Femanager is an extension for a TYPO3 Frontend-User Registration.
Maybe you know sr_feuser_register but you want to use a more modern extension, give femanager a try.
This extension basicly brings an easy-to-use frontend-user-registration with a profile manager to your system.
In addition femanager was developed to be very flexible and to bring a lot of features out of the box.
Note: Login and a I forgot my password function is part of the core and not part of femanager.
Requirements of femanager
TYPO3 8.7
Extbase / Fluid
Best use with jQuery and bootstrap
Suggestions
static_info_tables (to show localized countryselection)
sr_freecap (captcha for a spam prevention)
Features
Frontend-User Registration
One step registration with autologin
Main configuration with Flexform
User confirmation (Double-Opt In) (optional)
Administration confirmation (optional)
Refuse and Silent Refuse
Fill email field with username (optional)
Redirect with TypoScript standardWrap (optional)
Prefill Formfields via TypoScript standardWrap (optional)
Get it via composer composer require in2code/femanager OR
Import extension from TYPO3 Extension Repository (TER)
Make your extension configuration in the Extension Manager
Include static template to your main TypoScript template
Make your configuration in the Constants Editor (e.g. include jQuery or Twitter Bootstrap)
Add a new page with the Frontend Plugin and make your settings (e.g. for Registration)
Don't forget to set the startpage in the Content Element (the page where the fe_users should be stored)
Setup the hashing algorythm in the TypoScript Setup (see settings passwordSave)
It's recommended to use https on the page with registration form, to secure registration and validation via AJAX
Done
Step by Step
Extension Manager Configuration
Images
|em|
Extension Manager
|emConfiguration|
Extension Manager Configuration
Settings
Property
Data Type
Description
Default Value
disableModule
boolean
Disable Backend Module: You can deactivate the Backend Module if you don't need it
enableConfirmationModule
boolean
Enable confirmation view: Enable a special confirmation view in Backend Module
disableLog
boolean
Disable Log: If you don't want to save each change of an fe_user, you can disable the logfile
Plugin Configuration
Images
|plugin|
Pagecontent
|plugin2|
Plugin Configuration
Explanation Plugin Settings
Tab
Field Name
Description
Default Value
Main Settings
Choose View
Choose between Registration, Edit, List and Detail. This is the main setting for the output in Frontend.
[empty]
Registration
Select Fields for New-Form (empty = all fields)
Define which fields should be shown in the registration form in Frontend. Empty shows all fields.
[empty]
Registration
Select Usergroups for new Users
Define the usergroup(s) for the new registered user. Alternative define it via TypoScript or let the User decide which group is the right one.
[empty]
Registration
Registration must be confirmed from sender
If you check this field, the user has to confirm his registration with a link in a mail. This Double-Opt-In ensures that the email is correct.
Registration
Registration must be confirmed from an admin (add one ore more emails)
Add one ore more emails (one per line) if the admin should confirm the registration. This can be combined with the “User Confirmation” field.
[empty]
Registration
Notify admin on registration (add one or more emails)
Notify one or more email receivers (one per line) if a new user was completely registered
[empty]
Edit
Select Fields for Edit-Form (empty = all fields)
Define which fields should be shown in the profile-update-form in Frontend. Empty shows all fields.
[empty]
Edit
Show Delete Button in Edit Form
Renders a delete-Profile-Button in Edit view if checked.
Edit
Profile update must be confirmed from an admin (add one ore more emails)
Add one ore more emails (one per line) if the admin should confirm the profile-update.
[empty]
Edit
Notify admin on Profile update (add one ore more emails)
Add one ore more emails (one per line) if the admin should be informed on a profile-update.
[empty]
Listview
Show Searchfield
Displays a Search in Frontend
Listview
Limit
Set a maximum limit for the FE-List
[empty]
Listview
Order by
Order by a fe_users field
Lastname
Listview
Sorting
Order Ascending or Descending
Ascending
Listview
Show from usergroup (empty = show all)
Filter List by one or more Usergroups
[empty]
Detailview
User to show
Select one user for the Detailview. This can be left empty if this view is only visited from listview.
[empty]
Invitation
Restrict "Add Invitation" to one or more Usergroups (empty = No Restriction)
Restrict invitation form to a usergroup. Only users of this groups can invite new users (maybe an admin usergroup).
[empty]
Invitation
Select Fields for invitation-Form (empty = all fields)
Define which fields should be shown in the invitation form in Frontend. Empty shows all fields.
[empty]
Invitation
Select Usergroups for new Users
Define the usergroup(s) for the new registered user. Alternative define it via TypoScript or let the User decide which group is the right one.
[empty]
Invitation
Notify admin on step 1 (add one ore more emails)
Add one ore more emails (one per line) if the admin should be informed on a user creation in step 1.
[empty]
Invitation
Notify admin if user sets a password (add one ore more emails)
Add one ore more emails (one per line) if the admin should be informed on a user creation in step 2 (password set by user).
[empty]
Additional Settings
Add an internal link to a page with terms and conditions
Will be used for rendering the checkbox that asks the visitor to check that he/she accepted the terms for the registration
[empty]
FE Users Record
Images
|feusersRecord|
fe_users Record
New Fields in FE-Users Records
Tab
Field Name
Description
Default Value
Registration
Creation Time
Date and Time when this profile was created.
Registration
Last profile change at
Date and Time when this profile was changed at the last time.
Registration
Registration confirmed by user
Was this profile confirmed by the user?
Registration
Registration confirmed by admin
Was this profile confirmed by the admin?
Registration
FE_user Log
Logs every femanager-change on this profile
[empty]
Registration
Change Request
This field is needed, if the admin has to confirm a profile update. All fields that should be updated will be stored with an XML in this field.
[empty]
TypoScript Configuration
Images
|constants|
Constants Editor
Constants
You always find this constants in the file EXT:femanager/Configuration/TypoScript/Main/constants.txt
Constants can be easily changed with the Template Backend-Module (Constants Editor)
There are only a couple of constants in femanager. This is only for the main settings. Please have a look into the TypoScript Setup, if you want to configure more stuff.
Plain Text
plugin.tx_femanager {
view {
# cat=plugin.tx_femanager/file; type=string; label= Path to template root (FE)
templateRootPath = EXT:femanager/Resources/Private/Templates/
# cat=plugin.tx_femanager/file; type=string; label= Path to template partials (FE)
partialRootPath = EXT:femanager/Resources/Private/Partials/
# cat=plugin.tx_femanager/file; type=string; label= Path to template layouts (FE)
layoutRootPath = EXT:femanager/Resources/Private/Layouts/
}
persistence {
# cat=plugin.tx_femanager//a; type=int+; label= Default storage PID
storagePid =
}
settings {
# cat=plugin.tx_femanager//0100; type=text; label= Admin Name: Default admin name for all emails to the user
adminName = Femanager
# cat=plugin.tx_femanager//0101; type=text; label= Admin Email: Default admin email for all emails to the user
adminEmail = Femanager@domain.org
# cat=plugin.tx_femanager//0200; type=text; label= Upload folder: Define where to save images of the users
uploadFolder = fileadmin/users/
# cat=plugin.tx_femanager//0900; type=boolean; label= Include jQuery: Load and implement jQuery from external source (googleapis.com)
jQuery = 0
# cat=plugin.tx_femanager//0910; type=boolean; label= Include Twitter Bootstrap JS: Load and implement Twitter Bootstrap JavaScript from external source (bootstrapcdn.com)
bootstrap = 0
# cat=plugin.tx_femanager//0920; type=boolean; label= Include Twitter Bootstrap CSS: Load and implement Twitter Bootstrap CSS from external source (bootstrapcdn.com)
bootstrapCSS = 0
}
}
Copied!
