Create new users with front end form and put them in a group, need help with start-elevated-session

Question

This has been a long process that I set aside to resolve "later". Well, it's "later" and the clients wants to launch asap.

Only registered users can use this site. There are 2 groups: Manager and Employee. Users in Manager group have permission to create new users and put them in Employee group. It all works in the back end.

Using the craft front end User Registration template I added a hidden field for the group id <input type="hidden" name="groups[]" value="2"> and when I submit I get "HTTP 403 – Forbidden, This action may only be performed with an elevated session."

Some googling lead me to this craftcms github comment. I get what it's saying about the elevated session and needing to send the password again but am having issues doing it. First step is testing with hard coded values on my form submit:

$.ajax({
    method: 'POST',
    url: 'https://www.myurl.ca/',
    data: { action: 'users/start-elevated-session', password: 'xxx'}
})
.done(function( msg ) {
    alert( "Data: " + msg );
});

But nothing is alerted. So something is failing.

When I try https://www.myurl.ca/?action=users/start-elevated-session&password=xxx in a new browser tab I get "TypeError, Argument 1 passed to craft\web\User::startElevatedSession() must be of the type string, null given, called in /.../vendor/craftcms/cms/src/controllers/UsersController.php on line 234".

So it can't find password value. It's just getting null. I feel like maybe I don't know what "body params" means in the github comment. Can someone explain it like I'm 5?

Thanks Amanda

Answer 1

Elevated sessions are basically user sessions where the user has proven to Craft that it’s really them within the last 5 minutes. It’s used whenever Craft is about to increase permissions on a user (either directly or via a user group).

The point of the concept is to reduce the chances of malicious permission escalation.

(In English, that means if a user with certain permissions/groups walks away from their computer, elevated sessions reduces the likelihood that another user could walk up to it, find their own user account, and increase their account permissions. They’d think they’re going to get away with it right up until the point where Craft asks them to re-enter their password, which kicks off the elevated session.)

I’m explaining this so that you understand the risk in what I’m about to say.

Maybe the easiest way for you to work around this issue is to just disable elevated sessions on your site. You can do that by opening config/general.php and adding this:

return [
    'elevatedSessionDuration' => 0,
    // ...
];

If you do that, Craft will no longer require elevated sessions anywhere.

Otherwise, you need to have the user enter their current password as part of the user form, and send that off to Craft’s users/start-elevated-session action.

You can get that action URL, and the CSRF token needed to make any POST requests to Craft, and send them to JavaScript like this:

<script>
    window.startElevatedSessionUrl = "{{ actionUrl('users/start-elevated-session')|e('js')|raw }}";
    window.csrfTokenValue = "{{ craft.app.request.csrfToken|e('js')|raw }}";
</script>

Then in JavaScript (assuming you’re using jQuery),

$.ajax({
    url: window.startElevatedSessionUrl, {
    type: 'POST',
    dataType: 'json',
    headers: {
        'X-CSRF-Token': window.csrfTokenValue
    },
    data: {
        password: $('#current-password-input').val()
    },
    success: function(response, textStatus) {
        // submit the user form...
    }),
    error: function(jqXHR, textStatus) {
        // error handling...
    })
});

If you want to get even fancier you can check to make sure the user doesn’t already have an elevated session by running a POST request to users/get-elevated-session-timeout. If response.timeout is greater than 5 (seconds) or so, then it’s safe to submit the form without prompting them for their current password.

Answer 2

When you enable public registration in Craft’s user settings, you can select a user group that new users should be added to. Once a group is selected you can override the group programatically from a Users::EVENT_BEFORE_ASSIGN_USER_TO_DEFAULT_GROUP event handler.

Register the handler from your modules/Module.php module’s init() method. Add the following code to it.

use Craft;
use craft\events\UserAssignGroupEvent;
use craft\services\Users;
use yii\base\Event;

Event::on(Users::class, Users::EVENT_BEFORE_ASSIGN_USER_TO_DEFAULT_GROUP, function(UserAssignGroupEvent $event) {
    $user = $event->user;
    $form = Craft::$app->getRequest()->getBodyParam('form');

    $groupMap = [
        'form-a' => [2],
        'form-b' => [2, 3],
    ];

    if (($groups = $groupMap[$form] ?? false) !== false) {
        // Don’t assign the default group and assign groups manually
        $event->isValid = false;
        Craft::$app->getUsers()->assignUserToGroups($user->id, $groups);
    }
});

Enable bootstrapping of the module in config/app.php, simply un-comment the 'bootstrap' => ['my-module'] line.

Last step left is to add a hidden input to your registration forms to set a form param. This param is used in the event handler to lookup the user group IDs the user should be added to when registering with this form.

<input type="hidden" name="form" value="form-b">

This is a much more secure than passing group IDs with the form, and you don’t have to deal with elevated user sessions at all.

Answer 3

You can avoid the elevated session problem with the EVENT_AFTER_ASSIGN_USER_TO_DEFAULT_GROUP event. Just register the user as normal, letting them get added to the default group, and then use this event in your custom plugin's primary class init() function.

I have an example of my code in this ticket, although I'm doing a standard form post instead of with AJAX, but you could post to the standard Craft save-user controller and catch it in the event: https://craftcms.stackexchange.com/a/27926/4433