i18n, security and newbie questions :)

[khaos]

Hello @all.

The last few days I have read through countless articles, documentations and what not to make an informed decision what CMS I would like to use from my own business and to offer to my clients. Being a software engineer myself, I focused mainly on the technology side, so I had to decide whether it was going to be the Python/Django or the Ruby/RoR road (I have a deep antipathy for PHP, so that was never an option). I finally settled on Django because it just felt more mature from a technology point of view and from their project management. Now it is up to decide which CMS and I am having a hard time. :-)

I hope nobody minds me asking a few questions. Right now I am considering Django CMS (which seems to have slowed down in development somewhat [maybe due to djee.se?]), Merengue (which seems to be rather unknown) and Mezzanine (the hip and cool new kid on the block :P).

1. I myself need i18n support and I know my clients would ask for it as well. Is this a planed feature or is this missing on purpose?

2. Security is most important for me. How much care is taken in the dev process to ensure a good security foundation? And how are security problems handled? Is Mezzanzine secure and production ready?

3. I tried the demo site and noticed that there was absolutely no user/group/role management anywhere to be found. This would be rather important again for my clients. Is this planed for the future or missing on purpose?

4. I am new to Django and Python. My background is strongly C++. How hard is it to get Mezzanzine up and running for such a newbie and extend its features here and there if needed? (naturally with the will to learn Python and Django along the way and actually _read_ the documentation :P) Since Linux is second nature to me and I administrate my own server, that part is covered.

5. How about long-term maintenance? As young projects tend to vanish over time, is Mezzanzine here to stay?

I would really appreciate any honest and open suggestions, hints, clues, opinions and answers. :) Thanks a lot in advance.

So long
matthias.

[Josh Cartmell]

First off, welcome to Django and possibly Mezzanine.  And I'm happy you are asking questions!  I think you will enjoy working with Django due to its flexibility and ease of use.  Mezzanine in particular has been created in a way that makes it easy to extend.  The code base is easy to dive into and usually not very difficult to understand.  My biggest recommendation to you would be to try Mezzanine out.

I don't know the answers or don't feel like I would provide great answers to all your questions, but I will take a stab at some of them:
3. There is some user management and groups provided through the backend interface.  It appears that the user for the demo site has restricted privileges so that they cannot mess things up.  Also Mezzanine will be adding new account features very soon (you can see them if you pull from the github or bitbucket repos, but they haven't made it to PyPi yet.  If you read this thread it goes over some of the new stuff including user editable profile forms: http://groups.google.com/group/mezzanine-users/browse_thread/thread/ec58cad91b6770de

4. It's really simple to get mezzanine running and I definitely recommend you try it out.  Do something like the following:
# I would recommend that you always use virtualenv for python development so make sure it is installed.  You can read up on it here: http://pypi.python.org/pypi/virtualenv
# create a virtualenv
$ virtualenv MEZENV
$ source MEZENV/bin/activate

# The following will install mezzanine and all dependancies
$ easy_install -U Mezzanine
$ mezzanine_project testproj
$ cd testproj
# create the db with user admin and password default
$ python manage.py createdb --noinput
$ python manage.py runserver
# visit 127.0.0.1:8000 in your browser!

I came to python, Django and eventually Mezzanine from a background in Java, C++ and C that I had learned in school.  I found the transition to be pretty smooth and have come to really like python because it is so clear and readable.  I would recommend that you read this whole page to see how easy Mezzanine is to extend:
http://mezzanine.jupo.org/docs/content-architecture.html#content-architecture  I have always found page processors to be a particularly useful feature of Mezzanine.  I think you should come up with a small feature you would want to implement and do it using that documentation to give yourself an idea of how easy it is to add features.
In addition Mezzanine is just Django so you can also create and add more Django apps to your project.

Another big positive I see with Mezzanine is the community.  People are very helpful and often times Steve, the creator and maintainer, responds to questions on the mailing list within a day or less.

To summarize, give it a shot, I think you will like it!

[Stephen McDonald]

Some great questions here, I'm sure nobody minds them. My answers inline:

On Thu, Apr 26, 2012 at 12:25 AM, khaos <binar...@googlemail.com> wrote:

Hello @all.

The last few days I have read through countless articles, documentations and what not to make an informed decision what CMS I would like to use from my own business and to offer to my clients. Being a software engineer myself, I focused mainly on the technology side, so I had to decide whether it was going to be the Python/Django or the Ruby/RoR road (I have a deep antipathy for PHP, so that was never an option). I finally settled on Django because it just felt more mature from a technology point of view and from their project management. Now it is up to decide which CMS and I am having a hard time. :-)

I hope nobody minds me asking a few questions. Right now I am considering Django CMS (which seems to have slowed down in development somewhat [maybe due to djee.se?]), Merengue (which seems to be rather unknown) and Mezzanine (the hip and cool new kid on the block :P).

