I'm not sure if this is intended behaviour - although I can't see why it would make sense:
If "post_register_type" is "confirm_by_admin" and "send_admin_mail_after_register" is true, the notification mail with the admin deep link is sent to the user that just signed up for a new account.

I would expect this mail being sent to an admin instead, which probably has to be defined in the email template settings. While this actually works, the signup user still receives a copy of this mail, because the "user notification" with "admin template" is hardcoded here:

I guess this is not desirable - am I wrong?

I'd like to report 2 issues I have with the plug-in, which makes it totally unusable for me (what good is a members plug-in when I can't create members?):

• Whenever I'm creating a member through front-end, I get the error ParentID and ID is identical, an element can't be the parent of itself.
• Whenever I'm creating a member through back-end, for whatever reason, the member object is not found when trying to log in. Resetting the password works fine, but whenever I log in, I get \Zend_Auth_Result::FAILURE_IDENTITY_NOT_FOUND.

I'm not sure what you would need to help resolving this issues, so please let me know.

Implement a session free auth storage to prevent session locking.

Implement a Login-Brick (same behaviour as in M1)

The edit profile form allows to change the username. But it does noch check for the new username to be alredy in use. So I'm able to change it to an already existing username. After that none of the 2 users is able to login.

Steps to reproduce:

1. Register new user "aaa" and activate the account
2. Register new user "bbb" and activate the account.
3. Login as user "bbb" and use the profile edit form an change the username to "aaa"
   => This does not trigger an error, the new username is written to the user object.
4. Try to login using username "aaa" (which is now the username of 2 users)
   => None of the 2 passwords work. Login no longer possible

• removerole_hierarchy in security config. It's easily possible to to add stuff like that in project context if needed.
• allow role selection in group class

We have problems while updating pimcore to 5.2.2, can anyone confirm that?

What if Members uses the consent data-type for activated by admin feature?

https://pimcore.com/docs/5.x/Development_Documentation/Objects/Object_Classes/Data_Types/Consent.html

Currenty the HTML of the forms is not generated in the same way for some forms.
For example login and password lost look different than the registration form and require some additional CSS.
Ideally all forms would use the Symfony form_theme for rendering.

1.) currently there is no nice way in pimcore to trigger the object save event via plugin (js)

• PR added: pimcore/pimcore#545 (see pimcore/pimcore#545 (comment))
• if PR will be rejected: Find a solution to bind the object save event. wait for new pimcore event handling.

2.) Handling

• restrict objects: how to? (global dao hook, provide hooks for other plugins?)

Within issue #26, we changed the validator translation domain globally to messages:

This is quite wrong since a bundle never should change validator domains globally. The right way to change validation messages is to add them to /app/Resources/translations/validators.LANG.yml or by changing the domain in the app:

parameters:
    validator.translation_domain: 'messages'

@geekdevs if you still want/need to add validator messages to the pimcore message domain, please do like described above.

Generates default view params to allow user to create a custom login box (like the area in a document) from a object related context.

$areaBuilder = new AreaBuilder('object');
$areaBuilder->setup()
        ->setEditMode($this->view->editmode)
        ->setBackUrl($this->view->getParam('back'))
        ->setCurrentUrl($this->view->getRequest()->getRequestUri())
        ->setRedirectAfterSuccess($loginBrick->getRedirectAfterSuccess())
        ->setSnippetAfterLogin($loginBrick->getShowSnippedWhenLoggedIn())
        ->setHideAfterLogin($loginBrick->getHideWhenLoggedIn());
$params = $areaBuilder->getViewParams();

I'm starting to implement a delete account form so users can terminate their account. I'l provide a PR when I'm done.

Hey again,

I'm not really that experienced with using twig but I got my site working on twig now because I want to include the templates you provide inside my views like so:

{% extends 'Fred/layout.html.twig' %}

{% block content %}
    {{ include('MembersBundle::Registration/register.html.twig') }}
{% endblock %}

It always throws an error Variable "form" does not exist. Is my approach totally wrong? Or am I missing something?
My goal is to use the register form/login form etc inside my custom styling.

Thanks in advance

Allow Ajax Login/Requests.

Even when setting send_user_mail_after_confirmed: trueafter-confirmation email does not send.

This is likely the issue:

$this->configuration->getConfig('post_register_type') !== 'confirm_by_admin'

!== should be === here I believe so that it won't send email if confirmed by admin and would send it otherwise.

