What’s New in Plone 4
Plone 4 shipped in September 2010. It focuses on increased speed, scalability, and ease-of-use — and offers simple installation for both new sites and upgrades.
Plone is a powerful, user-friendly content management system. Plone 4 is an easy upgrade that delivers immediate benefits to end-users, content editors, and developers. If you're new to Plone, welcome aboard! We think you're going to like what you see.
Plone 4 is...
Blazing fast. Plone 4 is about 50% faster than Plone 3 overall, with big improvements for both anonymous and logged-in users. Plone is one of the fastest open-source CMS platforms on the market with page loads ranging from two to four times faster than competitive open source platforms.
Beautiful. Plone 4 features a brand-new default theme called "Sunburst." It's sleek, minimalist, modern and easy to customize.
Easy to use. Plone 4's user interface has been polished and refined so it's even more intuitive. Plone 4 includes a new graphical HTML editor (TinyMCE), with improved default configuration settings.
- Easy to install + upgrade. Includes point-and-click installers for Windows and Mac and a simple universal installer for Linux/Unix. You can be up and running in under 10 minutes. Plone 4 is an easy upgrade from Plone 3.
Plone 4 ships with “Sunburst,” a new default theme that is sleek, minimalist and easy to customize.
The original Plone design was influential when first unveiled in 2001, spawning direct copies such as the Wikipedia design (copied with permission). Most open source wiki software still uses design elements and icons from the original Plone design.
The original Plone design stood the test of time. After 9 years, it's time for an upgrade. These years of experience showed that what people want in a basic, out-of-the-box CMS design template, and those lessons went into the new Plone default theme called "Sunburst."
Sunburst design philosophy
Some central design goals of the new “Sunburst” theme were:
- Neutral without being boring — Sunburst is a clean, modern theme that provides a perfect base for customization, thanks to its use of an innovative, simple CSS grid system. It's easy to combine the theme with an existing brand or design.
- Uses a modern, table-less, grid-based design — While providing the advantages of a modern, semantic layout, Sunburst still preserves compatibility - even with 9 year old browsers like Internet Explorer 6. It also works equally well with fixed-width and fluid-width designs!
- Massively simplified CSS — The original Plone theme evolved over the years, leading to CSS stylesheets that grew large and cumbersome. The new CSS was built from scratch - producing lean, efficient stylesheets that maintain the high-quality feel of Plone while rendering quickly with strong compatibility.
- A path to the future... — The core of the new design and grid system was adopted from the Deco layout system being built for Plone 5, so the design techniques you learn with Plone 4 will prepare you for the revolutionary next Plone release.
- Support for the past — We still include the original, classic Plone theme for traditionalists and those who want to upgrade for the other advantages of Plone 4 without changing user expectations all at once. We have worked hard to preserve the same markup structure as the original Plone theme, so there should be little disruption even when upgrading an existing site to the new theme.
Significant performance improvements
Plone has a strong track record in performance, but the web is busier than ever and there's never time to rest on our laurels. Performance tuning was a major focus of Plone 4, and we're proud to show you the results. Plone 4 is about twice as fast as Plone 3 was under high loads, and up to four times faster than Plone 2.5. It also uses much less memory than previous releases, which lets you squeeze even more performance out of a given amount of hardware.
Here's a quick comparison of how much faster Plone 4 is at common tasks:
We also focused on improving performance when your site has lots of simultaneous users. Here's the how much Plone 4 has improved compared to previous releases:
Methodology: Using the Funkload suite with an increasing number of concurrent requests over time. All numbers relative to Plone 2.5 with Plone 2.5 as the baseline — i.e. 100% means twice as fast as Plone 2.5.
Plone is faster than many of its open-source competitors. Here's a simple comparison of some well-known open source CMS's from the lower end of the spectrum that are usually considered decent performers. Higher bars are faster.
Note: all of these systems ship with caching disabled by default, and that is how we tested. Appropriate caching can significantly improve the performance of all systems by 100× or more. But at that point, you're comparing the performance of your caching proxy or database caching layer, not the CMS itself — which is an important distinction.
Bottom line: Plone 4 is fast.
Intuitive visual editing
Plone shipped with a built-in graphical HTML editor since Plone 2.1, released in 2005.
In Plone 4, the graphical HTML editor has been upgraded to TinyMCE, a continually updated and improved editor that is widely used by many open-source and commercial products. TinyMCE offers improved usability, easier customization and a few new features, including:
- Improved image upload and insertion dialogs
- Strong support for HTML table editing (a weak area of our previous editor)
- Better support for inserting Flash content and other embedded content
- Easier inserting of hyperlinks
- Find and replace
Search and indexing improvements
Plone has long had the best out-of-the box search experience of any Content Management System out there, with innovative features like LiveSearch, our instant-feedback search box. Plone 4 improves searching in two important ways.
Advanced Search Form improvements
With Plone 4, the advanced search form hides less relevant sections, so you can expand the ones you need, and more easily ignore the ones you don't. It's a simple change that makes people much more comfortable with creating refined searches.
It also hides options based on your permissions in the site, so you can easily customize to your needs.