Setup
You always find this TypoScript in the file EXT:femanager/Configuration/TypoScript/Main/setup.txt
With TypoScript, you are able to:
Configure Clientside and Serverside Validation
Overwrite any Mail setting
Prefill Formfields
Save the values to another table (e.g. tt_address)
Send values to a third-party-software (e.g. a CRM like salesforce)
And much more...
All settings can be configured directly with TypoScript Setup. Please see all possibilities below:
Plain Text
plugin.tx_femanager {
view {
templateRootPaths {
0 = EXT:femanager/Resources/Private/Templates/
1 = {$plugin.tx_femanager.view.templateRootPath}
}
partialRootPaths {
0 = EXT:femanager/Resources/Private/Partials/
1 = {$plugin.tx_femanager.view.partialRootPath}
}
layoutRootPaths {
0 = EXT:femanager/Resources/Private/Layouts/
1 = {$plugin.tx_femanager.view.layoutRootPath}
}
}
persistence {
storagePid = {$plugin.tx_femanager.persistence.storagePid}
}
features {
#skipDefaultArguments = 1
requireCHashArgumentForActionArguments = 0
}
settings {
###################################
# Settings for CREATE user profiles
###################################
new {
# take username and copy it to the email field (so email field is not necessary in FE)
# fillEmailWithUsername = 1
# login after profile creation (don't work if admin confirmation is turned on)
login = 1
# prefilling (empty) input fields with values from TypoScript
prefill {
# username = TEXT
# username.value = ExampleUsername
# email = TEXT
# email.value = test@in2code.de
}
# redirect user (or admin if adminconfirmation) after profile creation (could be a PID, URL or fileadmin-Link)
# redirect = TEXT
# redirect {
# typolink {
# parameter = 1
# returnLast = url
# #linkAccessRestrictedPages = 1
# }
# }
# redirect user after profile creation request (only if user confirmation is activated) (could be a PID, URL or fileadmin-Link)
# requestRedirect = TEXT
# requestRedirect {
# typolink {
# parameter = 1
# returnLast = url
# #linkAccessRestrictedPages = 1
# }
# }
# redirect user after user clicks confirmation link in email (only if user confirmation is activated) (could be a PID, URL or fileadmin-Link)
# userConfirmationRedirect = TEXT
# userConfirmationRedirect {
# typolink {
# parameter = 1
# returnLast = url
# #linkAccessRestrictedPages = 1
# }
# }
# redirect user after user clicks refuse link in confirmation email (only if user confirmation is activated) (could be a PID, URL or fileadmin-Link)
# userConfirmationRefusedRedirect = TEXT
# userConfirmationRefusedRedirect {
# typolink {
# parameter = 1
# returnLast = url
# #linkAccessRestrictedPages = 1
# }
# }
# redirect admin after admin clicks confirmation link in email (only if admin confirmation is activated) (could be a PID, URL or fileadmin-Link)
# adminConfirmationRedirect = TEXT
# adminConfirmationRedirect {
# typolink {
# parameter = 1
# returnLast = url
# #linkAccessRestrictedPages = 1
# }
# }
# redirect admin after admin clicks refuse link in email (only if admin confirmation is activated) (could be a PID, URL or fileadmin-Link)
# adminConfirmationRefusedRedirect = TEXT
# adminConfirmationRefusedRedirect {
# typolink {
# parameter = 1
# returnLast = url
# #linkAccessRestrictedPages = 1
# }
# }
# redirect admin after admin clicks silent-refuse link in email (only if admin confirmation is activated) (could be a PID, URL or fileadmin-Link)
# adminConfirmationRefusedSilentRedirect = TEXT
# adminConfirmationRefusedSilentRedirect {
# typolink {
# parameter = 1
# returnLast = url
# #linkAccessRestrictedPages = 1
# }
# }
# validation of user input values
# possible validations for each field are: required, email, min, max, intOnly, lettersOnly, unicodeLettersOnly, uniqueInPage, uniqueInDb, date, mustInclude(number,letter,special,space,uppercase), mustNotInclude(number,letter,uppercase,special,space), inList(1,2,3), captcha, sameAs(password)
# see manual for an example how to add custom serverside and clientside validation
validation {
# Enable clientside Formvalidation (JavaScript)
_enable.client = 1
# Enable serverside Formvalidation (PHP)
_enable.server = 1
username {
required = 1
uniqueInDb = 1
mustNotInclude = space
}
email {
required = 1
email = 1
#uniqueInPage = 1
}
password {
required = 1
#min = 10
#mustInclude = number,letter,special
}
password_repeat {
required = 1
sameAs = password
}
usergroup {
# SECURITY: set inList to an allowlist of usergroup uids if users may
# choose their group. Without it (and without
# misc.allowUnrestrictedUserGroupSelection = 1) submitted usergroups are
# ignored. See "Securing the usergroup selection" in the documentation.
#inList = 1,2,3
}
captcha {
# requires installation of sr_freecap
# captcha = 1
}
}
# All email settings within the creation process
email {
# Email for User confirmation (User must confirm his Email address)
createUserConfirmation {
##########################
# Set values (overwrite)
##########################
# (de)activate email completely
_enable = TEXT
_enable.value = 1
# Overwrite Receivers (please fill both)
receiver {
email = TEXT
email.value =
name = TEXT
name.value =
}
# Overwrite Senders (please fill both)
sender {
email = TEXT
email.value = {$plugin.tx_femanager.settings.adminEmail}
name = TEXT
name.value = {$plugin.tx_femanager.settings.adminName}
}
# Overwrite Subject
subject = TEXT
subject.data = LLL:EXT:femanager/Resources/Private/Language/locallang.xlf:emailCreateUserConfirmationSubject
# Set CC receivers
cc = TEXT
cc.value =
# Set reply to receivers
replyTo = TEXT
replyTo.value =
# Set mail priority from 1 to 5
priority = TEXT
priority.value =
# Add Attachment (separate each with comma)
# attachments = COA
# attachments {
# 10 = TEXT
# 10.value = fileadmin/file.pdf
# 10.wrap = |,
# 20 = TEXT
# 20.value = fileadmin/file2.pdf
# 20.wrap = |,
# }
# Add Embed Images (separate each with comma) - can be used in mail with <img src="{embedImages.0}" /> and so on...
# embedImage = COA
# embedImage {
# 10 = FILES
# 10 {
# references {
# table = fe_users
# fieldName = image
# uid.field = uid
# }
# begin = 0
# maxItems = 1
# renderObj = IMG_RESOURCE
# renderObj {
# file.import.dataWrap = {file:current:storage}:{file:current:identifier}
# file.maxW = 120
# file.maxH = 120
# }
# }
# 20 = TEXT
# 20.wrap = ,|
# 20.value = fileadmin/image.jpg
# }
}
# Email for Admin confirmation (Admin must confirm registration in an email)
createAdminConfirmation {
##########################
# Set values (overwrite)
##########################
# (de)activate email completely
_enable = TEXT
_enable.value = 1
# Overwrite Receivers (please fill both)
receiver {
email = TEXT
email.value =
name = TEXT
name.value = {$plugin.tx_femanager.settings.adminName}
}
# Overwrite Senders (please fill both)
sender {
email = TEXT
email.value =
name = TEXT
name.value =
}
# Overwrite Subject
subject = TEXT
subject.data = LLL:EXT:femanager/Resources/Private/Language/locallang.xlf:emailCreateAdminConfirmationSubject
