Exploring Drupal V6, Part 2: Extending Drupal with modules

Once upon a time — say, 10 years ago — operating a Web site was something of a novelty. Today, a Web site is not only de rigueur but it's an essential component of any endeavor. Learn how to use Drupal's modules to build, customize, and secure your site.


Martin Streicher, Editor in chief, Linux Magazine

Martin StreicherMartin Streicher is the editor in chief of Linux Magazine. Martin earned a Master of Science in Computer Science from Purdue University and has been programming UNIX-like systems since 1986 in the Pascal, C, Perl, Java, and (most recently) Ruby programming languages.

developerWorks Contributing author

08 September 2009

Not all concerns can afford complex commercial content-management software, nor invest in custom development. Indeed, large expenditures are atypical and increasingly unnecessary, as a wide variety of lower-, low-, and no-cost software is available. In fact, the open source community proffers several capable, free-to-acquire, and free-to-use packages, including Joomla! (written in PHP), Radiant (written in Ruby on Rails), and Zope (written in Python). Another option — and one that's particularly popular — is Drupal, also written in PHP.

Frequently used acronyms

  • CMS: Content management system
  • HTML: Hypertext Markup Language
  • URL: Uniform Resource Locater

Drupal is notable because it is easy to install on any platform, capable from the get-go, and readily extended with thousands of pre-built modules or your own custom code. A Drupal site can serve modest goals and yet expand to include cutting-edge features.

Figure 1 from Part 1 of this "Exploring Drupal V6" series reflects the principle tenet of Drupal's approach. Content, or a node in Drupal parlance, has only a minimal set of core fields. Additional metadata, or data about the node, can be added by a module. For example, a module can augment an existing node with comments or ratings or extend a node to manage and display an entirely new form of content, such as a video reel.

Figure 1. Drupal's content model: Simple nodes and lots of extensions
Drupal's content model

Part 1 describes the core features of Drupal V6 and shows how to install the software on a UNIX®-like operating system. This second of three articles in this "Managing Drupal V6" series shows how to add a module and administer it, and the other core features found in Drupal V6, which is the latest version of the software. Refer to Part 1 for instructions on installing Drupal. The example in this series uses Mac OS X, but installation on UNIX® is similar. To install Drupal on Windows®, visit the Drupal Web site (see Resources).

Installing a Drupal module

The Drupal Web site boasts an enormous catalog of modules. You can browse the list by name or by category, such as Mail, Search, and Administration (see Resources). Because this article focuses on administration, let's install a module to simplify the chore. The Administration menu module centralizes all management functions in one menu, making it easy to find the task you'd like to perform.

Assuming you followed the instructions in Part 1, your Drupal site is found at a URL resembling http://localhost/~name/drupal-6.12, where name is your Mac login name. Point your browser to the Drupal URL and log in as the site administrator. On the landing page, click Administer to expand its list of options, then click Site Building > Modules. This is the area that enables and disables modules. You must visit this page after you add a module and before you intend to delete a module.

To install a new module, download its code from its project page, extract it, and copy the module to Drupal's module subdirectory. Each module is self-contained in its own folder, so installation is a snap.

Download the latest stable or "recommended" version of the module compatible with Drupal V6. Modules written for Drupal V5 do not work with V6. The latest stable version of this module is V6x-1.5, dated 2 Jul 2009. A module is typically distributed as a so-called "tarball" (a Gzip-compressed TAR file). Use tar z to unpack it.

$ cd /tmp
$ wget http://ftp.drupal.org/files/projects/admin_menu-6.x-1.5.tar.gz
$ tar xzf admin_menu-6.x-1.5.tar.gz
$ ls -F
$ cp -pr admin_menu ~name/Sites/drupal-6.12/modules
$ ls -F ~name/Sites/drupal-6.12/modules
README.txt			filter/				search/
admin_menu/			forum/				statistics/
admin_menu-6.x-1.5.tar.gz	help/				syslog/
aggregator/			locale/				system/
block/				menu/				taxonomy/
blog/				node/				throttle/
blogapi/			openid/				tracker/
book/				path/				translation/
color/				php/				trigger/
comment/			ping/				update/
contact/			poll/				upload/
dblog/				profile/			user/

With the folder in place, return to the browser and refresh the administration page. In a moment, you should see the new module at the top of the page in a new section titled Administration, as shown in Figure 2. Select the check box to enable the module, then click Save Configuration at the bottom of the page. After the refresh, the special menu appears as a black bar at the top of the page.

