how to improve knowledge management in their organizations. The session summary as well as slides are available at

[embedded content]

Social activities

Besides sessions, contributions and coding we enjoyed attending social events as well. On Tuesday, the organizers brought participants to the Bavarian Beer Garden to taste traditional German bratwurst and beers. The place was located in the park and there was no chance to miss the great event. 

On Wednesday, we joined our fellow Drupalers from the Swiss community for a dinner. It is always nice to catch up with local people in an international event such as Drupal Europe.

As usual, the event came to an end with traditional and yet always exciting Trivia Night.

What’s next?

During Drupal Europe, the project founder, Dries Buytaert has announced that Drupal Association signed an agreement with Kuoni, an international company specialized in events organizations. This results in bringing the official DrupalCon Europe event back in 2019 and it is going to happen in the capital of The Netherlands − Amsterdam.

We hope to see you all there!

Apr 24 2018
Apr 24

The largest DrupalCon yet took place from April 9 to April 13 in the city of music - Nashville, Tennessee. Thanks to their contributions and MD System’s Open Source contributing strategy, two of our members, Miloš and John, received a DrupalAssocation grant and represented our company at the conference. As the most important Drupal community event, DrupalCon has had much to offer.

Venue Exterior - DrupalCon Nashville 2018

Traditionally, Tuesday featured a DriesNote. The Drupal project founder, Dries Buytaert, talked about new Drupal 8.5 features which include easier Media management, simplified site-building, and other features. Also, Dries presented current improvements on the API-First initiative. According to his keynote speech, Drupal is getting many interesting features such as Drag&Drop layout and page building, JavaScript-based administration interface, improved web services with JSON API and many others.


Wednesday and Thursday were fully filled with the sessions and BoFs (Birds of a Feather). A record high number of submitted sessions guaranteed there is going to be enough choice for everybody. Wednesday featured an inspirational keynote by Steve Francia, where he talked about the role Drupal has played in his career. Steve was leading some of the largest open source projects (MongoDB, Go, Docker) and shared thoughts on open source patterns within Drupal.

On Thursday, Miloš and John took part in #DrupalChanges movement where they described how Drupal enriched their careers. DrupalChanges has been introduced by Drupalistas from ADCI solutions as a way to collect stories from people all over the world on how Drupal changed their lives. We talked about our first steps with Drupal, community contribution and engagement as well as about ways to stay connected with the community. We were happy to participate in such movement.

Friday Sprints

At DrupalCon, we spent our time to engage in conversations with people from all over the world, talk about a variety of topics and discuss things we are passionate about including Paragraphs and Translation Management Tool (TMGMT). Some of these conversations resulted in submitted patches during the contribution day on Friday.

As Nashville is famously known as a music city, it is worth to mention that we have enjoyed the after-con life as well. As a matter of fact, country music has its origins in this city and it is not hard to guess that choosing Nashville as a DrupalCon place was a great choice. Next year, DrupalCon US goes to the northwest, to Seattle, Washington.

Official Group Photo

Prior to that, we will most likely be heading to European Drupal events, Drupal Developer Days in Lisbon, Portugal and Europe’s largest event in 2018 - DrupalEurope in Darmstadt, Germany. We hope to see you there!

Thanks to Susanne Coates for providing many photos from the DrupalCon!

Sep 20 2017
Sep 20

An update on the strategy and progress of Paragraphs is long overdue with too many unanswered questions until now. Here we are!

The rising global star

Paragraphs climbed up from position #223 in June 2016 to currently #123. People all over the world are presenting success stories or best practices around Paragraphs at every possible event.

While Drupal 8 has only 18% of the Drupal 7 usage, Paragraphs for Drupal 8 already has 11% more installations than the Drupal 7 version. Wow! 15% of the Drupal 8 users (compared to 2.5% at Drupal 7) opted for Paragraphs, promoting it as the effective top #8 Module for Drupal 8 (see investigation).

Waiting until it is ready

After the exciting release at the Drupal Mountain Camp, we were ready to adopt sponsored features: We presented slides to stakeholders with several (15+) isolated small proposals, refined and extended them with mock-ups so that they could identify its users pains and help fund small features with immediate value to them. We spent weeks creating mock-ups and slides that showcased the ideas and constantly refined them.

Yet we didn’t succeed winning clients for funding and most of the previous collaborators shifted their focus back to regular commercial work. How could Paragraphs still have evolved?

Primer - a flagship use case

We decided to invest into a hybrid approach: Developing Primer for digital storytelling based on Paragraphs. By being opinionated, one can find many simple answers to otherwise complex problems. This led us to re-prioritize all the Paragraphs issues: We ended up focussing on extensibility and general UX improvements in Paragraphs itself. The vision of Paragraphs Collection as an atomic component library (defining Paragraph types, fields, providing plugins, templates and default design) mostly fell into the distribution context.

A new exciting release of Paragraphs

We concluded early that Paragraphs will ship with a classic widget that is mostly unchanged while innovating within a new widget with an experimental stability. Users can easily switch to the new widget, provide early feedback and switch back in case of issues.

The new release Paragraphs 8.x-1.2 contains a completely overhauled experimental widget. Its UX evolved significantly with a nice mobile experience.

To list a few new features: Action button "...", Drag & drop mode, Autocollapse mode, Paragraph summary with icons, Add modal form, Paragraph type icon with description and many more.

The new widget remains experimental. We are using it heavily in production already, but there are some known bugs (even data loss situations) and we still want to be flexible to complete ongoing refactoring. We are close to reaching a stable milestone that implements a nice collection of the original UX proposals.

We want to thank everyone that keeps contributing, with special thanks to Lukas von Blarer for his help with the Drag & drop mode UI after Berdir spent weeks debugging form magic to make it work, and the Thunder team (tjwelde, chr.fritsch, mtodor) for starting the modal add mode. You are awesome!

Quo vadis Paragraphs?

Our switch to Primer has allowed us to keep pushing many pieces forward in the Open Source domain for a limited time. Still, a huge potential of the original vision was lost. Our Drupal ecosystem can only survive in the long run if we keep innovating at a fast speed and it will be critical for the success of Paragraphs to find funds. We are exploring further options to involve major beneficiaries into our innovation cycle. Contact us if you like our work and you want to support it.

Aug 08 2017
Aug 08

We at MD Systems are 100% Drupal 8 advocates. We believe that it is the best solution for building various kinds of websites (older versions of Drupal included). We have believed in this for years and that is one of the reasons why we have been actively involved in its development since the beginning of the cycle. From leaders in core space to driving whole contrib initiatives (Media, Paragraphs, ...) forward, there probably is no significant part of the Drupal 8 ecosystem to which our company has not contributed at some point.

With that said, we also understand most of the concerns that are often expressed about the challenges that Drupal 8 introduced for many organizations such as NGOs, non-profits and small businesses. We believe that Drupal 8 can provide a lot of value for this kind of organizations so we decided to use our vast experience with Drupal distributions (NP8, Kampatools, Thunder) and build something that certainly will help us to fill the gap and bring Drupal back to the grassroots.

Many features for a low price

Today we would like to announce Primer, our new Drupal 8 distribution for small organizations. It comes with many features, standard design and low cost of entry. It uses a business model that allows us to continue its development, which means that you will always be up-to-date and that you can benefit from new features in the future.

What will Primer allow me to do?

Primer’s content creation is built around the popular Paragraphs module. It comes with more than 20 content components that can be used individually or combined, using different layouts and/or styles. Each of those components has out-of-the-box support in the Primer’s standard design, so it will look exactly as it should without any need for development or theming.

This approach allows anyone to build arguably complex landing-, overview-, campaign- and other pages solely through the editorial user interface. Combined with the great flexibility of the standard design (more about that later), it is possible to build a perfect website that uses organization’s branding for a very low cost.

Some of the Primer's features.

Three out of many components that come with Primer: content reference, quote and layouts.

Eager to explore more examples of features that Primer offers out of the box? Check the examples page on its website.

Besides its innovative approach to content creation we added much more functionality to Primer. From advanced media management and multilingual support to community generated content and event management.

Did we get your attention? Find out more and get in touch for a demo.

What are features without a good looking design?

Not much, really. Yes, we agree with you on that!

That’s why we built a powerful standard theme that will allow you to adapt the look & feel of your new website to the branding and needs of your organization. All that just by adjusting few configuration options, no custom development and without skyrocketing costs.