With case #45 the default validation domain has been reverted. But: Members still install Pimcore Shared Translations and they don't work out of the box. So it is unclear for the Developer how to use them. You can either change the validation translation domain to 'messages' or create a validations.yml translation file.

I think Members should supply a default 'validations.yml' translation file and remove them from the shared translation.

Hey,
is there a possibility to use php-templates instead of the twig-templates?

After a registration, user should automatically get applied to specific groups:

 user:
    initial_groups:
        - 'your-group-name'
        - 'your-second-group-name'

I've just started using your plugin, and I just now realized that seemingly nowhere the reset hash actually gets sent with the email.

When I tried to use this plugin with Hybridauth in pimcore I get this error:
PHP Fatal error: Uncaught Zend_Session_Exception: session has already been started by session.auto-start or session_start()
How I can fix this ?
Thanks.

The TreeListener uses two pimcore AdminEvents that were introduced with Pimcore 5.3. Therefore when updating Members with a Pimcore version prior to v5.3.0 it breaks the whole application.

FatalThrowableError
Undefined class constant 'ASSET_TREE_GET_CHILDREN_BY_ID_PRE_SEND_DATA'

For now I reverted back to dev-master#46e843a75677f6234b6441be71e38ff4626a01b7

• allow restriction for assets in /restricted-assets folder
• create static method in observer to check if asset is restricted

Usage

According to this we need a custom nav builder.

{% set nav = members_build_nav(currentDoc, documentRootDoc, null, true) %}

How it works

• Generates a custom cache key depending on active user (groups).
• Check each document if it's restricted and set it to disabled with so.

if config value is not empty redirect to given uri. keep redirect to profile as fallback.

Whenever I'd like to create my own pimcore static routes to overwrite the default MemberBundle routes, my routes are overridden by the default one's.

For example:

// Should overwrite the login route
1 => [
    "id" => 1,
    "name" => "members_user_security_login",
    "pattern" => "/^\\/[a-z]{2}\\/login/",
    "reverse" => "/%_locale/login",
    "module" => "MembersBundle",
    "controller" => "Auth",
    "action" => "login",
    "variables" => "_locale",
    ...
],

// Redirect to login page
public function defaultAction()
{
    return $this->redirect($this->get('router')->generate('members_user_security_login'));
}

This should redirect me to http://domain.com/de/login instead it redirects me to http://domain.com/de/members/login.

Am I missing something? If not, could the routing be refactored so the routes may be overridden?

Thanks! 😄

Allow site crawler like LuceneSearch to crawl restricted routes/assets by adding a X-AUTH-TOKEN for example.

• Implement Button to each content element to allow user group selection
• Lucene Search: How to detect and crawl restricted elements?

Routes should not be included by members itself since it's hard/impossible to override them later.

MembersBundle\EventListener\PostConfirmationListener is declared twice and is fired twice when dispatched. This is causing registration confirmation emails to be sent twice.
Simply removing one of declarations fixes the issue, so should we kill one of those?

1. pimcore-members/src/MembersBundle/Resources/config/services/event.yml

   Line 36 in ec1e772

   MembersBundle\EventListener\PostConfirmationListener:

2. pimcore-members/src/MembersBundle/Resources/config/services/registration.yml

   Line 20 in ec1e772

   members.event_listener.post_confirmation:

disable file transfer and attachment header if files are compatible with lucene search to allow restricted file indexing.

It would be very helpful for building up the navigation when the Access Restrictions where available for Links too.
We do not only use Documents but often use Links when building flyout/dropdown navigations.

Cannot install this extension with console. I see this error:

No entry is registered for key 'pimcore_admin_user'

Testing on fresh installation of pimcore 5, build 108.
And latest dev master of this extension (c5c78a3)

Steps to reproduce:

• composer require dachcom-digital/members:dev-master#c5c78a3fc23ac2435727bbaca5c86073b7bd37b7
• bin/console pimcore:bundle:enable MembersBundle
• bin/console cache:clear
• bin/console pimcore:bundle:install MembersBundle

Ever had the issue that as soon as Pimcore is in production mode, the logout route does not function anymore? Everything works well in debug (dev) mode. Cache clear does not work, nor are the routes wrong or anything... it's a miracle!

