This has been a long process that I set aside to resolve "later". Well, it's "later" and the clients wants to launch asap.
Only registered users can use this site. There are 2 groups: Manager and Employee. Users in Manager group have permission to create new users and put them in Employee group. It all works in the back end.
Using the craft front end User Registration template I added a hidden field for the group id <input type="hidden" name="groups[]" value="2">
and when I submit I get "HTTP 403 – Forbidden, This action may only be performed with an elevated session."
Some googling lead me to this craftcms github comment. I get what it's saying about the elevated session and needing to send the password again but am having issues doing it. First step is testing with hard coded values on my form submit:
$.ajax({
method: 'POST',
url: 'https://www.myurl.ca/',
data: { action: 'users/start-elevated-session', password: 'xxx'}
})
.done(function( msg ) {
alert( "Data: " + msg );
});
But nothing is alerted. So something is failing.
When I try https://www.myurl.ca/?action=users/start-elevated-session&password=xxx
in a new browser tab I get "TypeError, Argument 1 passed to craft\web\User::startElevatedSession() must be of the type string, null given, called in /.../vendor/craftcms/cms/src/controllers/UsersController.php on line 234".
So it can't find password value. It's just getting null. I feel like maybe I don't know what "body params" means in the github comment. Can someone explain it like I'm 5?
Thanks Amanda