But let me be quiet for a second and let the results speak for themselves….

Examples of design variations.

Four examples of design variations.

You don't believe me? Then you should definitely surf to the Primer’s design demo page and see it for yourself!

How much does it cost?

Are you afraid to learn? So many cool features must come with a huge price tag!

Not really! Primer-based site won’t cost you a fancy sport car. Heck, it won’t even cost you a family sedan!

The basic package, which includes vast majority of features that I mentioned so far, comes at 4950 CHF (~4350€/~$5100). Yes, fully running websites using the color scheme, logo and fonts of your choosing for around five grand. All that with professional support and constant updates with bug fixes and new features.

To good to be true, I know.

And the best thing about it? It is Drupal 8 with all its strengths. Need custom features? Find any Drupal professional and it will be coded for you. Prefer completely customized design? Sure, no problem! Is “there a module for that”? Install it on your Primer site and start using it today.

Possibilities are literally endless! Get in touch today and have a new state-of-the-art website by the end of the week.

Are you an agency?

Are you a Drupal shop or a digital agency? Would you like to stop building custom projects that are 80% alike over and over again? Never had resources to build your own Drupal distribution?

We offer an affiliate program for you. Use Primer for your client’s projects. You will get an exceptional product with the professional support and will be able to focus on what you do the best - satisfy your client’s needs and growing your business.

We already started shipping first pilot projects on Primer. Would you like yours to be next? Get in touch today!

Aug 02 2017
Aug 02

Since we released the earlier this year a lot of interesting things happened in the Thunder ecosystem. We thought that it is a good time to provide an update.

Thunder 2.x

The Thunder team released a new major version of the distribution earlier this summer. The new release comes, after months of hard work, with very interesting new features that will make your daily work much more pleasant and easier.

Thunder's content creation interface.

Thunder’s new admin theme.

Thunder now comes with nicer and more intuitive administration theme, a big number of the user experience improvements in the content creation interface, mobile preview capabilities, liveblogging, out of the box support for Accelerated mobile pages (AMP) and support for easier updates.

We are also proud to see another module that we actively maintain being adopted (beside Paragraphs, the entire Media suite of modules and Pathauto) by the Thunder distribution. The Diff module now allows you to show the changes between revisions of your content in a nice and transparent way.

Revision changes displayed inline.

Revision changes displayed inline. updates

We recently updated our Thunder demo platform as well. All instances that will be created from now on will automatically use version 2 of this popular distribution for professional publishing. We would like to encourage you to spin up your personal trial instance today and to give it a try.

We also prepared few interactive tours that will help you to get up to speed with Thunder faster and make sure that you do not miss any important features.

Together with our partners and Microsoft Azure we also made sure that you can use your personal test instance for a month completely for free. And since this is a “real” and fully featured website on a “real” professional-grade cloud hosting you can convert it into a real live website within days. Just start adding your content and let your users know about it.

It is really that easy! Cool, right? landing page. landing page.

MD Systems is now officially a CTI

Certified Thunder Integrators (CTI) are IT consultancies, developers, agencies, and similar IT professionals with a proven knowledge and practical experience in managing and implementing successful Thunder projects. CTIs need to be certified by the Thunder Core Team in order to be allowed to use the label ‘Certified Thunder Integrator’ and the associated badge to promote their services.

Yes, your favorite Drupal 8 professionals now officially became your favorite Thunder partner as well. With extensive early experience in Drupal 8, huge involvement in the community development and years of experience with the projects from the publishing industry we are definitely one of the most experienced teams for your next Thunder based project.

If you are looking for customizations, migrations from legacy systems, integrations with 3rd party systems, a long term support and consulting partner or if you need just a bit of help with converting your trial instance into a live site do not hesitate to contact us. We will be happy to help!

May 22 2017
May 22

We have built a shop to buy digital and print subscriptions as part of the newspaper platform sü The whole site and the user and subscription management is closely integrated into an external subscription management system that takes care of things like recurring billing, both invoices and credit cards. That system has no public interface, so if for example a credit card expires, the user needs to be able to renew the subscription through the website. Product information is synchronized with the external system and completed orders are sent to that system automatically for processing. It also does not support to buy multiple subscriptions at once, so we don’t need a cart.


Commerce 2.x provides an out of the box shop experience that is quite different from our requirements for the project. Thus we had to change that. We were able to find solutions for all those challenges and worked closely with the CommerceGuys team to find ways to contribute back. We also worked on a few missing features as well as making existing features more flexible, so we could customize it for our use case.

Storing and reusing payment methods… but not really

Commerce 2.x has much improved support for storing payment methods and using them again. The default use case that it supports is to make those stored payment methods visible again to the users in the checkout process, allowing them to avoid entering the payment information again.

We internally need to store payment methods so we can send it to the subscription system. However, the vast majority of users only buys a new subscription if they don’t have one yet or if their old one expired, in which case they either have no credit card yet or it expired.

That’s why we decided to replace the default payment gateway selection checkout pane with a custom one, that does not offer to re-use existing payment methods. Still, having the built-in default storage to store the credit card alias from the external payment gateway is a great improvement over Commerce 1.x.

Checkout existing customer

Different address handling

A second reason for that decision was that a stored payment method also has a corresponding billing address, so the selection of the billing address and the payment method in Commerce 2.x is combined and the payment gateway and billing address is selected/provided in the same pane, before the review step.

Our design/requirements required a different workflow for the address information checkout page

  • A required delivery address and optionally a different billing address
  • A few additional fields to enable existing customers to connect through a subscription number. By entering a valid subscription number we automatically fetch the address and fill out the address field.
  • The ability to provide a later subscription start date 
  • Custom validation to prevent that users can buy a subscription for a newspaper that they already have.

Additionally to replacing the payment gateway pane, we also replaced the address information pane with our own that had all those fields and validation logic in a single place, which simplifies maintenance.

Renewing an expired credit card

In case a credit card expires or the payment failed for another reason, the customer receives an e-mail with a link. That link leads to a page where they can do a manual payment again, which is then again sent to the external system. We wanted to make this step as fast as possible and jump directly to a review/info checkout page where the customer can just click once to start the payment.

This was surprisingly easy to implement, we defined a second checkout flow where we disabled all unnecessary checkout panes and pages, an order type that used that checkout flow as well as an order item type that used that order type and did not have a referenced product. We then programmatically create an order item, an order and send the user to the checkout process.

Edit variation

Synchronization of product variations and submitted orders

The external system defines the concept of an offer, which is a certain subscription with a given runtime, a price, a title as well as some other information like which payment gateways are allowed (monthly subscriptions can only be paid with credit card, others also with invoices).

There can also be special promotions. To avoid that this information gets out of sync with the website, the shop manager only needs to select the offer as well as providing a few web specific things, everything else is then automatically fetched from the API and updated in the background. Inline Entity Form made this fairly easy, as we can easily control which fields are displayed and hook into the process of building an entity from that.

The opposite happens when a user completes the checkout process, then we need to send that data to the external system, so it can be reviewed and processed. To be able to do this, we defined a custom order workflow, which is easy to define in YAML file, then used that for our order types. When an order reaches a certain step in that workflow, we collect all the information, convert it to the structure that the external system understands and forward it that information.

Checkout register

E-Mail only registration

The site doesn’t use usernames, the registration is customized to hide the username and build it from the e-mail. Commerce has a built-in login or register checkout page that is hardcoded to a few specific fields and shows both the username and the e-mail.

Initially, we started an issue that provides a setting to control whether the e-mail should be shown or not, but that is a bit controversial and likely requires a bunch of additional settings to define how the username is defined etc. As we mentioned in the previous blog post, Commerce 2.x tries to avoid having many settings, so we had to try something else.

Our second and current approach is to improve the checkout pane instead so it is easier to customize and extend. We ended up needing that anyway, as we need to show a few additional fields on the registration form too.

Direct checkout

Not having a cart and instead going directly to the checkout is a fairly common requirement, so there was already an issue for this with other people looking for this feature.

We worked on that and provided a first patch that is currently being reviewed. A new setting changes the button to go directly to the checkout page and any messages about cart are skipped. Commerce 2.x currently has the same limitation as 1.x, that anonymous users can only go through the checkout if the order is in the cart session and we currently have to work around that a bit. That also means the checkout and cart functionality are still tightly coupled. Checkout currently depends on cart, so you can not have a checkout without having the cart module completely disabled. That is possibly something that will still be improved.