1. I myself need i18n support and I know my clients would ask for it as well. Is this a planed feature or is this missing on purpose?

Support for this falls under two categories. Translatable interface, and translatable content. The former is fully supported, and Mezzanine's admin and default templates are already translated into around a dozen languages.

As for translatable content, there's no official support for this out of the box. But fear not. There's an ongoing thread for the implementation of this here: https://github.com/stephenmcd/mezzanine/issues/106 - this initially started out with getting Mezzanine working with the third-party translation app django-modeltranslation (http://code.google.com/p/django-modeltranslation/) which was successful. So there is a working solution right now. You'll see in the thread that work has also been begun around Mezzanine's own implementation. The only thing blocking this is manpower, so if you'd like to get involved that would be a great starting point if this is a core requirement for you.

You also have the option of treating each language as a separate site. Mezzanine has basic integration with Django's sites framework, have a read about that here: http://mezzanine.jupo.org/docs/deployment.html#multi-site

I'm also currently working on multi-tenancy, which will take the sites integration to the next level, whereby multiple sites can be run and managed via a single Django instance and admin interface. This will pave the way for the "language as a site" approach being more streamlined, as well as providing some of the low level groundwork for the proper translatable content implementation (via threadlocals and the current request, which both multi-tenancy and translatable content will each be based on).

 

2. Security is most important for me. How much care is taken in the dev process to ensure a good security foundation? And how are security problems handled? Is Mezzanzine secure and production ready?

I imagine you can appreciate that this is a really broad question that's hard to answer generally. Not that that discounts asking it. I can only answer yes to the "readiness" question. There have been zero security issues in Mezzanine's 2+ years of development and deployed sites. There have also been production deployments that have scaled to very high traffic. I don't have figures for it, but one Mezzanine site is used for one of Australia's largest sporting events, which during the event receives millions of page views per day.

The point about zero security issues should be taken with a grain of salt though, as this could very well be due to the obscurity of Mezzanine. However as the main developer, I can tell you that web app security has been a core focus of mine in my work for over the last decade. I was the guy on my team back in the early 00's who built all the libraries my team members would use to mitigate SQL injection and cross site scripting. We really are spoiled in this day and age with Django though. it makes many security issues irrelevant, but these areas are always something I'm mindful of. A better question to ask about the security of Mezzanine might be to ask the same question against Django itself, which I think you'll be quite pleased by.

 

3. I tried the demo site and noticed that there was absolutely no user/group/role management anywhere to be found. This would be rather important again for my clients. Is this planed for the future or missing on purpose?

The demo site disables any user related management which could be used to tamper with people using the demo site effectively. All of Django's user/group/permission management is enabled by default in Mezzanine. Fire up a dev version locally and have a play.

 

4. I am new to Django and Python. My background is strongly C++. How hard is it to get Mezzanzine up and running for such a newbie and extend its features here and there if needed? (naturally with the will to learn Python and Django along the way and actually _read_ the documentation :P) Since Linux is second nature to me and I administrate my own server, that part is covered.

The Django documentation is ridiculously thorough. Given your background I think you'll find things a breeze.

 

5. How about long-term maintenance? As young projects tend to vanish over time, is Mezzanzine here to stay?

Again you're asking a broad question, that while perfectly valid, is difficult to answer. This is an open source project. No one has any firm commitment to it. Having said that, this isn't a young project. It's been under development for over 2 years, and if you look at the repo history, you'll find that almost not a week has gone by where there hasn't been activity. As the main developer, I was asked this same question over a year ago, and said that I'd be lying if I offered any formal commitment to the long-term support of Mezzanine. It just doesn't make sense. Yet here we are today and things are still moving with as much pace as ever before.

 

I would really appreciate any honest and open suggestions, hints, clues, opinions and answers. :) Thanks a lot in advance.

So long
matthias.

Hope this helps.

--
Stephen McDonald
http://jupo.org

[khaos]

Hi Stephen and Josh,

Thanks to both of you for your honest and very detailed answers. It helped me immensely and is very much appreciated.

Support for this falls under two categories. Translatable interface, and translatable content. The former is fully supported, and Mezzanine's admin and default templates are already translated into around a dozen languages.

That's already good news. Since I am from Germany, not every german client wants to or can deal with a english interface, unfortunately.

 

As for translatable content, there's no official support for this out of the box. [...] So there is a working solution right now.