# Set CC receivers
cc = TEXT
cc.value =
# Set reply to receivers
replyTo = TEXT
replyTo.value =
# Set mail priority from 1 to 5
priority = TEXT
priority.value =
# Add Attachment (separate each with comma)
# attachments = COA
# attachments {
# 10 = TEXT
# 10.value = fileadmin/file.pdf
# 10.wrap = |,
# 20 = TEXT
# 20.value = fileadmin/file2.pdf
# 20.wrap = |,
# }
# Add Embed Images (separate each with comma) - can be used in mail with <img src="{embedImages.0}" /> and so on...
embedImage = COA
embedImage {
10 = FILES
10 {
references {
table = fe_users
fieldName = image
uid.field = uid
}
begin = 0
maxItems = 1
renderObj = IMG_RESOURCE
renderObj {
file.import.dataWrap = {file:current:storage}:{file:current:identifier}
file.maxW = 120
file.maxH = 120
}
}
# 20 = TEXT
# 20.wrap = ,|
# 20.value = fileadmin/image.jpg
}
}
# Email to user to confirm his new profile (with and without admin confirmation)
createUserNotify {
##########################
# Set values (overwrite)
##########################
# (de)activate email completely
_enable = TEXT
_enable.value = 0
# Overwrite Receivers (please fill both)
receiver {
email = TEXT
email.value =
name = TEXT
name.value =
}
# Overwrite Senders (please fill both)
sender {
email = TEXT
email.value = {$plugin.tx_femanager.settings.adminEmail}
name = TEXT
name.value = {$plugin.tx_femanager.settings.adminName}
}
# Overwrite Subject
subject = TEXT
subject.data = LLL:EXT:femanager/Resources/Private/Language/locallang.xlf:emailCreateUserNotifySubject
# Set CC receivers
cc = TEXT
cc.value =
# Set reply to receivers
replyTo = TEXT
replyTo.value =
# Set mail priority from 1 to 5
priority = TEXT
priority.value =
# Add Attachment (separate each with comma)
# attachments = COA
# attachments {
# 10 = TEXT
# 10.value = fileadmin/file.pdf
# 10.wrap = |,
# 20 = TEXT
# 20.value = fileadmin/file2.pdf
# 20.wrap = |,
# }
# Add Embed Images (separate each with comma) - can be used in mail with <img src="{embedImages.0}" /> and so on...
# embedImage = COA
# embedImage {
# 10 = FILES
# 10 {
# references {
# table = fe_users
# fieldName = image
# uid.field = uid
# }
# begin = 0
# maxItems = 1
# renderObj = IMG_RESOURCE
# renderObj {
# file.import.dataWrap = {file:current:storage}:{file:current:identifier}
# file.maxW = 120
# file.maxH = 120
# }
# }
# 20 = TEXT
# 20.wrap = ,|
# 20.value = fileadmin/image.jpg
# }
}
# Email for User notify, if admin refused profile registration
createUserNotifyRefused {
##########################
# Set values (overwrite)
##########################
# (de)activate email completely
_enable = TEXT
_enable.value = 1
# Overwrite Receivers (please fill both)
receiver {
email = TEXT
email.value =
name = TEXT
name.value =
}
# Overwrite Senders (please fill both)
sender {
email = TEXT
email.value = {$plugin.tx_femanager.settings.adminEmail}
name = TEXT
name.value = {$plugin.tx_femanager.settings.adminName}
}
# Overwrite Subject
subject = TEXT
subject.data = LLL:EXT:femanager/Resources/Private/Language/locallang.xlf:emailCreateUserNotifyRefusedSubject
# Set CC receivers
cc = TEXT
cc.value =
# Set reply to receivers
replyTo = TEXT
replyTo.value =
# Set mail priority from 1 to 5
priority = TEXT
priority.value =
# Add Attachment (separate each with comma)
# attachments = COA
# attachments {
# 10 = TEXT
# 10.value = fileadmin/file.pdf
# 10.wrap = |,
# 20 = TEXT
# 20.value = fileadmin/file2.pdf
# 20.wrap = |,
# }
# Add Embed Images (separate each with comma) - can be used in mail with <img src="{embedImages.0}" /> and so on...
# embedImage = COA
# embedImage {
# 10 = FILES
# 10 {
# references {
# table = fe_users
# fieldName = image
# uid.field = uid
# }
# begin = 0
# maxItems = 1
# renderObj = IMG_RESOURCE
# renderObj {
# file.import.dataWrap = {file:current:storage}:{file:current:identifier}
# file.maxW = 120
# file.maxH = 120
# }
# }
# 20 = TEXT
# 20.wrap = ,|
# 20.value = fileadmin/image.jpg
# }
}
# Email for Admin notify, if profile registration
createAdminNotify {
##########################
# Set values (overwrite)
##########################
# (de)activate email completely
_enable = TEXT
_enable.value = 1
# Overwrite Receivers (please fill both)
receiver {
email = TEXT
email.value =
name = TEXT
name.value = {$plugin.tx_femanager.settings.adminName}
}
# Overwrite Senders (please fill both)
sender {
email = TEXT
email.value =
name = TEXT
name.value =
}
# Overwrite Subject
subject = TEXT
subject.data = LLL:EXT:femanager/Resources/Private/Language/locallang.xlf:emailCreateNotifySubject