When combining all those changes, we ended up replacing or extending almost every checkout pane and a few other components that Commerce 2.x provides to be able to achieve the UI and processes we required. We were however able to do so in a very clean way and re-use a lot of code because Commerce 2.x is designed to support exactly that, thanks to the flexibility of the framework underneath the default UI.

Integrating with external systems also became easier in Drupal 8/Commerce 2.x compared to similar requirements in in a Commerce 1.x project. Converting data structures, error handling and general interaction with one or multiple external systems still requires a considerable amount of code and development time, services, plugins and improved APIs support developers in writing clean and maintainable code.

We are convinced that Commerce 2 is a great framework to use for both standard shops with products, shipping and a standard checkout process as well as heavily customized ecommerce solutions. We are looking forward to our next commerce projects.

Contact us if you are planning a Drupal Commerce project.

May 11 2017
May 11

The new version of Drupal Commerce has been rewritten from scratch, learning from what worked well and what was causing problems in Commerce 1.x.

In this blog post, we will focus on explaining some of the key differences we have seen so far and how they affect developers and users. In a second blogpost we will focus on challenges we had in our first e-commerce project in Drupal 8.

Built on reusable (composer) components

Quite a few of the lower level API’s have been built as generic libraries that can be used outside of Drupal. This allows CommerceGuys to collaborate on those with other eCommerce systems outside of Drupal.

That means it is a requirement to use composer to maintain sites. That works great and is not a big problem for experienced developers, especially those used to other PHP frameworks or languages where a package manager is common. But it can be a problem for less experienced users and some hosting providers. The hosting provider we use for this project,, has support for deploying projects using composer.

More functionality out of the box

Unlike Commerce 1.x, which provided only a minimal amount of features and required a lot of site building and customization, Commerce 2.x is closer to Commerce Kickstart than a plain Commerce 1.x installation. It includes a number of other modules like Inline Entity Form to improve UX as well as many features that previously required additional modules like storing and reusing payment methods, stores/marketplace and much more.

That makes it a lot easier to start a new commerce project, especially when adding it to an existing Drupal site or building custom install profiles.

Different terminology and product structure

Instead of using Nodes that reference products, by default Commerce now provides two entity types, Products and Product variations that provide a similar functionality with a considerably better UX. Payment methods from 1.x (e.g. Stripe or PayPal) are now called payment gateways and a payment method is a specific way a user paid, e.g. a specific credit card.

It takes a bit of time to get used to it, but the new terminology makes sense and should make it easier to learn commerce for new developers.

Opinionated, customization through code/templates

Commerce 2.x has an opinion as to how a shop and checkout process should look and work. It also has fewer configuration settings and options as experience has shown that less experienced users often break their installation with the wrong setting. At the same time, the mentioned flexibility makes it easier to customize for developers. One example is the checkout complete message. In 1.x this is a configuration setting, but we never have built a commerce site where just changing that text was sufficient. In 2.x, it is a twig template, which already offers a lot more flexibility in being able to implement a completion page that looks good. The confirmation mail is similar, it is built from a twig template and looks good out of the box.

Designed to be extended, parts replaced and changed

Almost everything is a plugin and there can be multiple variants of everything. That includes for example the checkout flow, there can be multiple variants of that and each uses a plugin. Any entity can be “bought” if it implements a certain interface, and it is also possible to do a checkout without any products at all. A lot of UI components are organized as reusable form elements.
Based on what we have seen so far, Commerce 2.x has a good balance between a good out-of-the-box shop and checkout experience while remaining flexible and customizable for developers.

Don't miss the second part of this blog series! We will go in detail about our experience of Drupal Commerce 2.x in a customer project.

Apr 26 2017
Apr 26

Modular architecture of the Drupal 8 media ecosystem has become a standard. If you want to build media related editorial experience modules like Entity browser, DropzoneJS and Media entity are the way to go. They can effectively handle locally hosted media, but they are not limited to that. Recently we implemented a module that integrates with the Bynder DAM and lets you use its assets directly in a Drupal 8 site.

Bynder offers its clients a friendly and powerful digital asset management tool to centrally manage all their digital assets. With its feature set, friendly and intuitive UI and central delivery of assets it is a great answer for the unified management of your marketing and branding materials.

Bynder approached us with their need to integrate their DAM application with Drupal 8. They wanted to provide their clients the ability to access the assets directly from their website and to use them in a centralized manner. 

Drupal 8 media ecosystem to the rescue

The Drupal 8 media ecosystem was designed with exactly this kind of use cases in mind. While modules like Entity browser and Media entity are able to handle locally hosted media perfectly fine they start to shine when you present them with challenges of this kind.

Media entity allowed us to represent Bynder assets in Drupal without actually copying them over. Yet, its powerful metadata API allowed us to expose and use all information about them in the context of a Drupal website. The end result of this is a perfect compromise between central management of assets and their full availability on sites that consume them.

The Entity browser module on the other hand allowed us to implement a friendly interface that allows users to browse their Bynder assets from the editor perspective of their Drupal site.

Bynder browsing in Drupal 8

And this is not all! If the right assets are not managed in the Bynder DAM yet there is a possibility to use the DropzoneJS driven widget to upload them into it directly from the Drupal site.

Bynder upload in Drupal 8

Remote delivery and display of assets

Bynder wants to provide a truly centralized asset management experience. This means that there should be no local copies of assets. This way we avoid the need to do updates on multiple sides (Bynder DAM & Drupal website). 

In order to support this we implemented a custom formatter for Drupal that communicates with Bynder and displays the assets using its CDN servers.

Successful collaboration

The project was a big success - not only from the technical but also from the organizational perspective. We used an agile approach with constant communication between Bynder and MD Systems. 

We used our extensive experience to consult the client and propose solutions that we felt will work the best with Drupal. And the Bynder team supported us when it came to questions about domain knowledge, the product itself and its application programming interface (API). The quality of collaboration that we had clearly shows competence, experience and true professionalism on both sides.

Custom formatter

Integrate your service

If you want us to support you with integrating Bynder or any other DAM system into your Drupal website, we are the perfect fit! Get in touch and we’ll be happy to present our services and answer your questions.

Mar 27 2017
Mar 27

This is the fourth part of the blog series about the Drupal 8 security features. We already covered Drupal community’s general approach to security, Cross site scripting, SQL injection and Cross site forgery request. I strongly recommend you to read the first, second and third part if you didn’t do that yet.

Sanitization of the user-submitted data in forms

Values that forms submit to the server are not strictly typed or limited in any way. This allows potential attackers to submit values that were not part of the form originally or to change their value or even data type (array instead of a string, ...).

This can potentially be dangerous if the code that processes the submitted values doesn’t check that.

Drupal protects us from that by relying on the Form API to automatically handle sanitization of the data submitted through the forms. It will validate it, remove any unknown fields that might have been added, ...

Drupal’s guidelines strongly recommend to never use raw $_POST or $_GET data. Data sanitized by the Form API should be used instead.


Someone tries to submit a field that is not part of the original form:

Submitted value can be seen in the $_POST superglobal:

But it was removed from the sanitized data (values in the form state accessible via $form_state->getValues()):

It is also worth mentioning that the exact copy of the $_POST/$_GET superglobals gets saved in the form state too (accessible via FormStateInterface::getUserInput()). This values are intended for internal use only. They should never be used in the custom code. If you need to use it then you’re doing something wrong.

Drupal 8: 3, Hackers: 0. Wait… it is probably 5 vs. 0 at this point. Whatever, you get the message, right? :)


We’ve come to the last part of our series about the Drupal 8 security features. We’ve shown how Drupal 8 protects us from some of the most common vulnerabilities on the web. Some of the protecting elements will work automatically and some others will rely on developer’s knowledge and consideration. And this leads to the main message of this post. You should never stop learning and exploring new things. If you do that you risk exposing yourself and your clients to various dangers. And this is not only sloppy but also irresponsible towards people that rely on your skills to sleep peacefully at night.

Did you like it? Follow us on Twitter to get more content as soon as we release it!

Do you need security review of your Drupal site or module? Get in touch!

Mar 21 2017
Mar 21

This is the third part of the blog series about the Drupal 8 security features. We already covered Drupal community’s general approach to security, Cross site scripting and SQL injection. I strongly recommend you to read the first and second part if you didn’t do that yet.

