Ext: sg_account

License: GNU GPL, Version 2

Repository: https://gitlab.sgalinski.de/typo3/sg_account

Please report bugs here: https://gitlab.sgalinski.de/typo3/sg_account

TYPO3 version: >=9.5

About

This extension provides various frontend user functionalities for a Typo3 installation.

Features:

  • Frontend User registration
  • Double Opt-in registration
  • Frontend User account overview
  • Frontend User profile editing
  • Avatar image upload
  • Gravatar integration
  • Frontend avatar image crop
  • Multiple email addresses with double opt-in validation
  • Frontend user login (with any email address saved for each user)
  • Facebook account login
  • Google account login
  • Auto login after Registration
  • Password recovery
  • Password policy options (available in the extension configuration)
  • Random password generation with respect to the defined policies (for FE and BE users)
  • FE 'Login As' feature for BE admin or editor
  • Backend Module for FE user management
  • Model Extensibility (with custom extension)

Integration

The TypoScript configuration ("SgAccount - Configuration") has to be included into your TypoScript template. The following settings can be defined:

plugin.tx_sgaccount.settings {

    ignoreConfirmHashInOtherActions - 0 or 1. If 1 then the email confirmation hash is ignored in other actions beside the confirm action.
									  (you most likely want this when you have multiple sgaccount plugins on the same page)
    adminEmails - the email address(es) of the Frontend Users' Administator.
    fromAddress - the originating email address for the extension's automated email messages.
    frontendUserStoragePage - uid of the page where newly registered user records will be saved.
    emailConfirmationPage - uid of the page where the email confirmation is handled.
    additionalEmailConfirmationLinkParameters - additional parameters for the email confirmation link generation.
    registrationPage - uid of the page where the user registration form is added.
    accountPage - uid of the page where the account overview plugin is added.
    editPage - uid of the page where the account edit form is added.

    defaultFrontendUserGroups - CSV of the user groups' uids to be added for newly registered users.
    defaultFrontendUserCountry - iso3 code for the autocompleted country in the user's registration
                                 or profile editing form (requires static_info_tables).

    sendAdminRegistrationNotification - 0 or 1. if 1 an email will be sent to the admin
 	                                    every time a new user is registered.
    sendUserRegistrationNotification - 0 or 1. if 1 an email will be sent to the user after his/her registration or
 	                                   email confirmation if the feature is enabled.

    uniqueEmailStoragePages - CSV of the pages containing FE user records constrained by unique email value.
                              The default value of this is `frontendUserStoragePage` constant value

    disableNewAccounts - 0 or 1. if 1 the newly registered user record will be disabled until an Administrator
                         reviews the data and chooses to enable it or remove it.
    generatePasswordForNewUsers - 0 or 1. if 1 a random password (based on the password policies) is generated for the
                                  new user. The password can be sent by email.
    loginAfterRegistration - 0 or 1. if 1 the newly registered user will be automatically logged in. This overrides
                             the `disableNewAccounts` option
    enableEmailConfirmation - 0 or 1. if 1 the double opt-in feature for the user will be enabled. In this case,
                              after registration the user will have to confirm his/her email address by following
                              a link sent to him/her. Otherwise, make sure to also send the 'skipConfirmationCheck' parameter
                              with value '1', together with the other login fields when a user logs-in.
    emailConfirmationTokenLifespan - integer (seconds). how long an email confirmation link will remain valid.
    enableAccountsAfterConfirm - 0 or 1. if 1 and the user record is disabled until the email address is confirmed,
                                 the user record will be enabled after the email confirmation.
    emailAutoConfirmation - 0 or 1. Auto confirm the email addresses, if the setting "enableEmailConfirmation" is FALSE.
    emailDomainBlacklist - A blacklist to disallow certain email domains. Specify as comma separated list, without TLD (e.g. gmail, yahoo, hotmail)
    removeFrontendUserGroupsAfterConfirm - CSV of the user groups' uids to be removed from the user record once
                                           the email address is confirmed.
    addFrontendUserGroupsAfterConfirm - CSV of the user groups' uids to be added to the user record once
                                        the email address is confirmed.

    userImageUploadFolder - [File Storage uid]:[relative folder path] pair used to define an existing folder
                            where the user's uploaded images will be saved. Ex: 1:/users/ .