Ok, I will have to dig further into Django to fully comprehend how those concepts work. Right now it is hard for me to understand, how a third party module can take over the job of "full" i18n support in a user friendly way (that is properly click into the admin interface and frontend editing).
 

You'll see in the thread that work has also been begun around Mezzanine's own implementation. The only thing blocking this is manpower, so if you'd like to get involved that would be a great starting point if this is a core requirement for you.

Generally, I am always interested in helping out with open source projects - especially naturally if I need them myself. Once I have made my decision, feel comfortable enough with Python/Django and time permits it (self-employment is rather unpredictable), this is something definitely worth investigating.

You also have the option of treating each language as a separate site. Mezzanine has basic integration with Django's sites framework, have a read about that here: http://mezzanine.jupo.org/docs/deployment.html#multi-site

 
That would be a nice option to have but I believe the majority of users would rather see one site with different languages... at least based on my experience (which is not too much -> C++ engineer :P).

I'm also currently working on multi-tenancy, which will take the sites integration to the next level, whereby multiple sites can be run and managed via a single Django instance and admin interface.

Nice. Is there a separate branch for this ongoing work?
 

The point about zero security issues should be taken with a grain of salt though, as this could very well be due to the obscurity of Mezzanine.

That was one thought that naturally crossed my mind. Currently Mezzanine is not as widely deployed as Drupal or Django CMS. So it is not as interesting as a target as those for attacks.
 

A better question to ask about the security of Mezzanine might be to ask the same question against Django itself, which I think you'll be quite pleased by.

Actually that was one reason why I turned RoR down in favor of Django, to be honest. I don't think they are as mature as Django and especially their recent handling of the default attribute access rights / mass assignment issue was not very encouraging, to say the least.

The Django documentation is ridiculously thorough. Given your background I think you'll find things a breeze.

I know. That was another plus. :-)
 

As the main developer, I was asked this same question over a year ago, and said that I'd be lying if I offered any formal commitment to the long-term support of Mezzanine. It just doesn't make sense. Yet here we are today and things are still moving with as much pace as ever before.

I truely value your openess and honesty. For me, it is a tough decision to make. There is on the one hand Django CMS which has been around longer and is backed by a company and paid developers.  Also it is more widely deployed and thus tested. But in my humble opinion, their communication falls behind recently and even though there has been talk of a 2.2.1 for quite a while (now even with Django 1.4 support), no work has yet shown up on their repo which as been quite for months. My questions haven't been answered and with djee.se in the works which is backed by their lead developers, it is unclear how much of their work will flow back and where the priorities will be. Now there is Mezzanine. Communication and community is absolutely top-notch and has been that way for as long as I checked the archives. :) The admin interface is very nice compared to others, the project is active and well documented as well. Yet it is not quite there in terms of features, is not as widely deployed/tested and still needs to build up a community of developers around it to keep it alive in the long run.

Tough call. :) Stephen, I hope you don't mind but I'd like to ask you two more question which would also be a great addition to the wiki or the front page because I guess more people will ask themselves the same thing: What do you think are the major advantages and disadvantages of Mezzanine compared to other solutions around (Django CMS, FeinCMS, Merengue, ...) - or why should one choose Mezzanine over the others? And the other question is: What are your plans for Mezzanine (apart from world domination)? :)

Thanks a lot for your patience.

So long,
matthias.

[Stephen McDonald]

I can't comment on the other CMS projects you mentioned, I haven't used any of them. They weren't around in any kind of mature form when I started working on Mezzanine and Cartridge, which was part of the motivation for starting them.

As for future plans? Nothing other than continuing in the same direction the projects have taken up until this point, which has been working with anyone who wants to be involved to shape the project in the best way possible for them and everyone else. That answer's a bit of a cop out, but it's the honest nature of things. Things have grown organically, yet with what I'd like to believe to be a good deal of precision and control along the way.

Sounds like you're at the point now where you just need to bite the bullet and make a decision. Give Mezzanine a try. The vast majority of feedback from people using it has been positive.

[Nicola Larosa]

khaos wrote:
> What do you think are the major advantages and disadvantages of
> Mezzanine compared to other solutions around (Django CMS, FeinCMS,
> Merengue, ...) - or why should one choose Mezzanine over the others?

I'll chime in and tell my story, sorry for the verbosity.