# Set CC receivers
cc = TEXT
cc.value =
# Set reply to receivers
replyTo = TEXT
replyTo.value =
# Set mail priority from 1 to 5
priority = TEXT
priority.value =
# Add Attachment (separate each with comma)
# attachments = COA
# attachments {
# 10 = TEXT
# 10.value = fileadmin/file.pdf
# 10.wrap = |,
# 20 = TEXT
# 20.value = fileadmin/file2.pdf
# 20.wrap = |,
# }
# Add Embed Images (separate each with comma) - can be used in mail with <img src="{embedImages.0}" /> and so on...
embedImage = COA
embedImage {
10 = FILES
10 {
references {
table = fe_users
fieldName = image
uid.field = uid
}
begin = 0
maxItems = 1
renderObj = IMG_RESOURCE
renderObj {
file.import.dataWrap = {file:current:storage}:{file:current:identifier}
file.maxW = 120
file.maxH = 120
}
}
# 20 = TEXT
# 20.wrap = ,|
# 20.value = fileadmin/image.jpg
}
}
}
# overwrite any user values with TypoScript
forceValues {
# Overwrite initally (default)
beforeAnyConfirmation {
# Usergroups can be set with a commaseparated list
# usergroup = TEXT
# usergroup.value = 2
# Set a fix value
# email = TEXT
# email.value = service@in2code.de
}
# Overwrite on user confirmation (only if user confirmation was activated)
onUserConfirmation {
# Usergroups can be set with a commaseparated list
# usergroup = TEXT
# usergroup.value = 3
# Set a fix value
# company = TEXT
# company.value = in2code.de
}
# Overwrite on admin confirmation (only if admin confirmation was activated)
onAdminConfirmation {
# Usergroups can be set with a commaseparated list
# usergroup = TEXT
# usergroup.value = 4
# Set a fix value
# www = TEXT
# www.value = http://www.in2code.de
}
}
# Send Form values via POST to another system (e.g. CRM like salesforce or eloqua)
sendPost {
# Activate sendPost (0/1)
# _enable = TEXT
# _enable.value = 0
# Target URL for POST values (like http://www.target.com/target.php)
# targetUrl = https://www.salesforce.com/servlet/servlet.WebToLead?encoding=UTF-8
# build your post datas like ¶m1=value1¶m2=value2
# data = COA
# data {
# 10 = TEXT
# 10 {
# # value from field {username}
# field = username
# wrap = &username=|
# }
# 20 = TEXT
# 20 {
# # value from field {email}
# field = email
# wrap = &email=|
# }
# 30 = TEXT
# 30 {
# # value from field {title}
# field = title
# wrap = &title=|
# }
# }
# activate debug mode - shows all configuration from curl settings (needs extension devlog)
# debug = 0
}
# Save user values to one or more other tables (e.g. tt_address or something else)
# With .field=[fieldname] you have access to the user object
# Possible values are: uid, username, address, city, company, country, email, fax, firstName, lastName, middleName, name, password, telephone, fax, title, www, zip and uid_[tablename] (to have access to the uid of one of the last loop)
storeInDatabase {
# tt_address {
# _enable = TEXT
# _enable.value = 0
# pid = TEXT
# pid.value = 21
# name = TEXT
# name.field = username
# email = TEXT
# email.field = email
# first_name = TEXT
# first_name.field = firstName
# last_name = TEXT
# last_name.field = lastName
# }
}
misc {
# Remove Usergroups from Usergroup Selection in Frontend
# removeFromUserGroupSelection = 2,3
# initially save password as hash ("Argon2i", "Bcrypt", "Pbkdf2", "Phpass", "Blowfish", "md5", "none" ("sha1" for TYPO3 V8) or empty for extension saltedpasswords - if installed
# passwordSave = md5
# Configuration for autogenerated Username and Password
autogenerate {
username {
# Length
length = 6
# Allow uppercase Characters
addUpperCase = 0
# Allow special Characters
addSpecialCharacters = 0
}
password {
# Length
length = 10
# Allow uppercase Characters
addUpperCase = 1
# Allow special Characters
addSpecialCharacters = 1
}
}
}
}
###################################
# Settings for UPDATE user profiles
###################################
edit {
# take username and copy it to the email field (so email field is not nessesary in FE)
#fillEmailWithUsername = 1
# redirect user (or admin if adminconfirmation) after profile update
# redirect = TEXT
# redirect {
# typolink {
# parameter = 1
# returnLast = url
# #linkAccessRestrictedPages = 1
# }
# }
# redirect user after profile update request (only if admin confirmation is activated)
# requestRedirect = TEXT
# requestRedirect {
# typolink {
# parameter = 1
# returnLast = url
# #linkAccessRestrictedPages = 1
# }
# }
# prefilling (empty) input fields with values from TypoScript
prefill {
# username = TEXT
# username.value = ExampleUsername
# email = TEXT
# email.value = test@in2code.de
}
# validation of user input values
# possible validations for each field are: required, email, min, max, intOnly, lettersOnly, unicodeLettersOnly, uniqueInPage, uniqueInDb, date, mustInclude(number,letter,special,space), mustNotInclude(number,letter,special,space), inList(1,2,3), captcha, sameAs(password)
validation {
# Enable clientside Formvalidation (JavaScript)
_enable.client = 1
# Enable serverside Formvalidation (PHP)
_enable.server = 1
username {
required = 1
mustNotInclude = space
}
email {
required = 1
email = 1
}
password {
required = 1
#min = 10
#mustInclude = number,letter,special
}
password_repeat {
required = 1
sameAs = password
}
usergroup {
# SECURITY: set inList to an allowlist of usergroup uids if users may
# choose their group. Without it (and without
# misc.allowUnrestrictedUserGroupSelection = 1) submitted usergroups are
# ignored. See "Securing the usergroup selection" in the documentation.
#inList = 1,2,3
}
captcha {
# requires installation of sr_freecap
# captcha = 1
}
}
# All email settings within the update process
email {
# Email for admin if user requests update (only if confirmation by admin is activated)
updateRequest {
##########################
# Set values (overwrite)
##########################
# (de)activate email completely
_enable = TEXT
_enable.value = 1
# Overwrite Receivers (please fill both)
receiver {
email = TEXT
email.value =
name = TEXT
name.value =
}
# Overwrite Senders (please fill both)
sender {
email = TEXT
email.value =
name = TEXT
name.value = {$plugin.tx_femanager.settings.adminName}
}
# Overwrite Subject
subject = TEXT
subject.data = LLL:EXT:femanager/Resources/Private/Language/locallang.xlf:emailUpdateRequestSubject
# Set CC receivers
cc = TEXT
cc.value =
# Set reply to receivers
replyTo = TEXT
replyTo.value =
# Set mail priority from 1 to 5
priority = TEXT
priority.value =
# Add Attachment (separate each with comma)
# attachments = COA
# attachments {
# 10 = TEXT
# 10.value = fileadmin/file.pdf
# 10.wrap = |,
# 20 = TEXT
# 20.value = fileadmin/file2.pdf
# 20.wrap = |,
# }
# Add Embed Images (separate each with comma) - can be used in mail with <img src="{embedImages.0}" /> and so on...
# embedImage = COA
# embedImage {
# 10 = FILES
# 10 {
# references {
# table = fe_users
# fieldName = image
# uid.field = uid
# }
# begin = 0
# maxItems = 1
# renderObj = IMG_RESOURCE
# renderObj {
# file.import.dataWrap = {file:current:storage}:{file:current:identifier}
# file.maxW = 120
# file.maxH = 120
# }
# }
# 20 = TEXT
# 20.wrap = ,|
# 20.value = fileadmin/image.jpg
# }
}
# Email to user if update request was refused by admin
updateRequestRefused {
##########################
# Set values (overwrite)
##########################
# (de)activate email completely
_enable = TEXT
_enable.value = 1
# Overwrite Receiver (please fill both)
receiver {
email = TEXT
email.value =
name = TEXT
name.value =
}
# Overwrite Senders (please fill both)
sender {
email = TEXT
email.value = {$plugin.tx_femanager.settings.adminEmail}
name = TEXT
name.value = {$plugin.tx_femanager.settings.adminName}
}
# Overwrite Subject
subject = TEXT
subject.data = LLL:EXT:femanager/Resources/Private/Language/locallang.xlf:emailUpdateRequestRefusedSubject
# Set CC receivers
cc = TEXT
cc.value =
# Set reply to receivers
replyTo = TEXT
replyTo.value =
# Set mail priority from 1 to 5 (from important to not important)
priority = TEXT
priority.value =
# Add Attachment (separate each with comma)
# attachments = COA
# attachments {
# 10 = TEXT
# 10.value = fileadmin/file.pdf
# 10.wrap = |,
# 20 = TEXT
# 20.value = fileadmin/file2.pdf
# 20.wrap = |,
# }
# Add Embed Images (separate each with comma) - can be used in mail with <img src="{embedImages.0}" /> and so on...
# embedImage = COA
# embedImage {
# 10 = FILES
# 10 {
# references {
# table = fe_users
# fieldName = image
# uid.field = uid
# }
# begin = 0
# maxItems = 1
# renderObj = IMG_RESOURCE
# renderObj {
# file.import.dataWrap = {file:current:storage}:{file:current:identifier}
# file.maxW = 120
# file.maxH = 120
# }
# }
# 20 = TEXT
# 20.wrap = ,|
# 20.value = fileadmin/image.jpg
# }
}
# Email for if update request was refused by admin
notifyAdmin {
##########################
# Set values (overwrite)
##########################
# (de)activate email completely
_enable = TEXT
_enable.value = 1
# Overwrite Receiver (please fill both)
receiver {
email = TEXT
email.value =
name = TEXT
name.value = {$plugin.tx_femanager.settings.adminName}
}
# Overwrite Senders (please fill both)
sender {
email = TEXT
email.value =
name = TEXT
name.value =
}
# Overwrite Subject
subject = TEXT
subject.data = LLL:EXT:femanager/Resources/Private/Language/locallang.xlf:emailUpdateNotifySubject
