Drupal is very much a "Do Everything" CMS. There are modules that allow you to add almost any functionality, which is great. However, it feels like a lot of the features (v5 and v6) seem scattered around and unintuitive for the user. As a developer, I'm left with the feeling of having patched a site together using bubble gum and string.
For example, to add text to the default search box (that disappears when clicked), you have to either add some jQuery code OR override the theme. I've also found the menu system more complicated than it should be.
Am I the only one with this opinion? What things (if any) would you change about Drupal's core?
It has a seemingly bad security record: http://secunia.com/advisories/search/?search=Drupal
To me, the biggest shortcoming of Drupal is that large portions of a live Drupal site are stored in the database. Since there's no automated way to migrate content or configuration between systems, rolling out changes to a live site must either be done manually or dealt with by excessively complicated code.
I find that the default admin interface isn't very intuitive compared to other cms' like modx or joomla/mambo
The lack of true object oriented design means that you frequently have to rely on other developers' foresight to leave "hook" functions to let you alter a certain behavior.
Using Drupal 5 I've also run in to situations where the only way to complete a relatively simple design change is to patch Drupal itself (and then be sure to reapply patches with each new official Drupal release). But, to be fair, you should have seen how bad it was in Drupal 4.
I'm also annoyed that when I take the time to identify a bug or quirk in the current production version of Drupal, I submit a patch, and the patch is never committed because, basically only security bugs get fixed in the current stable release.
I think it's high learning curve is the only shortcoming as most companies struggle finding good Drupal talent. http://drupalize.me/ and http://buildamodule.com/ are doing very good job to reduce this high learning curve.
One of Drupal's biggest shortcomings is that it dances on the line between a turnkey tool for nonprogrammer site builders, and a framework for developers building complex webapps. It has some cool stuff to offer both groups, but the concessions to one crowd always tend to trip up the other.
The growing trend in the Drupal community is to explicitly build developer APIs, then layer administration UI and end-user UI on top of the APIs. This is a good thing, but there's also still a lot of legacy architecture. The project turned 8 years old this week, and every site requires a mix of modules that are evolving at different paces.
If someone hasn't already built a module that does what you want, effectively leveraging the system without hacking core code requires grokking a lot of different internal APIs, a lot of unique-to-drupal data structures, and studying up on some occasionally funky workflows. A lot of terribly bad and impossible to maintain sites are floating around in the wake of people who needed to do tricky stuff and didn't have the expertise (or the time) to research the "right" way to do things.
(Disclaimer: I just co-authored a couple of chapters for a book about Drupal, and I do Drupal work full-time, so I'm about as far from 'unbiased' as you can get. But I do like to think that I keep perspective. I heart Django, too.)