Cross site request forgery (XSRF)

Cross site request forgery is a vulnerability that allows attackers to transmit unauthorized commands from a 3rd party site to the site that trusts the given user. Its results can be similar to XSS, but it works in a slightly different way.

Let’s assume there would exist an URL, that would allow users to delete a Drupal node without confirmation. In this case attacker could build a web page that would try to trick someone with admin permissions on the attacked site to click on a link to that URL. Drupal’s confirmation page comes into the equation at this point.

Looks familiar?

Yes, this page does not exist to annoy you and your clients since “it introduces a UX regression due to an extra click”. It is actually there to protect you from the XSRF attacks. Thank you Drupal!

Another way of XSRF attack is through a form. Let’s assume attacker could trick admin user to do an unauthorized POST request to the permissions form in Drupal. This could have disastrous results.

In order to prevent that Drupal’s form API generates unique form token (using SHA256 HMAC and a secret key) each time a form is loaded or updated. If the token is missing or changed it won’t allow submissions of that form. This ensures that the user that is submitted the form actually loaded it too.

General Drupal’s recommendation is to never use custom HTML forms and to use Form API instead.


Someone tries to do a POST request on admin user’s behalf. But since that person doesn’t know what is the valid value for the form token it tries to submit without it or with some arbitrary value.

Drupal detects that and refuses to accept the submitted data:

That’s it for today. Next time we’ll see how Drupal sanitizes user-submitted data if forms. Follow us on Twitter to stay tuned!

Do you need security review of your Drupal site or module? Get in touch!

Mar 13 2017
Mar 13

This is second part of the blog series about the Drupal 8 security features. We already covered Cross-site scripting and Drupal community’s general approach to security. I strongly recommend you to read the first part if you didn’t do that yet.

SQL injection

SQL injection is a vulnerability that allows attackers to inject custom SQL queries into the entry field (on a form or anything similar). If this kind of input is not correctly escaped the query might end up being executed on the underlying database. Something that we definitely don’t want to happen!

Drupal comes with the database API, which provides solid protection against SQL injection attacks when used correctly. It uses the parameterized queries approach where any attributes that are used with the database query are never concatenated directly to it. Instead they are sent separately to the API where they are correctly escaped before the query string is built.

Database API is just the first level of abstraction in Drupal 8. There is also Entity API with its Entity query API, which is another layer on top of the database API.

As we usually don’t need to define any custom database schemas in Drupal 8 (everything uses entities in Drupal 8 era) we also usually don’t need to use the Database API directly. Most interaction with the database happens through the Entity API, which essentially provides two levels of protection.

For more info about the topic check the relevant documentation sections.


We run a web development shop that is very successful in building great Drupal-based websites for the clients. But success comes with downsides too. The owner of the competing web agency in the same town is extremely envious and it comes up with the evil plan. He will hack our website to make it essentially unavailable, which will ruin our reputation for good.

There is a blog section on our site that has commenting enabled. He plans to use SQL injection on the comment form to delete all nodes from our database. Here is what he does:

Let’s explain what is going on here. Imagine the insert query behind the comment for. It could look something like this

INSERT INTO comment_field_data (subject) VALUES ('Harmless comment');

I agree… this is overly simplified. But it will work to explain Joe’s bad intentions. And you can actually run this query on a Drupal 8 database and it will actually execute and save the row. Now let’s see what kind of query we end up if the user-input wouldn’t be correctly escaped:

INSERT INTO comment_field_data (subject) VALUES (''; DROP TABLE node; --');

We’re facing two queries at this point. First query ends after the first semicolon and has syntax errors, which will cause it to fail. But look at the second one. It is perfectly valid and assuming the user Drupal is using to connect to the database has permissions to drop a table it will execute. Don’t believe me? You can try to run it, but please don’t do it on a production website!

Drupal 8 is obviously smarter than Joe. It escapes the comment subject which prevents the evil plan from succeeding. The result is, again, a bit ugly, but our node table survived.

Drupal: 1, Hackers: 0

Can you see where this is going?

That’s it for today. Next time we’ll see how Drupal deals with Cross site request forgery attacks. Follow us on Twitter to stay tuned!

Do you need security review of your Drupal site or module? Get in touch!

Mar 07 2017
Mar 07

The Drupal community puts a lot of attention into security. Drupal’s security team is the main party that is dealing with security issues and reports. They are monitoring all modules with stable releases that are published on This is one of the many reasons why we strongly recommend all our clients to publish their custom modules or 3rd integration plugins through it.

Another way of ensuring high security standards are APIs that automatically ensure security when used correctly and a set of best practices that should be followed in order to write secure code. The Relevant section of the Drupal 8 documentation provides more information on that. The similar document for Drupal 7 is also relevant, since a lot of things stayed the same since then.

MD Systems is strictly following all recommendations and best practices that the community developed. Even more, since we are one of the biggest contributors in the Drupal community we’re actively taking part in their further development and advancements. We are also using automated tools that can detect some of the security vulnerabilities in the code.

In this series of blog posts we’ll explain some of the most common vulnerabilities on the web and how Drupal secures against them. This time we’re covering XSS, which is probably the most common vulnerability on the internet.

Cross Site Scripting (XSS)

Cross site scripting allows attackers to inject a custom code (usually JavaScript) into a 3rd party site which is then executed on behalf of other users. This allows them to potentially bypass access controls.

Drupal’s general approach to the unsecure user-submitted content is escaping at the display time. This means that we generally consider any content that came from the internal database or from any 3rd party system as potentially malicious.

Drupal 7 relied on developers to properly escape the content before displaying them (using functions like check_plain() and filter_xss()). Useful and easy to use API functions made writing secure code easy, but still prone to human errors.

Drupal 8 made a huge step forward in this areas. In order to secure the system against XSS it automatically escapes all variables that are printed as part of the Twig-powered template system. This means that we’re providing substantial protection against XSS attacks by correctly using provided render APIs.


A naughty content author would like to gain editorial privileges to be able to bypass editorial decisions. He creates an article with some malicious JavascriptCode injected into it. OK, … in real life something a bit more sophisticated than a simple alert() would be needed, but it will work for the sake of the presentation.

Our naughty editor now expects an alert popup to appear when the article is visited. But Drupal 8 is smarter. It escapes the malicious code which results in it being displayed to the entire universe. Not pretty, but definitely secure. The bad intentions of our naughty content author are immediately revealed.

Drupal: 1, Hackers: 0

That’s it for today. Next time we’ll see how Drupal deals with SQL injection attacks. Follow us on Twitter to stay tuned!

Do you need security review of your Drupal site or module? Get in touch!

Jan 30 2017
Jan 30

The Media Initiative was started more than 3 years ago at the DrupalCon Prague. Until recently it focused on contributed modules that are supporting many use-cases in the media domain.

We’ve been part of the initiative since the inception. We organized sprints in 2014 and 2015. In spring of 2016 we joined forces with Acquia to finish some of the most important modules of the ecosystem. Besides that we constantly supported leaders and contributors of the initiative and dedicated many of our own resources to it.

When the Media ecosystem reached a certain maturity level it made sense to start thinking which of the components could be adopted by Drupal 8 core. The Media team had a sprint in December where we have outlined plans for that and done the initial work. Great progress was achieved there but this is just the start.

Media Initiative becomes official

Activities around the Media in Drupal core continued and we are getting closer and closer to getting some of the most basic pieces in. This also initiated discussions about the official status of the Media Initiative which was eventually approved by Dries:

Dries approves the Media initiative.

A patch was committed later that day and the Media Initiative became one of the official Drupal core initiatives. We are also proud to announce that our team member Janez Urevc became the initiative lead!

Perfect media partner

This establishes MD Systems as one of the biggest Drupal experts in the media domain. Combined with all the experience that we’ve gained while building the NP8 distribution and numerous comercial media projects we’re confident to say that we are one of the best partners for media projects of any complexity and size.

We will stay an active part of the initiative and are looking forward for more improvements to become part of Drupal core.

How to help?

We will need to organize a few sprints in 2017 in order to achieve goals that we’ve set for ourselves. We will need some sponsors to cover our workload as well as travel expenses and accommodation for sprinters. We also need more people to step-up and help. If you are able to help in any way please ping @DrupalMedia on Twitter or join the weekly meeting every Wednesday at 14:00 UTC on #drupal-media IRC channel.