# Set CC receivers
cc = TEXT
cc.value =
# Set reply to receivers
replyTo = TEXT
replyTo.value =
# Set mail priority from 1 to 5 (from important to not important)
priority = TEXT
priority.value =
# Add Attachment (separate each with comma)
# attachments = COA
# attachments {
# 10 = TEXT
# 10.value = fileadmin/file.pdf
# 10.wrap = |,
# 20 = TEXT
# 20.value = fileadmin/file2.pdf
# 20.wrap = |,
# }
# Add Embed Images (separate each with comma) - can be used in mail with <img src="{embedImages.0}" /> and so on...
# embedImage = COA
# embedImage {
# 10 = FILES
# 10 {
# references {
# table = fe_users
# fieldName = image
# uid.field = uid
# }
# begin = 0
# maxItems = 1
# renderObj = IMG_RESOURCE
# renderObj {
# file.import.dataWrap = {file:current:storage}:{file:current:identifier}
# file.maxW = 120
# file.maxH = 120
# }
# }
# 20 = TEXT
# 20.wrap = ,|
# 20.value = fileadmin/image.jpg
# }
}
}
# overwrite any user values with TypoScript
forceValues {
# Overwrite initally (default) - Note: This values will be updated as soon as the admin confirms the request (if admin confirm is activated)
beforeAnyConfirmation {
# Usergroups can be set with a commaseparated list
# usergroup = TEXT
# usergroup.value = 2
# Set a fix value
# email = TEXT
# email.value = service@in2code.de
}
# Overwrite on admin confirmation (only if admin confirmation was activated)
onAdminConfirmation {
# Usergroups can be set with a commaseparated list
# usergroup = TEXT
# usergroup.value = 3
# Set a fix value
# www = TEXT
# www.value = http://www.in2code.de
}
}
misc {
# Don't change password if it is empty
keepPasswordIfEmpty = 1
# Remove Usergroups from Usergroup Selection in Frontend
# removeFromUserGroupSelection = 2,3
# initially save password as hash ("Argon2i", "Bcrypt", "Pbkdf2", "Phpass", "Blowfish", "md5", "none" ("sha1" for TYPO3 V8) or empty for extension saltedpasswords - if installed
# passwordSave = md5
}
}
###################################
# Settings for INVITATION View
###################################
invitation {
# take username and copy it to the email field (so email field is not nessesary in FE)
#fillEmailWithUsername = 1
# redirect admin after step 1
# redirectStep1 = TEXT
# redirectStep1 {
# typolink {
# parameter = 1
# returnLast = url
# #linkAccessRestrictedPages = 1
# }
# }
# redirect user after profile delete (from email)
# redirectDelete = TEXT
# redirectDelete {
# typolink {
# parameter = 1
# returnLast = url
# #linkAccessRestrictedPages = 1
# }
# }
# redirect user after he changed his password
# redirectPasswordChanged = TEXT
# redirectPasswordChanged {
# typolink {
# parameter = 1
# returnLast = url
# #linkAccessRestrictedPages = 1
# }
# }
# validation of user input values
# possible validations for each field are: required, email, min, max, intOnly, lettersOnly, unicodeLettersOnly, uniqueInPage, uniqueInDb, date, mustInclude(number,letter,special,space), mustNotInclude(number,letter,special,space), inList(1,2,3), captcha, sameAs(password)
# Validation for first Step (Create)
validation {
# Enable clientside Formvalidation (JavaScript)
_enable.client = 1
# Enable serverside Formvalidation (PHP)
_enable.server = 1
username {
required = 1
uniqueInDb = 1
mustNotInclude = space
}
email {
required = 1
email = 1
}
usergroup {
# SECURITY: set inList to an allowlist of usergroup uids if users may
# choose their group. Without it (and without
# misc.allowUnrestrictedUserGroupSelection = 1) submitted usergroups are
# ignored. See "Securing the usergroup selection" in the documentation.
#inList = 1,2,3
}
captcha {
# requires installation of sr_freecap
# captcha = 1
}
}
# Validation for second Step (Edit)
validationEdit {
# Enable clientside Formvalidation (JavaScript)
_enable.client = 1
# Enable serverside Formvalidation (PHP)
_enable.server = 1
password {
required = 1
#min = 10
#mustInclude = number,letter,special
}
password_repeat {
required = 1
sameAs = password
}
}
# All email settings within the update process
email {
# Email to user for confirmation
invitation {
##########################
# Set values (overwrite)
##########################
# (de)activate email completely
_enable = TEXT
_enable.value = 1
# Overwrite Receivers (please fill both)
receiver {
email = TEXT
email.value =
name = TEXT
name.value =
}
# Overwrite Senders (please fill both)
sender {
email = TEXT
email.value = {$plugin.tx_femanager.settings.adminEmail}
name = TEXT
name.value = {$plugin.tx_femanager.settings.adminName}
}
# Overwrite Subject
subject = TEXT
subject.data = LLL:EXT:femanager/Resources/Private/Language/locallang.xlf:emailInvitationSubject
# Set CC receivers
cc = TEXT
cc.value =
# Set reply to receivers
replyTo = TEXT
replyTo.value =
# Set mail priority from 1 to 5
priority = TEXT
priority.value =
# Add Attachment (separate each with comma)
# attachments = COA
# attachments {
# 10 = TEXT
# 10.value = fileadmin/file.pdf
# 10.wrap = |,
# 20 = TEXT
# 20.value = fileadmin/file2.pdf
# 20.wrap = |,
# }
# Add Embed Images (separate each with comma) - can be used in mail with <img src="{embedImages.0}" /> and so on...
# embedImage = COA
# embedImage {
# 10 = FILES
# 10 {
# references {
# table = fe_users
# fieldName = image
# uid.field = uid
# }
# begin = 0
# maxItems = 1
# renderObj = IMG_RESOURCE
# renderObj {
# file.import.dataWrap = {file:current:storage}:{file:current:identifier}
# file.maxW = 120
# file.maxH = 120
# }
# }
# 20 = TEXT
# 20.wrap = ,|
# 20.value = fileadmin/image.jpg
# }
}
# Email for admin if profile added (only if admin notify is activated)
invitationAdminNotifyStep1 {
##########################
# Set values (overwrite)
##########################
# (de)activate email completely
_enable = TEXT
_enable.value = 1
# Overwrite Receivers (please fill both)
receiver {
email = TEXT
email.value =
name = TEXT
name.value = {$plugin.tx_femanager.settings.adminName}
}
# Overwrite Senders (please fill both)
sender {
email = TEXT
email.value =
name = TEXT
name.value =
}
# Overwrite Subject
subject = TEXT
subject.data = LLL:EXT:femanager/Resources/Private/Language/locallang.xlf:emailInvitationAdminNotifiyStep1Subject