My job has been Python web development for 13 years now (and I have a
beard to show for it). I've gone through Zope 1, 2 and some 3, Quixote,
Twisted, narrowly avoided Plone, and ended up with Django, becoming its
Italian translation coordinator. I shall also note a three-month stint
using Pinax on a project, after which I joined Canonical and was able to
forget about it. :-)

A few months ago I needed a CMS, and since the "customer" already used
Joomla I went into PHP mode (ugh). I discarded Wordpress right at the
outset (not really a CMS); I looked into Joomla and did not like one bit
of what I saw; then for a couple of months I tried, really tried to make
myself like Drupal. Almost managed to, but in the end I could not, so I
went back to the beloved Python world.

I once again considered Plone, and once again discarded it, too many bad
Zope memories. At that point I had nothing left in the way of what I
perceived being the not very mature Django-based CMS ecosystem.

I had another look at Pinax, even if it's not a CMS, and was dismayed to
find it in a worse state than I left it.

A first search revealed four main contenders: Django CMS, FeinCMS,
Merengue and Mezzanine. I was looking for something with well integrated
functionality, well tested, well documented, with good community and
leadership, but still understandable and not too bloated.

FeinCMS looks good on paper, but it's more of a toolkit than something
usable out of the box, and I'm trying to be more of a webmaster than a
programmer, for once.

Merengue ultimately feels rather unbalanced. Again, it looks good on
paper, with lots of functionality and good testing practice. However its
documentation is incomplete, the community is basically non-existent
outside of the Spanish university it's developed in, and when trying to
use it I see too many things I don't understand.

I really wanted to like Django CMS: it seems to have the biggest
community, and has a good philosophy of reusing and integrating already
existent Django apps. When I try to use it, though, I get versioning
problems, UI problems, not stellar docs, and a general absence of a
strong, interested guide behind it.

Finally, Mezzanine. The feature list seems kind of meager, but that's the
only con I can find. [Going into flattery mode now] This Stephen guy
oozes commitment and professionality from every pore: he writes good
documentation, has a clear vision, knows what he wants and has no qualms
in saying "no", very much bent on user interface usability and quality of
code, very good interaction with the community. And he also writes
interesting and useful blog posts!

I tend to look at tools in terms of investment rather than features: the
foundation has to be solid, the features will come. Even if I did not end
up using it yet, I like Mezzanine, enough to preventively take on the
burden of translating it and Cartridge to Italian (Transifex really makes
it not that much of a burden :-) ).

There you go, I hope you find this useful. Oh, don't click on the link
below, it's hideous and not yet using Mezzanine. It probably will though,
one day or another. :-)

--
Nicola Larosa - http://www.tekNico.net/

I totally guarantee this one [prediction]: Eventually, the cost of
buying anything that requires human intervention in the manufacturing
process is going up. The sooner the better. - Tim Bray, January 2012

[Stephen McDonald]

Gosh. Thanks for the kind words Nicola. I'll be sure to hit you up if I ever need to hire a PR manager.

[Stephen McDonald]

In a doubly-ironic twist, we just had our first security issue reported by one of the Django CMS developers who also had the same vulnerability.

I'm happy to post it here since it is relatively obscure. A staff user can add JavaScript to any RichText field that will be displayed on a page. The JavaScript can include an AJAX post to the Django admin, updating that user's superuser status. If a superuser then views that page, the JavaScript is run, the AJAX post is made, then the staff user is now a super user.

We'll need to sanitize the RichText field - I'll have a fix shortly.

[khaos]

Hello everyone.

In a doubly-ironic twist, we just had our first security issue reported by one of the Django CMS developers who also had the same vulnerability.

 
That is partly my fault. :-) I had a very nice and kinda long chat with the Django CMS devs because I wanted to see what is currently happening within that project to get a clear picture for both projects. So, sometime during the chat I mentioned my trouble in deciding between Mezzanine and Django CMS... and somehow they came up with that security leak which they fixed a while ago. Nice that they reported it back.

Thanks Nicola for your detailed posting about your experiences. I agree with you on Merengue. It looks very nice on paper but as soon as you start looking for documentation or the like, you are off on your own. And you should not tell someone not to click on your homepage link because it has drawn me immediately to it. :) Nice write up about MySQL / PostgreSQL by the way. ;)

Right now Django CMS has a slight edge for me, simply for the reason that I rather like their concept of content agnostic pages coupled with their plugin system. I can see all sorts of potential use cases where this might come in handy and I can imagine that potential clients would find this easier to work with from their perspective. Simply adding a page, choosing the "grid layout" and the rest is up to frontend editing and assigning plugins and content. That would be a nice feature for Mezzanine to have, by the way. :P No matter what, I will give both a try and see what fits my shoes best.

Thanks again to everyone (especially Stephen) for being patient and weighing in their opinions and experiences. It is very much appreciated.

So long,
matthias.