The Drupal Mountain camp, which will happen in February in Davos, Switzerland, will also include four days of focused sprints. This is the next opportunity to sprint with and learn from the most experienced contributors from the Drupal Media Initiative.

Jan 09 2017
Jan 09

The Media team concluded the exciting and successful year 2016 with a Drupal 8 core media sprint in Berlin. As a long time media contributor we were part of it of course.

Sprint was hosted by the Hubert Burda media and the Thunder team. The week-long event was attended by many prominent names from the Drupal community: Gábor Hojtsy, Daniel Wehner - dawehner, Florian Weber - webflo, Samuel Mortenson, Adam Hoenich - phenaproxima, Marcos Cano Miranda - marcoscano, Christian Fritsch - chr.fritsch, Mladen Todorović - mtodor, Sean Blommaert - seanB, Philippe Guillard - pguillard, Dietmar Gigler - dietmarg, Tobias Bähr - tobiasb, Katja Heitmann - katzilla, Luca Curella - lucur and our Janez Urevc - slashrsm.

Why is Media in Core important?

We’ve invested quite a lot of energy into contrib media solutions. They are widely adopted and working fine. So why do we need improvements in core? One would argue that this is an unnecessary investment and we could agree to that to some extent. Solutions that already exist in contrib solve many most common use cases. One example is the NP8 distribution that we helped to create. It comes with relatively powerful media handling and wouldn’t really benefit from the same solutions being part of core. Same is probably true also for Lightning and Thunder distributions.

But there are also problems. Contrib solutions often lack good documentation. This means that experienced solution providers, such as MD Systems, can easily build applications with them. But less experienced individuals and teams can have some issues when initially exploring the ecosystem. Core would, on the other hand, remove many of those barriers and make this solutions much more accessible and easier to use.

Another problem is standardization. Due to core’s lack of “leadership” in the media field a few competing approaches exist in contrib. This is true for many, but the most problematic are architectural and UI/UX aspects. This could be solved by core as well as patterns would eventually spill over to contrib.

That said, the biggest winners from better media support in core would be not-so-experienced users who currently struggle with contrib solutions. Another winner would be big and complex websites which would be able to get rid of a lot of complexity due to this change. We also think that this would help driving Drupal 8 adoption in the long run. The entire community would benefit and even more those individuals and companies that are invested in Drupal.

A lot has been achieved...

Janez published a blog post where he summarizes the results that were achieved at the sprint.

[embedded content]

… but a lot still needs to be done

A lot of great progress, but we’re not even closely done yet. In order to realize all the goals that the Media team set for themselves a lot more time and resources will need to be invested - at least few months, as it was mentioned in the video above. Such an effort can’t be done solely by the team of volunteers. We also need professional support and engagement to be really successful.

Berlin sprint was made possible mostly because of a few companies stepping up, allowing their employees to attend the sprint as part of their work time and covering expenses. While that is a quite successful model it definitely isn’t a long term solution to fund the initiative for Media in Core. Specially considering the fact that the entities that enabled last sprint mostly can live with the contrib solutions and already invested a lot of resources in those in the past few years.

Team’s desire is to organize at least 2 or 3 similar (focused week-long) sprints in 2017 since the past experience shows that we achieve greatest results on them. At this point there are no funds secured for that and it is absolutely necessary for more companies to step up and contribute significant financial and other resources to the initiative. It is hard to imagine how Media in Core could see significant improvements without that.

Based on our “20% goes back to the community” rule you can help solving this problem by hiring MD Systems to help you with the next Drupal (media) project.

Next sprinting opportunity is Mountain camp

Drupal Mountain camp, which will happen in February in Davos, Switzerland, will also include four days of focused sprints. This is the next opportunity to sprint with and learn from the most experienced contributors from the Drupal Media Initiative.

See you there?

Dec 19 2016
Dec 19

In less than three months, Paragraphs climbed on the global popularity list from #244 to #223 out of 36’126 projects on

People love to build their content websites with Paragraphs, because it creates consistent, appealing experiences, with simple usability. It is frequently present in all our common channels, from tutorial blogposts, success stories, case studies to camp sessions, with promotions to newsletters and Drupal Planet. That’s awesome!

The missing collaboration

Paragraphs is used as a framework and every few days or weeks new modules are popping up, building on top of it. Its impact is wide, from modules defining paragraph types for richer use of media, various layout tools and style, functionality such as sliders, alternative user interfaces, and many more.

There is so much energy spent to build all these things, but most of the solutions have been created in isolation and user adoption stays very low. In order to get to the full potential of Paragraphs to the benefit of everyone, we need more. We need true collaboration on Paragraphs.

Many ideas implemented in these modules are not new. Some of these ideas even have been widely discussed in issues for years, waiting for someone to implement it as a standard feature. To succeed, we need to be better out of the box and perform with a stunning simple user experience. And if we do so, we can remove options (and with it complexity), because that solution will fit better to everyone.

Calling for collaboration

As a next step, we will reach out to all the maintainers and invite for collaboration. We will create one issue in each project and open the discussion to transform functionality into Paragraphs itself or how we would recommended to implement and maintain it. MD Systems offers free mentoring for developers that dedicate their time to collaborate with us.

We will do a next status presentation at Drupal Mountain Camp in February (16-19) and we will also cover all related modules. Paragraphs will be a primary sprint topic during the event and we will add 3 days of community sprint in January (24-26) to prepare. Signup now!

We are strongly dedicated to bring Paragraphs to the next level and are looking forward to collaborate with everyone from the community. Get in touch with us and we will figure out how you can help.

Nov 08 2016
Nov 08

About two months ago we released a re-design of on NP8, the Drupal 8 distribution for news portals that was created by Somedia and Gassmann in cooperation with MD Systems. Since then we released three more websites for the same publisher. Netzmedien is a publishing company that is focused in publications for tech-savvy audience.

Somedia Production as project lead was in charge of project management and design while we have been hired for the functional and frontend implementation.

As long term newsletter subscribers of the Netzwoche newsletter we are especially proud that a client with such a demanding customer base chose NP8.

NP8 distribution for rapid development

A rich set of features, its advanced components and the modern technology of NP8 allowed us to develop sites very rapidly. After the initial release of we published another media portal every two weeks. This achievement would not be possible without the right tool for the job. NP8 once again proved to be an excellent solution for mid to high profile media websites. 

Features like paywall, newsticker, marketplace, search, dossiers, ad provider integration and many more allow its users to focus on what is most important for them - creating and delivering highest quality content.

Would you like to know more about NP8? Let us know. We will be happy to prepare a free demo.

There is a Netzmedien website for everyone

All of the portals we created are oriented towards tech-savvy readership, but they still focus on slightly different target groups.

Netzwoche Website is an on-line version of the most popular Swiss ICT magazine. It is aimed at the decision makers and opinion leaders in the areas of IT, telecommunications, e-commerce and web technologies. 

IT Markt website is a media platform for the Swiss IT sector. It is focused towards the suppliers of IT products and services, value-added resellers, system integrators and distributors in the Swiss IT market.

CEToday website’s main topic is consumer electronics. It covers everything from personal computers, smartphones and tablets to fotography, HiFi and smart home products.

ICTjournal website

ICTjournal, the last but not least of the Netzmedien family is an ICT focused media platform focusing on the Western part of Switzerland. It addresses business decision-makers and opinion leaders in the areas of IT, telecommunications, e-commerce, web and mobile technologies. The specialized editorial team follows the global markets and regularly delivers online news, in-depth background reports and interviews.

Integration with Woodwing Content station

Woodwing Content Station is an enterprise multi-channel publishing platform. Content for all four websites is created and curated on it and seamlessly delivered to the each individual platform. In order to achieve everything that our client required we worked with Woodwing’s developers to improve the official Woodwing integration module for Drupal 8

Multi-channel and digital-first publishing is one of our special interests and expertise. During our day-to-day work with media publishers we’re identifying many problems in this field that need to be solved. We believe that this project was another piece in a huge puzzle which we’re actively working on and are planning to push forward in the future. 

This project represented just a start of what we’re hoping to become a fruitful long-term collaboration. We’re currently working on a Drupal 8 integration with Woodwing’s digital asset management (DAM) subsystem, Elvis. Follow our blog if you’d like to hear more about this in the near future.