Full-text Search Indexing of East Asian Languages
Full-text indexing typically splits words on spaces, but CJK (Chinese, Japanese, Korean) languages don’t. Plone 4 introduces bigram-splitting for those languages instead, which produces better results when searching in East Asian languages.
This increases the usability of Plone for 1.5 billion potential new users.
Group dashboards for a customized user experience
Plone 4 introduces Group Dashboards – a big win for intranets looking to take their customized user offering to the next level
Plone 4 allows portlets, the elements used to display information within the page interface, to be assigned to users on a group-by-group basis.
This means you can create content that displays for users in any particular department, specialty, or even project – focusing their attention on the information they need most, while hiding it from users who don’t need to see it.
This creates a more user-centered intranet experience, and avoids information overload caused by content a users don’t need to see on their screen.
Massively improved handling of large files & media
Plone 4 now stores all file and image data on the file system rather than in one big database file. This improves performance and reduces resource consumption without giving up storing multiple revisions of the same file or fine-grained access control. We also support versioning of assets, so you can revert to an earlier version of any uploaded file.
Support for large binary files (like audio, video, PDF documents) and down-loadable files has been rewritten from the ground up with focus on performance, reduced memory consumption, and convenience.
This is a massive improvement in how Plone manages large files. The files are still handled by the same proven database technology with powerful, fine-grained access control.
Let's examine real world performance for a large Plone site:
Potsdam Institute For Climate Impact Research had a 16.5 GB database containing documents and other media:
- Upgrading the entire site to the new, file system-based storage: 51 minutes.
- Plone database size: reduced from 16.5 GB to 3.0 GB.
- Memory footprint on the heavily cached server: reduced from 10 GB to 3 GB.
- Load on the site while in heavy use: reduced to 10-20% of the previous CPU usage, with no intermittent massive spikes, as had been the case with Plone 3.
- File transfers were faster, with no discernable increase in memory usage while large documents were being downloaded.
Plone 4's new large files implementation has been field tested on large production installations during the beta process. Plone 4 delivers massive performance and resource usage improvements on sites with multi-gigabyte data stores.
New, faster folder implementation
Historically, Plone had two different folder types, one optimized for holding a large number of items, and one optimized for manual ordering of items. Plone 4 combines these into a single folder type which simplifies things for users, and offers big performance improvements.
Plone 4's new folder implementation means there's less to worry about. It's just simpler and faster for your users.
Upgrading your existing folders is transparent and automatic; effortless with Plone 4.
More powerful management of users and groups
Plone 4 brings many improvements to user & group management.
Plone 4 delivers a great set of improvements to the everyday experience of creating and managing new users, including:
Streamlined user creation process for administrators — Plone 4 lets you create new user accounts for your site faster than ever before, and allows you to choose groups for users while creating them.
Full support for nested groups — Groups can now contain other groups, making it easier and faster to give everybody exactly the permissions they need.
Improved user management— We've overhauled the entire user interface for managing user and groups to make everything faster, easier and more consistent.
Flexible user registration— You can now show and hide user profile fields on member registration forms. A new user data framework allows for easily extensible member registration and profile fields.
A new login option— Allow your users to log in using either username or email address.
Popup forms with jQuery Tools
The framework, known as plone.app.jquerytools, also integrates much of the jQuery Tools toolkit, including Tabs, Tooltips, Overlay, Exposé (masking) and Scrollable. This makes it possible to build visually impressive, highly-usable and highly-accessible user interfaces into your Plone sites with a minimum of fuss and both.
plone.app.jquerytools also works on Plone 3, making it possible to create add-on products that use these effects, yet work seamlessly on both Plone 3 and Plone 4.
Improved first-run experience
Comparison between the original Zope start screen on the left, and the new version on the right:
In addition, for more advanced developers, Plone 4 includes convenience functionality, like selecting add-ons to automatically install during site creation.
Smooth upgrade experience
Plone 4 is the easiest Plone upgrade yet.
Plone 4 has maintained backwards compatibility whenever possible, while still cleaning up the infrastructure and improving the code base and performance.
Effort has also been made to preserve backwards compatibility for add-on products and customizations. Most current add-on products will “just work,” while others will require only minor changes. Feedback from alpha and beta users indicate the easiest, smoothest Plone upgrade experience ever. This allows Plone 3 sites be able to upgrade with minimal time investment.
Plone 4 ships with a well-tested upgrade script that includes a "dry-run" test mode, so you can see if the upgrade will be successful without making any actual changes to the database. Of course, backups are essential as part of any upgrade.
Plone 4 is the easiest release to upgrade to yet.
Reduced memory footprint
Plone 4 uses less memory and uses it more efficiently, thanks to numerous improvements in our software stack.
Plone 4 brings several behind-the-scenes improvements that work together to reduce its memory footprint and let you squeeze more performance out of your hardware. On average, Plone 4 uses about 20% less RAM than Plone 3. Even better, Plone's memory consumption no longer grows over time but remains constant after initial caches are filled up.