# Set CC receivers
cc = TEXT
cc.value =
# Set reply to receivers
replyTo = TEXT
replyTo.value =
# Set mail priority from 1 to 5
priority = TEXT
priority.value =
# Add Attachment (separate each with comma)
# attachments = COA
# attachments {
# 10 = TEXT
# 10.value = fileadmin/file.pdf
# 10.wrap = |,
# 20 = TEXT
# 20.value = fileadmin/file2.pdf
# 20.wrap = |,
# }
# Add Embed Images (separate each with comma) - can be used in mail with <img src="{embedImages.0}" /> and so on...
# embedImage = COA
# embedImage {
# 10 = FILES
# 10 {
# references {
# table = fe_users
# fieldName = image
# uid.field = uid
# }
# begin = 0
# maxItems = 1
# renderObj = IMG_RESOURCE
# renderObj {
# file.import.dataWrap = {file:current:storage}:{file:current:identifier}
# file.maxW = 120
# file.maxH = 120
# }
# }
# 20 = TEXT
# 20.wrap = ,|
# 20.value = fileadmin/image.jpg
# }
}
# Email for admin if profile added (only if admin notify is activated)
invitationAdminNotify {
##########################
# Set values (overwrite)
##########################
# (de)activate email completely
_enable = TEXT
_enable.value = 1
# Overwrite Receivers (please fill both)
receiver {
email = TEXT
email.value =
name = TEXT
name.value = {$plugin.tx_femanager.settings.adminName}
}
# Overwrite Senders (please fill both)
sender {
email = TEXT
email.value =
name = TEXT
name.value =
}
# Overwrite Subject
subject = TEXT
subject.data = LLL:EXT:femanager/Resources/Private/Language/locallang.xlf:emailInvitationAdminNotifiySubject
# Set CC receivers
cc = TEXT
cc.value =
# Set reply to receivers
replyTo = TEXT
replyTo.value =
# Set mail priority from 1 to 5
priority = TEXT
priority.value =
# Add Attachment (separate each with comma)
# attachments = COA
# attachments {
# 10 = TEXT
# 10.value = fileadmin/file.pdf
# 10.wrap = |,
# 20 = TEXT
# 20.value = fileadmin/file2.pdf
# 20.wrap = |,
# }
# Add Embed Images (separate each with comma) - can be used in mail with <img src="{embedImages.0}" /> and so on...
# embedImage = COA
# embedImage {
# 10 = FILES
# 10 {
# references {
# table = fe_users
# fieldName = image
# uid.field = uid
# }
# begin = 0
# maxItems = 1
# renderObj = IMG_RESOURCE
# renderObj {
# file.import.dataWrap = {file:current:storage}:{file:current:identifier}
# file.maxW = 120
# file.maxH = 120
# }
# }
# 20 = TEXT
# 20.wrap = ,|
# 20.value = fileadmin/image.jpg
# }
}
# Email for admin if user refused profile invitation (only if admin notify on step 1 is activated)
invitationRefused {
##########################
# Set values (overwrite)
##########################
# (de)activate email completely
_enable = TEXT
_enable.value = 1
# Overwrite Receivers (please fill both)
receiver {
email = TEXT
email.value =
name = TEXT
name.value = {$plugin.tx_femanager.settings.adminName}
}
# Overwrite Senders (please fill both)
sender {
email = TEXT
email.value =
name = TEXT
name.value =
}
# Overwrite Subject
subject = TEXT
subject.data = LLL:EXT:femanager/Resources/Private/Language/locallang.xlf:emailInvitationUserRefusedAdminNotifiyStep1Subject
# Set CC receivers
cc = TEXT
cc.value =
# Set reply to receivers
replyTo = TEXT
replyTo.value =
# Set mail priority from 1 to 5
priority = TEXT
priority.value =
# Add Attachment (separate each with comma)
# attachments = COA
# attachments {
# 10 = TEXT
# 10.value = fileadmin/file.pdf
# 10.wrap = |,
# 20 = TEXT
# 20.value = fileadmin/file2.pdf
# 20.wrap = |,
# }
# Add Embed Images (separate each with comma) - can be used in mail with <img src="{embedImages.0}" /> and so on...
# embedImage = COA
# embedImage {
# 10 = FILES
# 10 {
# references {
# table = fe_users
# fieldName = image
# uid.field = uid
# }
# begin = 0
# maxItems = 1
# renderObj = IMG_RESOURCE
# renderObj {
# file.import.dataWrap = {file:current:storage}:{file:current:identifier}
# file.maxW = 120
# file.maxH = 120
# }
# }
# 20 = TEXT
# 20.wrap = ,|
# 20.value = fileadmin/image.jpg
# }
}
}
# overwrite any user values with TypoScript
forceValues {
# Overwrite initally (default)
beforeAnyConfirmation {
# Usergroups can be set with a commaseparated list
# usergroup = TEXT
# usergroup.value = 2
# Set a fix value
# email = TEXT
# email.value = service@in2code.de
}
# Overwrite on admin confirmation (only if admin confirmation was activated)
onAdminConfirmation {
# Usergroups can be set with a commaseparated list
# usergroup = TEXT
# usergroup.value = 4
# Set a fix value
# www = TEXT
# www.value = http://www.in2code.de
}
}
misc {
# Remove Usergroups from Usergroup Selection in Frontend
# removeFromUserGroupSelection = 2,3
# initially save password as hash ("Argon2i", "Bcrypt", "Pbkdf2", "Phpass", "Blowfish", "md5", "none" ("sha1" for TYPO3 V8) or empty for extension saltedpasswords - if installed
# passwordSave = md5
}
}
delete {
# redirect after profile delete
# redirect = TEXT
# redirect {
# typolink {
# parameter = 1
# returnLast = url
# #linkAccessRestrictedPages = 1
# }
# }
}
list {
filter {
searchword {
fieldsToSearch = address, city, company, country, email, fax, first_name, image, last_name, middle_name, name, telephone, title, usergroup.title, username, www, zip
}
}
}
loginAs {
# redirect when simulate a frontenduser login from administrator
# redirect = TEXT
# redirect {
# typolink {
# parameter = 1
# returnLast = url
# #linkAccessRestrictedPages = 1
# }
# }
}
misc {
# Where to save new image files
uploadFolder = {$plugin.tx_femanager.settings.uploadFolder}
# Number of allowed images to upload
uploadAmount = 3
# Maximum size for image upload in bytes
uploadSize = 25000000
# Number of allowed images to upload
uploadFileExtension = jpeg, jpg, gif, png, bmp, svg, tif, tiff
# Width of the rendered image in FE
renderImageWidth = 250
}
# Add own finisher classes that will be called after registration, profile update, invitation or deletion (e.g. if you want to do something with form values by your own: Save into tables, call an API, etc...)
finishers {
# Femanager finishers
10.class = In2code\Femanager\Finisher\SaveToAnyTableFinisher
20.class = In2code\Femanager\Finisher\SendParametersFinisher
# 100 {
# Classname that should be called with method *Finisher()
# class = Vendor\Ext\Finisher\DoSomethingFinisher
# optional: Add configuration for your PHP
# config {
# foo = bar
# fooCObject = TEXT
# fooCObject.value = do something with this text
# }
# optional: If file will not be loaded from autoloader, add path and it will be called with require_once
# require = fileadmin/femanager/finisher/DoSomethingFinisher.php
# }
}
# Add any dataProcessor classes that will be called just before the action will be rendered
dataProcessors {
# Remove empty usergroup variables
10 {
class = In2code\Femanager\DataProcessor\CleanUserGroup
events {
New = create
Edit = update
}
}
# Enable image upload
20 {
class = In2code\Femanager\DataProcessor\ImageManipulation
config {
propertyNamesForUpload = image
sysFileRelation {
tablenames = fe_users
fieldname = image
table_local = sys_file
}
}
events {
New = create
Edit = update
}
}
# Birthdate converter
30 {
class = In2code\Femanager\DataProcessor\DateConverter
config {
fieldNames = dateOfBirth
}
events {
New = create
Edit = update
}
}
# 100 {
# Classname that should be called with an existing method process()
# class = Vendor\Ext\DataProcessor\DoSomethingDataProcessor
# optional: Add configuration for your PHP
# config {
# foo = bar
# fooCObject = TEXT
# fooCObject.value = do something with this text
# }
# call this class just before this actions will be opened
# events {
# New = create,createStatus
# }
# }
}
# Add own autoAdminConfirmation classes that can decide if confirmation by admin (only if activated) can be skipped. E.g. if an Email domain fits to a given list.