Are you excited about similar topics or do you need a partner to help you solving the multi-channel and digital-first publishing problems? Get in touch. We’ll be happy to talk to you.

Oct 07 2016
Oct 07

We really like to attend Drupal community events. Our company is regularly attending meetups, camps, sprints and conferences. Often we’re involved in the organizational part of many of those (on that note… if you haven’t checked Drupal Mountain Camp you definitely should).

There are few events that have a special place in our hearts and DrupalCon is definitely one of them. It is the biggest and the most important community event, which, as you likely already noticed, happened at the end of last month in Dublin. Obviously we were there too!

Group Photo - Tuesday - DrupalCon Dublin 2016

DrupalCon Dublin 2016 group photo.

Why did we go to Dublin?

Because everyone is there; community leaders, most influential members of the community, decision makers, prospect clients and individuals that we could potentially work with in the future. Just this makes DrupalCon very appealing to attend. If one wants to be up to speed with the most important developments in Drupal (and, of course, this is in our DNA) practically needs to be there or it is left behind.

In order to provide the best service for our clients we follow and help setting the trends and need to be informed and involved in the most important discussions about the future of the Drupal and internet in general. This is only possible by being actively involved with the community and DrupalCon plays a very important part in this.

Prenote - Tuesday - DrupalCon Dublin 2016

Our friend Josef Dabernig (@dasjo) from Amazee labs capturing an important moment.

We presented!

One of our lead-engineers, Janez Urevc (@slashrsm), gave two talks as part of the main conference schedule. The first one was about the Entity browser module, which can significantly improve content creation user experience on your website and is part of the NP8 distribution by default.

Did you miss it? No problem! All sessions at DrupalCon are recorded:

[embedded content]

Would you like to know more about the Entity browser module and its capabilities? Do you need someone to help you integrate it into your site? Or maybe build an integration for a Digital Assets Management (DAM) system or a 3rd party content provider? Let us know and we’ll do our best.

We discussed and planned!

The second session that Janez gave was about the plans for media asset management improvements in Drupal core.

[embedded content]

In the talk and the discussions that followed we defined a concrete roadmap, which will bring significant improvement in this area, such as media library, re-usability of media assets and support for YouTube videos, as early as Drupal 8.3.0. Stay tuned!

Are you struggling with media asset handling in Drupal? There is no need to wait until the next minor release of Drupal. A lot of this is already possible today with the right tools. Get in touch and we can help you learn how to do it.

DrupalCon Dublin - 03 Tuesday

There is no Dublin without a pint of beer.

We sprinted!

Contribution sprints are part of the most community events and DrupalCon is no exception. Our CTO Sascha Grossenbacher (@Berdir), who is one of the top 5 Drupal contributors, worked hard on some of the thoughest problems in Drupal. From entities and revisions to file usage tracking and multi media asset handling. There are not many Drupal 8 subsystems that Sascha didn’t touch at some point in the past few years. Having people like him in our team, together with our vast experience, makes MD Systems one of the most experienced Drupal teams in the world. Hiring us for your next project is a recipe for success.

Where to see and meet us next?

We are one of the proud sponsors of the IronCamp, which will happen in November. We are, as already mentioned earlier, one of the organizers of the Drupal Mountain camp, which will happen in February 2017 in Davos.

If you happen to be in Zurich, Switzerland at the beginning of November we kindly invite you to join us at Drupal meetup, which will happen on November 2nd in our office.

Interested to be among the first to hear about the initiatives and events we’re being part of? Regularly check our blog for more updates!

Sep 28 2016
Sep 28

It is probably no secret that we are one of the bigger contributors to Drupal (definitely the biggest when company size is taken into consideration). Contribution is part of our daily routine. Every time when we run into a problem that can be resolved in a general/community way we try to do that. Our developers are active in the issue queues on a daily basis. Working in the issue queue is as common as checking new messages on our company’s Mattermost channels.

We often lead long-running focused initiatives

On a daily basis, while working on client projects, one is able to do a lot, but still not enough to push forward bigger initiatives and changes. In order to be able to do that too we regularly lead long-running focused initiatives. Examples of such initiatives are Media, Translation management, CRM and more.

Our focused initiatives helped push forward a lot of critical subsystems in Drupal 8. Due to the success of our past work we’re convinced to continue with similar activities also in the future.

Clients and community both benefit from the MD System’s commitment

At MD Systems we feel responsible towards the community. We believe that we and our clients are going to be successful if the Drupal community will be successful too. As a client, by working with a service provider that is heavily involved with the community, you benefit in form of constant innovation, hassle-free updates, continuous deployments of latest functionality and generally better experience.

Because of that we strive to invest 20% of every project’s value back into the community. Let’s put it that way. If you hire MD Systems to do your next Drupal project, audit your site, organize a training or a bootstrap week, implement a Translation management translator plugin or DAM integration for media ecosystem community will directly benefit from that.

If you are interested in our work do not hesitate to contact us and if you’d like to hear more about the things we’re currently focused at follow our blog as we’re preparing some more exciting stuff for you in the following weeks.

Are you at DrupalCon Dublin? So are we. Poke Sascha Grossenbacher (@berdir) or Janez Urevc (@slashrsm) if you’d like to meet us there.

Aug 09 2016
Aug 09

At the beginning of July we attended NYC Drupal camp, which is part of a bigger, mission-driven open source conference called Open camps. NYC Drupal camp is one of the biggest community-organized Drupal events in the world and we are always eager to return to it.

Digital media and publishing is, due to the strong media ecosystem in New York, one of the main topics of the conference. There is a focused media summit, many media related sessions as part of the main conference, a week-long media sprint and more. We are heavily involved in many aspects of the media field.

We were involved into few of the earliest Drupal 8 news portals, developed the NP8 distribution, were and still are one of the most dedicated contributors to the Drupal 8 media initiative and more. Considering all this facts it is not hard to understand why we feel that we need to be part of the event like this.

We presented NP8 distribution & improved Drupal media handling

In the past, we invested a lot of time into image cropping in Drupal 8. Main results of that were the Crop API and Image widget crop modules. Together they provide you great image cropping experience based on a simple, standardized and robust architecture. One of the members of our team, Janez Urevc, gave a session about the topic together with Alex Ross from NBC (author of the Focal point and Advanced image crop modules).

We were also attending the media summit where we've seen a lot of interesting presentations and shared knowledge with people with similar interests and background. We presented there, too. This time it was about the NP8 distribution that we built together with our partners.

NP8 is one of the most feature-rich enterprise media & publishing distributions on Drupal 8. It ships with many interesting features by default. From numerous default content types and performance optimizations to fully functional paywall solution and AMP integration. Need a marketplace? We've got you covered. Powerful multi-media handling? We've got that, too. FAQ pages? Yup, that too. Newstickers? You know the answer already, right?

Did we get your attention? Are you excited about NP8 and would like to know more? Maybe you'd like to see a demo to evaluate it for your next project? Let us know and we'll make sure to answer all questions that you might have.

We also attended the media sprint as part of which we worked hard to get closer to the beta releases of the few modules that we're extensively using on our projects. A lot of extremely cool features were introduced to the Entity browser, which is now much more aware of the world around it, it is able to validate your actions much more confidently and it is much easier to use it as part of your custom code.

Besides all new features that people were asking for we made a big step forward when it comes to stabilisation of the ecosystem. This will make your life much easier and working on your Drupal 8 projects much more enjoyable.

Drupal Small Groups
Samuel Mortenson, Adam Hoenich and Janez Urevc in deep discussions about media. Photo by Photographic Intrinsic.

Where can you meet us in the future?

We are planning to attend few more events this year. Main one is definitely DrupalCon Dublin where Janez will be giving two sessions. We are the most excited about the core conversation about the multi-media handling in Drupal core. The goal of the conversation is to create a long-term plan to make Drupal the best media handling CMS in the world. On the other hand - if you'd prefer to hear more about the cool things that you can use today to improve content creation UX, then the session about the Entity browser module is a must for you.

Are you interested in the stuff we're doing? Would you like to meet and talk to us? Get in touch)!

Jun 28 2016
Jun 28

One of our favourite community events, Drupal Developer Days (DDD), happened last week in Milan. DDD is an event with rich history and strong tradition. It is independently organized by the Drupal community. 

