Manual user activation for non-admins

Question

I am using CraftCMS 2.

Beside the admins, I have 2 user groups: Employees and Editors. As admin I can activate pending Editor accounts by clicking on 'Activate account' in the corresponding user account. However, this button is not available for non-admins (Employees), even if the non-admin has all permissions of the user module. I understand that there is no way to make this button available for non-admins in control panel.

Question: Is there a way to make this action ('Activate account') available for Employees through a frontend form? Ultimately I want Employees to be able to activate pending Editors manually.

Basically I want to do the same as Jeremy A but with non-admins.

Answer 1

Generally best practice is to look into the source code and see what happens in the function

/**
 * Manually activates a user account.  Only admins have access.
 *
 * @return null
 */
public function actionActivateUser()
{
    $this->requireAdmin();
    $this->requirePostRequest();

    $userId = craft()->request->getRequiredPost('userId');
    $user = craft()->users->getUserById($userId);

    if (!$user)
    {
        $this->_noUserExists($userId);
    }

    if (craft()->users->activateUser($user))
    {
        craft()->userSession->setNotice(Craft::t('Successfully activated the user.'));
    }
    else
    {
        craft()->userSession->setError(Craft::t('There was a problem activating the user.'));
    }

    $this->redirectToPostedUrl();
}

The important part is $this->requireAdmin();. Copy the function into a custom controller and remove that line and you are generally done. You can even hook into the CP template and include this the button on your own.

My Solution

I wrote a plugin that uses above method. It is accessed via a controller. I just changed the line that requires the user to be an admin. Then I just put a button somewhere in the CP that uses this controller action.

- $this->requireAdmin();

+ if (!craft()->userSession->getUser()->can('accessPlugin-MyNewPlugin')) {
+    throw new HttpException(403, Craft::t("You don’t have the required permissions for this operation."));
+ }