Plone 4 achieves these improvements through a variety of approaches. First, Plone 4 handles translation files in a smarter and more memory-efficient way. Plone 4 also uses Python 2.6, which improves memory handling and garbage collection, and allows Python to give unused memory back to the operating system.
The other major feature we've added that reduces the memory footprint is a new version of the Zope Object Database (ZODB) that includes support for storing and serving large files (aka "BLOBs") directly from the file system. This means that Plone uses a lot less memory when serving, receiving and storing files and images.
Plone 4 makes life easier for developers and integrators. We've upgraded our core infrastructure, cleaned up a lot of code and smoothed out lots of rough edges.
Plone is based on Python and Zope. Both have released major new versions since Plone 3 came out, and with Plone 4, we get to enjoy their many benefits.
Plone 4 ships with Python 2.6, a proven and officially supported release of Python. It's faster than earlier Python versions, has improved memory management and a lot of improvements to the language syntax. Python 2.7 support is expected to be available for Plone 4.1.
Plone 4 uses Zope 2.12, which brings bring improvements to the Zope web framework -- the most significant of which is support for flexible storage options (RelStorage for use with SQL databases, BLOB storage for use with large media files). Zope 2.12 is fully “eggified." Eggs are the standard method for distributing Python packages, and what this means in practice is that you can upgrade your Plone version, your Zope version and everything related to it with Buildout.
This makes upgrading easier, since you just change the version number of Plone in your configuration file to the version that you want to upgrade to, run Buildout, and let us figure out the rest for you. You'll like it.
With each Plone release, we bring hundreds of small fixes that add up to a whole lot of polish. Some of the small but important improvements that will make Plone developers happy are:
This list won't make much sense to you unless you're a dyed-in-the-wool Plone developer, so feel free to skip to the next section!
- Starting Plone 4 is roughly 3 times faster than in Plone 3.
- Plone 4 ships with the new, faster jQuery 1.4 release.
- Creating custom emails is easier than ever with the new built-in Mailing Action Variable Substitutions:
- Workflow variables
- Dublin Core variables
- Easier for add-on products to add new substitutions as part of their feature set
- In-page display of the login page, advanced workflow actions, etc. — and a standardized way to do all these things in a consistent manner from your own applications using jQuery Tools.
- It's now easy to create a site without default content.
- The RSS template now sorts by publication date (not modified date) and includes the body text of the content.
- Simplified terminology to match other systems — “Description” is now “Summary,” and “Categories” are now “Tags.” (Don't worry, we haven't renamed "Collections" again. ;-)
- ResourceRegistries now has an “authenticated” flag which can be used instead of an expression for resources that should only be available to any authenticated user. This is faster than evaluating an expression.
- Debug (fg) mode now automatically enables debug mode for the Resource Registries, making it easier to develop JS and CSS. It can of course be put into production mode while the rest of the site is in debug mode, to make page loading faster too.
- The default editor setting has been revamped, and it's now easier to set (or change) a site-wide default editor.
- There's a control panel for configuring predefined image scales.
- KSS is faster and lighter.
- GenericSetup import has been added for Sharing Page Roles.
- Add view support from CMF has been added, this makes it easier to create custom add forms for content types, and simplifies Dexterity integration.
- Action Icons have been deprecated. One less tool to worry about, now you define action icons directly on actions instead using “icon_expr.” The old format will continue working until Plone 5.
- plone.app.upgrade is now the standard way to upgrade a Plone site, as well as add-on products. We “eat our own dog food,” and use GenericSetup upgrade profiles to handle Plone upgrades too.
- Additional Dublin Core properties support makes it easy to expose Dublin Core metadata in rendered HTML.
- Improved display of hidden and blocked portlets.
- Plone now uses Full Names everywhere, i.e. displays the user’s full name instead of username everywhere, including search results & RSS Feeds.
- archetypes.referencebrowserwidget replaces Products.ATRefBrowser, some advantages are:
- Massive performance improvements,
- Easily overridable template,
- Proper test coverage.
- Images will now set IDs based on the Title field. This makes images act more like other types, and gives images more memorable IDs. Instead of “DSC_084308.jpg,” you get a proper, normalized ID. This only applies if you give it an explicit title, so you can still keep filename-as-title by behavior by not supplying a title when adding.
- Plone now uses the Distribute packaging system instead of the languishing Setuptools as its default package handling system.
Security Analysis (Common Vulnerabilities and Exposures)
As of May 28, 2013:
- Entries containing Plone - 21 CVE Entries
- Entries containing Zope - 30 CVE Entries
- Entries containing Python - 130 CVE Entries
- Entries containig PostGre - 17 CVE Entries
- Entries containing WordPress - 384 CVE Entries
- Entries containing MySQL - 359 CVE Entries
- Entries containing Drupal - 627 CVE Entries
- Entries Containing Joomla - 629 CVE Entries
- Entries containing PHP - 4940 CVE Entries
These numbers do not prove anything by themselves, but do suggest a general trend and are a good approximation of the Plone security track record compared to other systems.
One should note that when installing a CMS stack, one should consider the security records of all stack components (including add-on products and modules). That means if a CMS requires an external database server, the security of that server should be considered in addition to the security of the CMS system itself.