DDD is primarily developer focused and community oriented. This makes it a perfect place to work side by side with other developers from the community, meet new people with common interests and start new initiatives and collaborations.

What were we doing at DDD?

Four members of our team were attending the event this year. John Gustavo Choque Condori and Miloš Denčev were sprinting on the Paragraphs module and the Media initiative for the entire week. Miro Dietiker and Janez Urevc joined few days later to help with the sprinting efforts and to present at the conference part of the event.

Italian style dinner at Navigli in Milano. #drupaldevdays

— Dragan Eror (@draganeror) 23. Juni 2016

From right to left - John, Miloš, Miro, Janez and Dragan (our friend and former member of the MD Systems team).

Paragraphs are ready for Drupal 8!

Miro and John gave a talk about the Paragraphs module, which we use on many of our projects. Our company invested a lot of resources to help porting it to Drupal 8 and we are proud to announce that the Drupal 8 version of the module is ready to be used!

Paragraphs module is ready for use in production! #drupaldevdays session by @miro_dietiker

— Dragan Eror (@draganeror) 24. Juni 2016

Check out the presenation of Miro and John.

Media is more powerful than ever

Janez gave two presentations; about Entity browser and Entity embed modules. Both were born as part of the Drupal 8 media initiative to solve two of the most common problems in that field. However, they were designed to be general, which allows the users to use them also outside of media.

Entity browser is a general entity browsing and selecting tool that improves UX in any case where referencing of entities is required. The most common use case for it is any type of the entity reference field.

I just gave a session about Entity browser to this nice crowd. Thank you for coming. #drupaldevdays

— Janez Urevc (@slashrsm) 24. Juni 2016

Check out the Entity Embed presentation of Janez.

Entity embed is a module that allows the users to embed any renderable entity type into WYSIWYG editor. It is based on the best practices that core established and are using exclusively standard tools like field formatters, view modes and text filters.

Drupal Dev Days Milano 2016
Janez shows how the data is grabbed for embedding.

Check out the Entity browser presentation of Janez.

You can benefit from all these modules today. They can help you to significantly improve user experience for content creators and make the structure of your content much more flexible. We at MD Systems have extensive knowledge about them as we were involved in the planning, design and implementation from the very beginning. If you need assistance or support in those areas do not hesitate to get in touch. We are one of the biggest experts in the Drupal community and we will be able to help you even with the most complex problems.

DDD 2016 was great!

We really enjoyed the event and are already looking forward to the 2017 edition. DDD was and still is one of our favourite Drupal community events.

We would like to thank to the Italian Drupal community, organizers of the DDD Milan for their great job. Event was flawlessly organized; venue was on a nice location, atmosphere was great and food was amazing! But the best part was extremely friendly, hospitable and welcoming Italian community that made us feel almost like at home. Thank you!

Jun 14 2016
Jun 14

It is no secret that we at MD Systems take community very seriously. We have invested time and money in many Drupal 8 initiatives in the past 3 years. This has helped us adopting Drupal 8 sooner than the majority of the community and also resulted in MD Systems becoming the number one contributor to Drupal.

MD Systems, Drupal 8 and media

It is probably not that obvious why we are heavily involved in the media and publishing field. Together with our partners we developed NP8, the enterprise digital media distribution on Drupal 8. As a result of that we have been and still are working with many media clients and have already launched several media websites on the Drupal 8:

When developing NP8, we have significantly contributed to the Media ecosystem in Drupal 8 and have helped to bring it to a fairly mature state. We have built many modules that solve specific problems and if one knows how to combine them sensibly, it is possible to cover most use cases that our clients have. However, there is always room for improvement. At this point we’d like to stabilize the most important components of the ecosystem and provide pre-configured solution modules on top of them. This should encourage more users to start actively using what we’ve built so far.

Many modules released recently

To solve the first problem we recently joined forces with Acquia. More precisely its Drupal 8 module acceleration program. This allowed us to dedicate some more time to working on the modules of the media ecosystem and push them to a more stable state. This resulted in many commited issues over the course of the last month or so:

  • Media entity 8.x-1.0: Storage layer designed with lean support for remotely hosted media assets in mind. At the same time we also released many of it's plugins: image, slideshow, Twitter, Instagram and audio. There are also plugins for embedded videos and documents, which were developed and released by their maintainers.

  • File entity (fieldable files) 8.x-1.0-beta1: This very well known module from Drupal 7 finally got its Drupal 8 version. It upgrades core's files to full featured entities to be fieldable and displayed on their own.

  • Field formatter 8.x-1.0-beta1: Provides a few very useful generic formatters. They allow us to display a single field from a referenced entity or wrap output of any other formatter with a link. 

  • Fallback formatter 8.x-1.0-beta1: Another generic formatter. It allows us to use more than one formatter on a single field.

Beta blockers removed

Additional to that we fixed all but one beta blocker (cache-related) of Entity embed, our WYSIWYG embedding tool. This module is already very stable and in use on many live websites. We are striving to release first beta in next few weeks, but we'd like to encourage you to give it a try right now.

Our main focus at this point is Entity browser. We still have some issues which need our attention there. Those focus mostly on improving the site-builder’s and editor’s experience. We are adding support for conditions related to the expected selection and the ability to edit existing selection. The first issue will make the browser aware of the nature of the entities expected from it, which will prevent many cases of mis-configuration and confusion that comes from that. The second issue will enable us to build editorial workflows that are not possible at the moment, which will vastly improve the content creation experience.  We are planning to finish those tasks and release beta in approximately one month.

The last two modules are our main priority at the moment. Work on them will continue throughout June. We will also attend sprints and present about media in general at DevDays Milan and NYC Drupal camp.

Help us improving media

Test the tools that we mentioned, let us know if you experience any problems and submit patches. We also need to improve our documentation. If helping other people excites you, check D8 media guidebook and submit pull requests with improvements.

Join us on sprints. We are always happy to help new contributors to get started.

Spread the word. It is absolutely crucial that we raise awareness about our work and encourage people to use our tools.

Tell your friend about it, present at your local meetup or simply tweet this post. Everything helps!

MD Systems offers support

Would you like to start building your next media project on Drupal 8, but you’re a bit scared or not sure where to start? We are always happy to help. Get in touch and let us know how we can help you. 

We will write more posts as we have new exciting news to share with the community. Stay tuned! 

May 31 2016
May 31

Paragraphs recently gained focus and wide adoption in modern Drupal projects. The module is showcased on almost every DrupalCamp or DrupalCon as a best practice for advanced content creation in applications with a growing frequency of blog posts.

With our experience in Media, we at MD Systems have decided to target Paragraphs as a focus topic for the future of content creation. After joining the team of maintainers, it was time to call the community for a workshop.

Count down for a stable release

During the past 4 months, John at MD Systems has led development to rebuild deep internals such as the storage and to clean multilingual support with full test coverage. The demanding paragraphs widget led us to discover many hidden areas of complexity and even limitations and bugs in Drupal core. After all recent improvements, we now rarely see new bugs reported.

We started the workshop on Thursday with a group of 10 participants by setting up a public Trello board and revisiting all known issues. The goal was fixing plain functional issues and also polish the UI for more consistency.

An RC5 release candidate was shipped, probably the last one. A stable version is near!

The future of content creation

Drupal core enables you to build rich platforms without a single line of code. It still needs tools like page manager and panels to build rich landing pages. Content creation means picking a content type and filling a set of fields, previously defined by a site builder. A greatly pluggable WYSIWYG editor allows us to build tools to embed pieces into content, but complexity still grows and managing HTML is hard. With omni channel outputs, WYSIWYG is more misleading, because an uneducated user will assume that everyone else will see it the same way. Still, Drupal does not semantically understand the HTML inside a body field.

In contrast, Paragraphs can satisfy many future requirements of content creation. The editor is empowered to flexibly combine predefined visual components. A rich landing page with a slideshow, a testimonial, a form, a parallax background image and action buttons is easy to create without a site builder getting involved.

Through the cleanly managed definition of each component, the CMS is aware of semantics and can also easily feed modern decoupled architectures with structured data. A responsive design is always in a well defined state.

But, if Paragraphs is the solution to everything, what is missing?