    forgot {
            defaultRedirectPriority - string CSV. the order in which the redirect posibilities after a user login
                                        should be checked. This is overwritten by the plugin settings. Possible values:
                                            request - specified in the request url for the login page
                                            plugin - specified in the plugin settings (BE)
            defaultRedirectPage - uid of the page the user will be redirected after the pw forgot action if the
                                  first valid redirect method checked is 'plugin'. This is overwritten by the
                                  plugin settings
    }

    register {
            defaultRedirectPriority - string CSV. the order in which the redirect posibilities after a user login
                                        should be checked. This is overwritten by the plugin settings. Possible values:
                                            request - specified in the request url for the login page
                                            plugin - specified in the plugin settings (BE)
            defaultRedirectPage - uid of the page the user will be redirected after registering if the first valid redirect
                                    method checked is 'plugin'. This is overwritten by the plugin settings.
    }

    logout {
            defaultRedirectPriority - string CSV. the order in which the redirect posibilities after a user login
                                        should be checked. This is overwritten by the plugin settings. Possible values:
                                            request - specified in the request url for the login page
                                            plugin - specified in the plugin settings (BE)
            defaultRedirectPage - uid of the page the user will be redirected after logout if the first valid redirect
                                    method checked is 'plugin'. This is overwritten by the plugin settings.
    }

    login {
        loginPage - uid of the page where the login form is added.
        forgotPasswordPage - uid of the page where the password reset is handled.
        defaultRedirectPriority - string CSV. the order in which the redirect posibilities after a user login
                                    should be checked. This is overwritten by the plugin settings. Possible values:
                                        request - specified in the request url for the login page
                                        plugin - specified in the login plugin settings (BE)
                                        group - specified in the usergroup(s) of the logged-in user
        defaultRedirectPage - uid of the page the user will be redirected after login if the first valid redirect
                                method checked is 'plugin'. This is overwritten by the plugin settings.
        forcePermanentLogin - 0 or 1. If 1, A user visiting the site will be logged in automatically if he/she
                                has logged-in recently
        showForgotPassword - 0 or 1. If 1, the forgot password link will be displayed bellow the login form
        showRegistration - 0 or 1. If 1, the account registration link will be displayed bellow the login form
        loginActionsOnly - 0 or 1. If 1, the plugin will render only login actions. Useful for handlind the display
                           of a login lightbox on a page where another login plugin is present.
        forgotPasswordTokenLifespan - integer (seconds). how long a password reset link will remain valid.
        enableDisclaimer - 0 or 1. If 1, the FE user must accept the terms and conditions in order to log-in.
        disclaimerTermsPage - uid of the page that will be linked in the disclaimer's checkbox label.
        addFrontendUserGroupsAfterAcceptedTerms - CSV of the user groups' uids to be added to the user record once
                                                  he logged in accepting the disclaimer terms and conditions.
        confirmEmailWhenForgotPassword - 0 or 1. Confirms the email, if the user is using the password forgotten feature.
        enableFEUserSessionCheck - 0 or 1. If 1, a script will continiously check if the user login session is valid
                                     and refresh the page if it expires.
        usergroupAccessRedirectPage - uid of the redirect page in case of usergroup access error. Overrides the
                                      loginRedirectUrl extension configuration in order to have a multi-domain option
        addRedirectParameterForUsergroupAccessError - 0 or 1. If 1, the user will be redirected after a successfull
                                                      login to the page he tried to access before he was denied
                                                      because of usergroup restrictions and redirected to a login page
        provider {
            google {
                enable - 0 or 1. If 1 the Google plus login feature is enabled
                app_id - string. Id of the Google app used for the login
                app_secret - string. Value of the secret client string used for the login app
                callbackPageTypeNum - int. Type value of the Google login callback page.
                registerIfNotFound - 0 or 1. If 1 and the Google account email was not found in the existing
                                     user accounts. The user will be redirected to the account registration form
            }

            facebook {
                enable - 0 or 1. If 1 the Facebook login feature is enabled
                app_id - string. Id of the Facebook app used for the login
                app_secret - string. Value of the secret client string used for the login app
                callbackPageTypeNum - int. Type value of the Facebook login callback page.
                registerIfNotFound - 0 or 1. If 1 and the Facebook account email was not found in the existing
                                     user accounts. The user will be redirected to the account registration form
            }
        }
    }
}

Now you should create a new cron job within the scheduler backend module. This will check the consistence of the user data and prevent errors.

  • Class: Extbase CommandController Task
  • Type: Recurring
  • Frequency: Once a day
  • CommandController Command: SgConsistence CheckConsistence: checkConsistenceForDomainModel

After saving, you need to add arguments to the cron job. They will appear in the bottom.

  • domainNamespace: SGalinski\SgAccount\Domain\
  • domainModel: FrontendUser

Backend Module

The Backend module is found in the WEB section under the name Frontend Users

You can create a new frontend user by clicking on the New Website User button.