Here's my routing config:

members_auth:
    resource: '@MembersBundle/Resources/config/pimcore/routing/auth.yml'
    prefix: /{_locale}

Actual route (output of bin/console debug:router):

Name                                Method          Schema       Host     Path
----------------------------------- --------------- ------------ -------- -----------------
members_user_security_logout        GET|POST        ANY          ANY      /{_locale}/logout 

Security settings (output of bin/console debug:config security):

security:
    firewalls:
        members_fe:
            logout:
                path: members_user_security_logout
                target: /
                csrf_parameter: _csrf_token
                csrf_token_id: logout
                invalidate_session: true
                delete_cookies: {  }
                handlers: {  }

And I'm calling it in one of my twig templates like so:

{# Input #}
<a href="{{ path('members_user_security_logout') }}">Logout</a>

{# Output #}
<a href="/de/logout">Logout</a>

Any help on this would be greatly appreciated! Thanks!

Translations do not apply for validation messages.
Although I see translations from this bundle are added to the admin, e.g. "members.validation.email.already_used" it's not applied during form validation.

For example registration form has IsUniqueEmail constraint which has default message email_already_used instead of members.validation.email.already_used.

But even if I update it to be "members.validation.email.already_used" it still won't translate because pimcore is only using "messages" translation domain for translations and symfony sets "validators" translation domain for constrain violations.

I managed to solve it by forcing pimcore use "messages" domain always:

parameters:
    validator.translation_domain: 'messages'

But I was wondering if you had better solution in mind and that's just a minor issue?

• add bridge
• add example

Try to avoid inheritance as a physically relation storage - instead, use smarter queries.

Whenever a user object gets updated (e.g. moving the object in the object tree or the user is logging in) the register confirmed message will be sent.

I guess something along those lines of code is wrong.

Pimcore Version 5.1.2 (build 192)
Members Version 2.0.1

Current configuration for "MembersBundle"
=========================================

members:
    send_admin_mail_after_register: false
    send_user_mail_after_confirmed: true
    post_register_type: confirm_by_admin
    restriction:
        enabled: false
        allowed_objects: {  }
    user:
        adapter:
            class_name: MembersUser
        initial_groups: {  }
    group:
        adapter:
            class_name: MembersGroup
    auth:
        adapter:
            class_name: null
            object_path: null
    emails:
        default:
            register_confirm: /email/register-confirm
            register_confirmed: /email/register-confirmed
            register_password_resetting: /email/password-reset
            admin_register_notification: /email/admin-register-notification
        sites: {  }
    relations:
        profile:
            form:
                type: AppBundle\Form\Type\ProfileType
                name: members_user_profile
                validation_groups:
                    - Profile
                    - Default
        registration:
            form:
                type: AppBundle\Form\Type\RegistrationType
                name: members_user_registration
                validation_groups:
                    - Registration
                    - Default
        change_password:
            form:
                type: MembersBundle\Form\Type\ChangePasswordFormType
                name: members_user_change_password_form
                validation_groups:
                    - ChangePassword
                    - Default
        resetting:
            retry_ttl: 7200
            token_ttl: 86400
            form:
                type: MembersBundle\Form\Type\ResettingFormType
                name: members_user_resetting_form
                validation_groups:
                    - ResetPassword
                    - Default

Show a restriction (+ inherited) icon in tree view for documents, assets and objects:

In 20_CustomClassName.md the config keys to overwrite the class names are: members.adapter.class_name

Path should overwrite the default config from the bundle in config.yml (members.user.adapter.class_name & members.group.adapter.class_name)

Hi there,

I'm just getting into using pimcore-members. Working great so far, thanks for providing this extension!

My use case requires me to have an admin confirm all new registrations. The e-mail I'm getting has a deeplink to the new account but the link doesn't work.

I dug a bit and found it is working if you remove the _locale=en& part from the link.
This is added here and I remove the conditional the link works perfectly fine. It also matches the deeplink to the object the info box in the backend gives me (also without the locale-part).

There probably is a good reason to have the conditional there though. I can't see it yet though.

Thanks

Provide a simple class (user & group) installer command.

In members/src/MembersBundle/Manager/UserManager.php at line 39 the required path "/members" is not available directly after installation, so the getId() part throws an exception. (tested multiple times).
Can be solved by checking for existance and add the required folder when not exitsting or by installer routines.
(Pimcore 5.0.0|132)