Shaping the future of Paragraphs

The workshop invited for extensive discussions to exchange ideas for improvements and tell us about individual use cases from the community. In two blocks we analysed problems, possible solutions and the values these provide. We realised that we need to decide, if we want to stick to the typical Drupal core backend editing functionality, try to improve the Drupal core quickedit approach, or even start an alternative UI project that is derived from one of the many other recent frontend content creation UIs.

Quickedit is a great tool to demonstrate the ease in content editing, but it has many limitations for content creation. The workshop participants are not using it and it turned out to be challenging as the steps to make it satisfying are unclear and a comparison of complexity versus value is hard.

When discussing the ideas for an alternative UI, we realised that there is great room to improve the backend user interface in valuable smaller steps. In order to build a satisfying UI, we also need to learn much more about our editor’s requirements and the use cases.

A standard paragraph type collection

More and more agencies using Paragraphs support the idea of maintaining a pool of standardised paragraph types. The standard collection will neither be a distribution nor a demo module. It will be a regular module that maintains a set of best practices for Paragraphs, with deep integration with further contrib modules and initiatives such as Media. The module will also offer an improved editor experience for frequently used paragraph types such as a grid layout, color styles and a slider.

Without the need for extensive site building, it will allow you to jumpstart your custom project with a nice content creation experience from the start. And it will not limit freedom of advanced customisation. This approach will significantly reduce cost and complexity of a custom site.

The collection will be started shortly after the release and will further evolve with every single project at MD Systems and other community contributors. A specific sprint will be organised in the coming months.

The Paragraphs Initiative needs your help to make it happen. Contact us if you want to support the ideas or you want to discuss your custom requirements.

May 18 2016
May 18

Since April, MD Systems has been in the first place of the global ranking of Drupal companies. This outstanding position is the result of a steadfast realization of a long term open source strategy together with our clients.

Drupal published a ranking for the globally most active Drupal companies in 2015. Since the beginning, MD Systems has constantly been on the second place and now could leap into first place. The success is strongly correlated with the long-term and globally unique Open Source strategy of MD Systems.

Open Source as business value

On first sight, Open Source and business do not seem to fit. Why should a company rely on an Open Source solution? As an IT service provider that relies on free software very successfully, we have the correct answers to that question, of course.

In today’s world where technologies change faster and faster and the requirements of a web project grow ever bigger, software is getting more complex. Almost no company is able to afford the creation, maintenance and development of an individual solution by itself. Therefore, Open Source is the perfect concept to keep up with the constant changes and is increasingly also the driver of innovation in general. Anyone using Open Source technology intelligently and with foresight will automatically benefit from improvements implemented by others and will therefore not lose connection to new technologies.

Multiple advantages for our clients

Of course, we also develop individual solutions that are not published. To keep the costs down, we limit the complexity of individual solutions to a minimum. If we see that requirements of one project also occur in other projects, we further develop the existing solution with the client. Thus, the client gets a tailor-made Open Source solution.

The clients benefit from:

  • low cost development through the usage of standard components. As the base of the feature has already been developed, tested and is now in operation, parts of the cost for architecture, development and testing can be used elsewhere or can be saved.
  • secure software, because quality assurance is implemented consequently and security criterias are examined.
  • low cost maintenance, because standard components have maintainers and therefore are frequently updated.
  • new features, as modules on are being developed. Thus, web projects get new features without incurring development cost.

Open Source strategy of MD Systems

The strategy of MD Systems of consequently relying on Open Source has further advantages. Our employees have significantly less repetition in the projects as standard features can be reused and only need adaptations for the clients. The employees can focus on developing individual solutions and therefore improve their skills. This increases their motivation, which has positive effects on client projects, as well.

As maintainer of more than 50 active modules, we are strongly involved in Open Source initiatives (Media, CRM, etc.) in which we are collaborating with other maintainers, i.e. the Drupal community. We also take the  lead in the strategy of innovation creation and always move Drupal ahead. The statistics on show that we contributed to more than 400 issues within the last 90 days. This is not merely a snapshot as we have delivered over 1600 issue credits within a year.

Unique expert knowledge at MD Systems

Thanks to the steadfast realization of our strategy, we have acquired unique expert knowledge. We know almost all relevant and well maintained modules on and can therefore guarantee our clients to only use the best suited modules in their web projects. And incidentally, we now are on the first place of all Drupal service providers of the world.

Apr 08 2016
Apr 08

The annual "Best of Swiss Web" awards took place in Zurich on Thursday, April 7.

We are proud that the Relaunch of Le Temps won Bronze in the category Usability. The award is the proof of a fruitful collaboration between Antistatique, Le Temps and MD Systems. The NP8 based platform therefore is one of the best websites that have been created in Switzerland in 2015. Congratulations!

Find here more about the Best of Swiss Web Awards.

Apr 06 2016
Apr 06

On Monday, April 4th 2016 another news portal based on NP8 has been published: Somedia Production was responsible for project management, design and the frontend implementation, MD Systems did the functional implementation. Amongst other features, an individualised paywall was introduced.

Newsportal of Zürcher Oberland Medien AG

The new webportal of Zürcher Oberland Medien AG has merged the websites of “Zürcher Oberländer”, “Anzeiger von Uster”, “Glattaler”, “Winterthurer Stadtanzeiger” and The focus of lies on news and backgrounds to politics, society, economy, culture and sports in the Zürcher Oberland and the greater Winterthur area.

New paywall features

An important change is the newly introduced paywall. NP8 contains a flexible and extensible paywall which can easily be adapted for the individual business models of any news portal with low costs. offers a lot of subscription options. The users are able to combine the various print newspapers with an online access or simply just buy an online access. Also, it is possible to completely hide all the ads for an additional fee.

NP8 as the perfect base for news portals

Of course, there were a lot of other adaptions and new features like BabyfotosBlaulicht, Newsticker, etc. Once again, NP8 proved to be the perfect base for such a news portal.

Thanks to the extensive standard functionality of NP8 the project team could focus on individual requirements of and keep development costs on a low level.

Mar 29 2016
Mar 29

Translation Management (TMGMT) has reached its largest milestone since the project was started in 2011. We are excited, that Continuous Translation is now a standard feature of TMGMT core. The system can be configured to automatically submit new or updated content to the translation service provider. With a first release candidate, we are closing the current development phase.

We've been busy - more than 100 commits

Since beta2 (January 22nd), a team of up to 4 developers did more than 100 commits for extending and improving the main project alone, and also worked on additional plugin modules for service providers.

The completed version is an answer to all major requirements for translation job management since the project beginning in 2011.

Most importantly: Our new UI offers a better overview through new features such as global job item overview. Further, all elements have been reduced for better accessibility and productivity. Each workflow has been reviewed and improved to eliminate possible causes of inconsistency. Translation management now detects if the source changed and asks the reviewer to fix the situation. A reviewer now also is checked to have sufficient permissions for the current security settings or can not accept an item.

Still, we are not out of ideas for features such as adding a translation memory to TMGMT. But that’s something for the next phase...

Easier management thanks to Continuous Translation

As the most recent and an important achievement, TMGMT offers to trigger fully automated translation workflows through Continuous Translation. Unlike normal jobs that have a fixed set of items, job items for continuous jobs are automatically added when content is created and updated. This feature allows to automatically translate the site's new content - without any manual interaction.

Combined with the auto accept feature, Continuous Translation offers true delegation of the translation workflow by allowing the translation service provider 100% remote control over the process. And if a provider supports the remote preview, perfect quality assurance isn’t wishful thinking anymore. Thebigword is the first translation service provider that supports both Continuous Translation and Preview Rendering.

Now, most of the work for the first stable release is done. We currently focus on minor polishing and quality assurance.

Upgrade your integration now

As Continuous Translation requires support from translation service providers it will be visible only if the provider supports it. Google and Microsoft translation are the first two machine translation providers supporting the feature. Other interested providers are welcome to connect with us for making their plugin ready for Continuous Translation, too.

The status of TMGMT was presented on the Drupal User Group Zurich meeting on March 24th and will be presented on Drupal User Group Basel meeting on March 31st. Here you can find the slides.

About Drupal Sun

Drupal Sun is an Evolving Web project. It allows you to:

  • Do full-text search on all the articles in Drupal Planet (thanks to Apache Solr)
  • Facet based on tags, author, or feed
  • Flip through articles quickly (with j/k or arrow keys) to find what you're interested in
  • View the entire article text inline, or in the context of the site where it was created

See the blog post at Evolving Web

Evolving Web