Figure 2. New Administration menu module after installation
New Administration Menu module after installation

Removing a module from your Drupal site is as simple as adding it: Simply disable it and save the configuration. Once disabled, visit the Site Building > Modules page and click the Uninstall tab. Select the check box associated with the module, click Uninstall, and acknowledge the decision. Uninstall removes all the data the module had accumulated. However, it does not remove code from the modules subdirectory on the file system; you must perform that step manually. Until you remove the code, the module remains in the module administration page, where, if you desire, you could re-enable the module. Think of Uninstall as a "reset," unless you also remove the code immediately after.

For the time being, leave the module installed and enabled. It is a convenience and helpful for learning. The module is only visible to you, the site administrator, and any user to whom you grant access.

Roles and permissions

Speaking of access, not all Drupal users are equal. As the site administrator, you can change the site as you see fit. Others, however, should have much more restricted access. The rule of thumb is to grant only those privileges one requires and no more. For example, in an online news organization, a staff writer may be limited to composing, saving, and editing articles he writes. In contrast, an editor may be able to edit, save, and publish (make public), but not delete articles. No matter the purpose of the business, stratification typically exists and must be enforced.

In Drupal, a role represents the job someone performs, such as writer or editor, or a class of users, such as "staff." A permission is the right to perform a task, such as download a confidential file or post a rating. Each Drupal module can define its own permissions, and each of those can be permitted or redacted as you see fit. You can grant or deny a role any number of rights spanning all the modules.

Let's look at an example. Return to the module administration page, and find and enable the Upload module. To confirm proper operation, remain logged in as the administrator, visit an existing post or create a new post, and verify that an input section labeled "File attachments" appears close to the Save button. If so, the module is operational.

Allowing anyone to upload an arbitrarily large file is probably ill-advised. To restrict that task to a subset of your constituents, you must establish a role, grant it permissions, and assign one or more roles to each user. Using your newfangled administrator's menu bar, choose User Management > Roles. A page like Figure 3 appears.

Figure 3. A role is a class of users or a particular job in a workflow
A role is a class of users or a particular job in a workflow.

As the message on the page mentions, Drupal has two embedded roles —anonymous user and authenticated user— that cannot be deleted. The former is any user who is casually browsing the site, but is as yet unknown to the system. The latter is a user who has provided proper credentials and is logged in. Although these roles cannot be deleted, you can assign no, some, or all permissions to either role. Other roles you create cannot differentiate between anonymous users and authenticated users, so some auditing of permissions for these essential roles is likely warranted.

To create a new role, type its name in the blank field, then click Add role. For instance, add Staff for employees. To assign the new role permissions, click edit permissions. The next page you see, akin to Figure 4, is a list of permissions per module. At the top of the current list is the right to view the administration menu, which is attributed to the Administration menu module. Now scroll down: The core node module provides a lengthy list of rights you can tailor to an editorial workflow. At the bottom of the list, you should find the two permissions for the Upload module. A column of check boxes appears at the far right of the page. Select a check box to grant the respective right to the named role.

Figure 4. Each Drupal module can define permissions
Each Drupal module can define permissions

Grant both Upload module rights to Staff, then upload a file and view the files.

So far, no user is assigned to Staff. To verify that the rights work, create a new user, and label that user Staff. Click User Management > Users > Add User, and complete the form that appears, shown in Figure 5. To add the user to Staff, select the check box for Staff under Roles, then click Create new account.

Figure 5. Assign roles when you create a new user
Assign roles when you create a new user

You use this same form to modify the roles of existing users, too. Click User Management > Users > List to enumerate all users, and click Edit under the Operations column to access this page.

To verify that your new user and class of user has access to the Upload features, log out to become the anonymous user and browse a piece of content that has an attachment. The anonymous user should not see the attachments. Now, log in as the new user, and verify that you can add attachments and peruse existing attachments.

The design and ongoing implementation and audit of roles and permissions should mirror the intent and requirements for your site.