autoAdminConfirmation {
# Femanager autoAdminConfirmation classes
# 10 {
# class = In2code\Femanager\Domain\Service\AutoAdminConfirmation\EmailDomainConfirmation
# config {
# Just look at the domains of the given Email-Addresses
# confirmByEmailDomains = .de, .it, .ch, .at
# confirmByEmailDomainsExceptions = gmail.de, gmx.de
# }
# }
# 100 {
# Classname that should be called with method isAutoAdminConfirmationFullfilled()
# class = In2code\FemanagerExtended\Domain\Service\AutoAdminConfirmation\IpAddressConfirmation
# optional: Add configuration for your PHP
# config {
# foo = bar
# fooCObject = TEXT
# fooCObject.value = do something with this text
# }
# }
}
# Don't touch this - this is needed to let the plugin know if the main typoscript is included - otherwise an errormessage will be shown in the frontend
_TypoScriptIncluded = 1
}
}
#########################
# Inlude JavaScript files
#########################
# add jQuery if it was turned on in the constants
[globalVar = LIT:0 < {$plugin.tx_femanager.settings.jQuery}]
page.includeJSFooterlibs.femanagerJQuery = //ajax.googleapis.com/ajax/libs/jquery/3.2.1/jquery.min.js
page.includeJSFooterlibs.femanagerJQuery.external = 1
[end]
# add twitter bootstrap JS if it was turned on in the constants
[globalVar = LIT:0 < {$plugin.tx_femanager.settings.bootstrap}]
page.includeJSFooterlibs.femanangerBootstrap = //maxcdn.bootstrapcdn.com/bootstrap/3.3.7/js/bootstrap.min.js
page.includeJSFooterlibs.femanangerBootstrap.external = 1
[end]
#########################
# Inlude CSS files
#########################
# add twitter bootstrap CSS if it was turned on in the constants
[globalVar = LIT:0 < {$plugin.tx_femanager.settings.bootstrapCSS}]
page.includeCSS.femanangerBootstrap = //maxcdn.bootstrapcdn.com/bootstrap/3.3.7/css/bootstrap.min.css
page.includeCSS.femanangerBootstrap.external = 1
[end]
page {
includeCSS {
femanagerMain = EXT:femanager/Resources/Public/Css/Main.min.css
}
includeJSFooter {
femanagerValidation = EXT:femanager/Resources/Public/JavaScript/Validation.min.js
femanager = EXT:femanager/Resources/Public/JavaScript/Femanager.min.js
}
}
Copied!
Backend Module
Images
|backendmodule|
Backend Module (List)
|backendmodule2|
Backend Module (Confirmation)
Explanation
List Module
The Femanager-Backend-Module List is only a small module to search and list some frontend users.
Some AJAX-requests will help you and your editors to delete or hide and unhide users very fast.
The edit icons works in the same way as in the list module.
In addition you can see who's only in this moment (If fe_users session exists and is not older than 2h) and you can
logout your fe-users with just one click.
A new feature called log in as allows you to open a new window where your frontend is shown and you are already
logged in as the chosen user (admin only feature)
Confirmation Module
The confirmation module can be activated via Extension Manager because it's still in the beta phase. Nevertheless you
will see a list of not-yet-confirmed fe-users that can be confirmed (or refused) by just one click.
Per default only disabled users are listed that have a user confirmation.
If all disabled users should be shown, even if they have no user confirmation (because your plugin is configured, that
only admins should confirm the requests), User TSConfig can be used like (to list those users):
tx_femanager.UserBackend.confirmation.filter.userConfirmation=0
Configuration
Nearly all settings for the backend module are done in ext_typoscript_setup.txt in the key module.tx_femanager.
One setting must be done in your TypoScript Template, the setting module.tx_femanager.settings.configPID should be set in your TypoScript, the default is 1.
You can overwrite these settings in your page TS.
Tab
Field Name
Description
Default Value
settings.configPID
typoscript main template storage
You need to specify the pid, where your main typoscript settings (frontend) is stored. Usually you will take the
root page of your installation. This is needed to perform actions like confirm users via Backend or resend
confirmation mails. If you have a multidomain system, you can overwrite config in your typoScript Tempplate for
each domain.
This security release closes multiple security issues:
Privilege escalation:
Closes a privilege escalation in the frontend usergroup selection.
The registration, edit and invitation forms can render a usergroup <select>. The frontend
template and the rendered dropdown were treated as the only restriction on which usergroup a user
could choose. They are not a security boundary: a crafted request can submit any usergroup uid,
regardless of what the form offers. A logged-in frontend user could therefore assign any
frontend usergroup - including privileged ones - to their own account.
What changed
The submitted usergroup relation is now validated on the server before the user is persisted, in a
single place (UserGroupSanitizationService). The form is secure by default / fail closed:
Forced groups - if settings.<form>.overrideUserGroup is set, the configured group(s)
always win and the submitted value is ignored (unchanged behaviour).
Field not editable - if usergroup is not part of the configured fields, any submitted
usergroup change is reverted.
Allowlist - if settings.<form>.validation.usergroup.inList is set, the submitted uids are
reduced to that list. This is the recommended way to let users choose a group.
Opt-in for unrestricted selection - if no allowlist is configured but
settings.<form>.misc.allowUnrestrictedUserGroupSelection = 1 is set, every offered group may
be selected (legacy behaviour).
Fail closed - if neither an allowlist nor the opt-in is configured, the submitted usergroup
change is ignored and a log entry (Profile update not authorized) is written.
Every reverted or reduced submission is logged so unexpected usergroup changes become visible.
Important
Installations that previously relied on an unconfigured usergroup selection (no
validation.usergroup.inList) will no longer accept user-submitted usergroups by default. This
is intentional. To keep offering a usergroup selection, do one of the following per form
(new, edit, invitation):
If you override Resources/Private/Partials/Fields/Usergroup.html, note that the field is now
rendered depending on the new usergroupFieldMode variable
(select / hidden / notice). When neither an allowlist nor the opt-in is configured, a
generic notice (usergroupSelectionNotConfigured) is shown instead of the selection; the specific
missing configuration is not exposed in the frontend but written to the TYPO3 log. Compare your
template with the shipped partial to pick up this behaviour.
Closes a registration confirmation bypass. Two issues are fixed:
The admin confirmation action (status=adminConfirmation) could be triggered with the regular
user confirmation hash, because this version had no dedicated admin hash at all. A registrant
who obtained their own user confirmation hash could therefore approve their own account without
admin interaction.
The "Resend Confirmation Mail" action sent the user confirmation email (containing that hash)
for any submitted address, even on sites that only use admin confirmation.
Important
After updating, run the upgrade wizard
Admin Tools > Upgrade > Run Upgrade Wizard > "EXT:femanager: Migrate required confirmation for pending users".
It populates the new field fe_users.tx_femanager_confirmation_required for accounts that were
still pending at the time of the update. See "Fallback" below for the behaviour if it is not run.
What changed
A dedicated adminHash is now mandatory for every admin action.HashUtility can now derive a
separate admin hash for a user, and admin confirmation, refusal and silent refusal always
require a valid adminHash. The regular user hash alone is no longer sufficient. This applies
both to the registration confirmation (New controller) and to the profile change confirmation
(Edit controller, confirmUpdateRequest).