Edit
Disable/Enable
Delete
Show further information
Show history
Create a new user on this page
.... Expand/Collapse the options menu
Login with this user

Automated Email Messages

The extension uses sg_mail to configure email templates for the following email messages:

register_admin - sent to the specified Administrator address(es) after a new user registration.
register_user - sent to the registered user's address after registration or after email confirmation
                if 'enableEmailConfirmation' is set.
confirm_user - sent to the registered user's address after registration if 'enableEmailConfirmation' is set.
               It contains the email confirmation link.
confirm_email - sent if 'enableEmailConfirmation' is set, to an unconfirmed email address after a login atempt or
                if the user edits his email addresses. It contains the email confirmation link.
notify_admin - sent to the Administrator if a user record is pending removal for inactivity.
notify_user - sent to a user if his/her account is pending removal for inactivity.
deactivate_admin - sent to the Administrator if a user record was removed for inactivity.
deactivate_user - sent to a user if his/her account was removed for inactivity.

For more information about registering and configuring email templates please refer to the sg_mail documentation.

Rendering a profile image

sg_account comes with a viewhelper, that enables you to display a frontend users profile image inside a fluid template.

It takes the following arguments:

  • userUid: the uid of the user
  • width: the width of the image
  • height: the height of the image
  • defaultImageUri: path to a fallback/default image if no user profile image is set

Example usage:

{namespace sgAccount=SGalinski\sgAccount\ViewHelpers}
<sgAccount:getProfileImage userUid="100" width="20" height="20" />

Extensibility

The extension is built so that it can be further extended by a custom extension.

Models

In order to extend the Models, you will need to set up the extending model classes in your custom extension's ext_localconf.php

$GLOBALS['TYPO3_CONF_VARS']['EXTCONF']['sg_account']['sg_account_extender']['FrontendUser']['your_custom_extension_key'] =
	'EXT:your_custom_extension_key/Classes/Domain/Model/FrontendUser.php';

Your custom model classes should contain the new or overwritten class properties or methods. Anything else will be ignored.

User Model Classes:

  • FrontendUser - base model class for the fe_users records
  • NewFrontendUser - extends FrontendUser. Contains properties and methods for creating a new user record.
  • EditFrontendUser - extends FrontendUser. Contains properties and methods for editing a user record.

Validation

Custom Model validation can be added by extending the model classes as mentioned above and using Extbase validation annotation for non-object-related field validation, or by using one or more of the validation signal slots for object-related validation.

Signal Slots

For more detailed functionality extensions there are signal slots which can be used

  • SGalinski\SgAccount\Domain\Service\FrontendUserService
    • beforeRegistrationEmails - dispatched before the registration/confirmation emails are sent
    • beforeCreateUser - dispatched before a new user record is created
    • afterCreateUser - dispatched after a new user record is created
    • beforeSaveUser - dispatched before a user record is updated
    • afterSaveUser - dispatched after a user record is updated
    • beforeConfirmUserEmail - dispatched before a user confirms his/her email address
    • afterConfirmUserEmail - dispatched after a user confirms his/her email address
    • beforeSavePassword - dispatched before a user resets his/her password
    • afterSavePassword - dispatched after a user resets his/her password
  • SGalinski\SgAccount\Service\GeneralService
    • sendMail - dispatched before an automated email is sent
  • SGalinski\SgAccount\Domain\Validator\NewUserValidator
    • validateUser - dispatched for the validation of a new user registration
  • SGalinski\SgAccount\Domain\Validator\EditUserValidator
    • validateUser - dispatched for the validation of a user profile edit
  • SGalinski\SgAccount\Domain\Validator\NewPasswordValidator
    • validateUserPassword - dispatched for the validation of a password reset
  • SGalinski\SgAccount\Controller\AccountController
    • beforeShowAccount - dispatched before the Account Overview content is rendered
    • beforeRenderNewForm - dispatched before the Account Registering Form is rendered
    • beforeRenderEditForm - dispatched before the Account Editing Form is rendered
    • allowUserProperties - allows the adding of custom user account fields to the new/edit forms
    • afterCreateRedirect - dispatched in the controller to allow redirection to another page after registration
    • afterSaveRedirect - dispatched in the controller to allow redirection to another page after profile editing
  • SGalinski\SgAccount\Hooks\ProcessDatamap
    • afterDisableUser - dispatched after a user account has been disabled from the BE
  • SGalinski\SgAccount\Hooks\ProcessDatamap
    • afterEnableUser - dispatched after a user account has been enabled from the BE

Redirect to a page after login

If you set a link to a protected page, the user will be redirected to the login form if not currently logged in. By providing a URL via the redirect parameter, you can control the page the user will be redirected to after a successful login. It might be possible to adjust the redirect priority in order for the query parameter to work!

See the following examples where you want to redirect to `https://foobar.com/protected```.

From a link

Link to the login page with the escaped redirect URL as a querystring param.

Hint: if you generate the link via JavaScript, use the decodeURIComponent() function to escape the URL in the query string.

<a href="https://foobar.com/login?redirect=https%3A//foobar.com/protected">Login</a>

From inside the login form

Include the following hidden input (or set the value if it's already included).

Note that the value has to contain the pathname and not the full URI.

<input type="hidden" name="redirect" value="/protected">