Looks like a jumped the gun purchasing user.

I have 4 member groups that I need folks to assign themselves to a group when they register. Is this possible with User without utilizing invitations?

Thanks!

-T.

T,

This is one function that we did not enable. I consider it a security risk since someone could build an EE site and if not careful, allow people to assign themselves to a member group with permissions to access the CP and do damage.

Do you need a refund?

mk

Mitchell,

Thanks for the reply. I like to think that we are careful. Besides we were planning to hard code the member group on different forms, not have a popup or anything like that.

Any chance it could be enabled for this project?

- T.

T,

I wish we had the time to help with this modification right now. I’m trying to keep the team focussed on bringing our software up to 1.6.1 compatibility.

mk

I would like this feature myself, I understand the potential security issues, but I think you can do a few things to mitigate it. Either require confirmation when that feature is used, or restrict any user group that has cpanel access (filter them out). Or you must explicitly mention each user group in the form and code. Can you let me know if this is doable? Thanks!

James,

In the most recent version of the User module, try providing the group_id param in the register form. Set the param to the group number to which a new registrant should be assigned. Should work ok for you.

mk

Not sure if I’m getting it.

I want an option dropdown to let each user pick their membership group.

So I coded this

{exp:user:register form_name="register_member" form_id="register_member" return="account/register_confirmation" group_id="6|7"}

What CoC do you belong to?*

<select name="group_id" id="group_id">

<option value="6">Balance of State</option>
<option value="7">Bridgeport</option>

</select>

So what am I doing wrong

James,

It’s a security risk to allow a member group to be submitted through the form and accepted by the form handler. In my view that’s a window for hackers. So I have not and likely will not enable this. What I may code in in the future is the ability for you to specify which member groups a person can join through a parameter. And then check this against what someone chooses using a pulldown. The allowed groups that you specify as a site admin when the form is generated have to be stored in the database and kept secure. Simply having the pulldown choices limited wouldn’t be secure enough for me to sleep at night knowing how many copies of the module are out there.

mk

Mitchell,

That would be ideal, I don’t mind specifying it through the parameter then using a pulldown in the form, because that is what I was attempting to do with my code. Any guestimate on something like that? I know this one is a lil tricky…

James,

Pie Man is no doubt tracking this. He’ll add it to our list. Maybe about two weeks or so.

mk

So er, any updates???

James,

Not quite yet.... we’re getting to it though

*Bump* any updates?

James,

I haven’t been able to get to this yet. Honestly, the security side still makes me nervous. It exposes a big hole if you’re not careful. And worst of all, it would take a while to figure out how someone hacked your site if there was an error. Ultimately Solspace’s head would be on the chopping block. No fun.

mk

Hi Mitchell,

I understand your concern, however having to manually change the memberships for each person on my signup is a pain in the rear! I think adding this feature makes the tool much more useful and would help with sales.

Regarding security, there are a few points I’d like to make. 1. I’m an adult, as long at you clearly give a warning in the documentation, or set up a preference to OFF as default in the settings (and then big warning when you turn this feature on) you are covered. 2. You could code in a restriction that will only assign a user to a group that DOES NOT contain access the the control panel, there by containing this security concern in an automatic way. In the end I’m basically asking you to treat me like an adult that can assess the security risk for myself.

Sorry for the delay on this replay, I’ve had other projects to work on. I really hope you reconsider this as I will need this functionality for another site in the coming months.

James,

My plan right now is to look at a number of these issues pertaining to the User module once EE 2.0 comes out. I suspect that with 2.0, with all the re-coding those guys are doing, the User module will become irrelevant. If I am wrong then we’ll look into some secure ways to enable things like you’re asking for.

mk