Other administration tasks

In addition to modules, roles, permissions, and users, a Drupal administrator can further customize a site. Here are some options:

  • Themes — A theme defines the look of your site. Like modules, scores of these are available to suit your taste. Installing a new theme is much like installing a new module: Download its code, unpack it into its own folder, and copy that folder into Drupal's sites/all/themes subdirectory. When in place, visit the Site Building > Themes page and choose the new theme as the default. There is one important additional step: In addition to aesthetics, a theme defines one or more regions, or areas on the Web page, where you can place navigation and other self-contained features called blocks. If you change your theme, be sure to rearrange blocks to fit into the available regions. If you refresh the site and a piece of real estate turns up empty, chances are you need to relocate the missing block to a new home.
  • Blocks — A block is a self-contained applet you can embed in a larger page. As mentioned, a Drupal page can define one or more regions, and each region can contain no, some, or many blocks. Within a region, blocks are ordered, and you can add, remove, or alter the sequence of blocks in a region. Like modules and themes, you can add blocks to your installation, and there is a Blocks page under Site Building on which you perform all this administration. Interestingly, the Blocks management page features a slick drag-and-drop interface; to place a block, simply pick it up and drop it into any of the regions shown. Prior versions of Drupal had a clunky ordering and placement interface, but this new option is much more efficient and direct.
  • Updates — Because a Drupal site can quickly grow to include tens of modules and themes, it would be exceedingly difficult and time-consuming to keep all those parts up to date. However, such a chore is essential to preclude security breaches, errors, and a poor user experience. Instead, Drupal's core Update Notifications feature automatically alerts you to new releases. To find available updates, click Reports > Available Updates. In general, updates require at least some manual intervention, so carefully read the release notes or UPGRADE.txt notice that appears with each new release. Some updates change code, while others also change database tables. Note the recommendations, back up your entire site before each upgrade, and follow the instructions. Drupal provides a special "Offline mode" to keep a site functional but static during an upgrade.

As a site administrator, you must also contend with input formats and filters. An input format is simply a handle. The real heavy lifting is performed by the format's filters, which strip a particular field of undesirable markup. An input format can order its filters, too. As an example, there are filters to strip suspect HTML tags such as <form> and <script> from user-contributed postings.

You can also look into actions and triggers. An action is small chore; a trigger ties an action to an event in the CMS. One example: Send an e-mail message whenever a new comment is posted.

And although sites such as Google and Yahoo! will likely spider your site to index your pages, you should consider enabling the Search module. You can fine-tune its indexing scheme to match your content. Go to Administer > Site Configuration > Search Settings to configure the service. Search does not index automatically, though: You must configure your system cron daemon to launch indexing from time to time.

More customizations

Configuration of Drupal really is a breeze, and you can customize myriad features from the pages shown here. Moreover, you can customize nearly everything with a bit of code. The final installment in this series looks at enhancing Drupal through custom code.



  • Check out Part 1 and Part 3 for more information about Drupal.
  • Visit Drupal.org to find documentation, add-on modules, and other resources, as well as connect with others in the Drupal community.
  • Installing Drupal on Windows: The Drupal site provides instructions for installing Drupal and MySQL on Windows.
  • Check out the showcase Theme Garden of available Drupal themes. Similarly, Drupal Modules is a searchable database of available Drupal modules.
  • To listen to interesting interviews and discussions for software developers, check out developerWorks podcasts.
  • Stay current with developerWorks' Technical events and webcasts.
  • Follow developerWorks on Twitter.
  • Check out upcoming conferences, trade shows, webcasts, and other Events around the world that are of interest to IBM open source developers.
  • Visit the developerWorks Open source zone for extensive how-to information, tools, and project updates to help you develop with open source technologies and use them with IBM's products.
  • Watch and learn about IBM and open source technologies and product functions with the no-cost developerWorks On demand demos.

Get products and technologies



developerWorks: Sign in

Required fields are indicated with an asterisk (*).

Need an IBM ID?
Forgot your IBM ID?

Forgot your password?
Change your password

By clicking Submit, you agree to the developerWorks terms of use.


The first time you sign into developerWorks, a profile is created for you. Information in your profile (your name, country/region, and company name) is displayed to the public and will accompany any content you post, unless you opt to hide your company name. You may update your IBM account at any time.

All information submitted is secure.

Choose your display name

The first time you sign in to developerWorks, a profile is created for you, so you need to choose a display name. Your display name accompanies the content you post on developerWorks.

Please choose a display name between 3-31 characters. Your display name must be unique in the developerWorks community and should not be your email address for privacy reasons.

Required fields are indicated with an asterisk (*).

(Must be between 3 – 31 characters.)

By clicking Submit, you agree to the developerWorks terms of use.


All information submitted is secure.

Dig deeper into Open source on developerWorks

Zone=Open source
ArticleTitle=Exploring Drupal V6, Part 2: Extending Drupal with modules