The required confirmation is stored on the user. During registration femanager now persists
which confirmations are required (user and/or admin) in the new field
fe_users.tx_femanager_confirmation_required. The workflow reads this field instead of the
ambient plugin settings, which the "Resend Confirmation Mail" plugin does not have access to.
Resend only resends a pending user confirmation. The resend action sends the user confirmation
email only when the account still has an outstanding user confirmation (already confirmed accounts,
or accounts that only await admin approval, are not resent). To avoid disclosing whether an account
exists for a given email address, the same neutral message is shown for every valid address -
regardless of whether a mail was sent, nothing was pending, or no such account exists.
Customized email templates
If you override any of these templates, add the adminHash argument to all admin action links,
otherwise the links will be rejected as "not authorized":
The fix does not depend on the wizard for its security: for accounts that still have the default
value 0 (none) - i.e. accounts created before the field existed - the required confirmation
is inferred at runtime from the confirmation state, mirroring the wizard:
disabled, confirmed by user, not by admin → admin confirmation is still required
disabled, confirmed by neither → both confirmations are required (an admin can always release the
account from the backend)
already confirmed by admin, or enabled → no confirmation pending
As a result the registration workflow and the resend action behave correctly even without the wizard.
Running the wizard is still recommended: it persists the precise requirement so it is shown and
filterable in the backend and the runtime fallback is no longer needed.
Warning
There is no way to find out retroactively whether an existing, still pending account originally
required an admin confirmation or not. For the ambiguous case (a disabled account that has been
confirmed by neither the user nor an admin) both the wizard and the runtime fallback therefore
choose the safe option and require an admin confirmation. On a site that only uses user
confirmation this means such legacy accounts now additionally wait for an admin, even though no
admin confirmation was originally intended. These accounts are not lost: an administrator can
release them at any time via Web > Frontend Users (femanager backend module). Only
accounts that were already pending at the time of the update are affected; accounts created
afterwards store their exact requirement and are never over-restricted.
Information Disclosure:
Closes a unauthorized access to frontend user details issue.
The detail action accepted a frontend user from the request without verifying that the requested record matched the
user configured in the Detail plugin or a user shown by the List plugin. A crafted request could therefore display
the details of another frontend user.
What changed
The user shown by the Detail plugin is now resolved from a trusted source:
If a specific user is configured, request arguments can no longer override that user.
If Logged in FE User ([this]) is configured, request arguments can no longer override the current user.
Links generated by the List plugin contain a signed hash for the linked user. The detail action rejects a
request-supplied user when the hash is missing or invalid.
Important
Installations that override Resources/Private/Templates/User/List.html must add the signed hash to
every link that passes a user to the show action. Without the hash, the detail request is rejected.
Customized list templates
UserController::listAction assigns the showHashes array, keyed by the user uid. Resolve the nested value in
a separate Fluid variable before passing it to arguments.
Do not use hash:showHashes.{user.uid} directly inside the arguments expression. With the Fluid version used
by this release, the nested expression can be interpreted as a string instead of an array.
Customized detail templates
If a customized Resources/Private/Templates/User/Show.html contains a self-referencing show link, pass
the showHash variable assigned by the controller:
If you are using customized templates for the invitation function, please check the Resources/Private/Templates/Invitation/Edit.html
You need to add
<f:form.hidden name="hash" value="{hash}"/>
in order,that the function is working.
to version 6.0.0
Version 6.0 support TYPO3 9 LTS and 10 LTS. The support for TYPO3 8 was dropped. No changes on Templates are needed.
Backend Module "Frontend User" - View User Confirmation
If you want to use the Backend Module to confirm or refuse Frontend User, you need to setup the configPID. The extension
uses now a frontend call out of the backend, to organise these actions.
You need to add:
<f:form.hidden name="token" value="{token}" />
between the form tag.
Example:
<f:formname="user"object="{user}"action="update"enctype="multipart/form-data"additionalAttributes="{data-femanager-plugin:data.uid}"class="form-horizontal {f:if(condition:'{settings.edit.validation._enable.client}',then:'feManagerValidation',else:'')}"><fieldset><legend><f:translatekey="titleUpdateProfile" /></legend><f:form.hiddenname="token"value="{token}" />
more stuff here in the template file…
</f:form>
Copied!
to version 5
There are minor breaking changes include. Main change is, that all eid scripts were replace, by a page num approach.
In order that the js validation works, you need to take care, that you these page typenums are available:
Backend Module: Login as User feature
feManagerLoginAs.typeNum = 1548943013
Copied!
see the complete config in file ext_typoscript_setup.txt
Frontend Validation via JS
feManagerLoginAs.typeNum = 1548935210
Copied!
see the complete config in file Configuration/TypoScript/setup.ext
to version 4.2.3 / 4.2.4 / 4.2.5
If you use your own HTML templates of new/edit/invitation-templates you should compare them with the one from
EXT:femanager. There is a new additional attribute inside the form viewhelper: data-femanager-plugin, which contains
the content element id.
If you use a modified version of the Validation.js, there are also changes: plugin and action parameter is send to
the eID-Script now
Features
See some features or best practice parts of the extension femanager.
If you want to modify a HTML-File of femanager, you should not overwrite them directly in the extension folder.
Think about upcoming versions with important bugfixes or security-patches.
There are two ways to use own HTML-Templates (and Partials / Layouts) instead of the original Templates.
Replace all HTML Templates from Femanager with own Templates
You can copy all Files from
- EXT:femanager/Resources/Private/Templates/
- EXT:femanager/Resources/Private/Partials/
- EXT:femanager/Resources/Private/Layouts/
to a new folder in fileadmin - e.g. fileadmin/templates/femanager/ and modify them as you want.
After that, you should say femanager to use the new Templates with some lines of TypoScript setup:
You can copy only the Files that you want to modify from
- EXT:femanager/Resources/Private/Templates/
- EXT:femanager/Resources/Private/Partials/
- EXT:femanager/Resources/Private/Layouts/
to a new folder in fileadmin - e.g. fileadmin/templates/femanager/ and modify them as you want.
After that, you should say femanager to use the old folders and merge them with the new folders
This Feature allows you to display the data of the current user, a selected user by an editor or list user and provide
a detail page.
Caution: Please take care, that you do not disclose information in public environments and be careful, which data you show in the detail view.
Show the current user
Useful, if you want to show a "read only view" for the current logged in
frontend user.
Configuration:
Add a femanager plugin to your page
choose "detail" view
select the tab "Detail" and choose "Logged in FE User"
|showlistusers1|
Show a given user
You can provide a list view of all frontend users or frontend users of selected groups
|showlistusers2|
Add a femanager plugin to your page
choose "detail" view
select the tab "Detail" and select your options
Attention
Take care that you do not disclose information in public environments and be careful which data you show in the detail view.
If you do not select a frontend user, the detail view only renders a user that was linked from a femanager list plugin. Those links carry a signed hash argument that is validated before the record is rendered, so a hand-crafted URL with an arbitrary tx_femanager_detail[user]=XX and no valid hash is rejected.
Custom list and detail templates
Every link to the show action that passes a user must also pass the corresponding signed hash. This also applies to customized list templates. Without the hash, the detail request is rejected.
UserController::listAction assigns the showHashes array, keyed by the user uid. Use it in customized list templates as follows:
tx_femanager {
flexForm {
new {
addFieldOptions {
twitterId = Twitter ID
skypeId = Skype ID
somethingElse = LLL:EXT:yourextension/Resources/Private/Language/locallang_be.xlf:custom
}
}
edit < tx_femanager.flexForm.new
}
}
Copied!
Modify the partial folder
“twitterId” (see TSConfig) means that femanager searches for a partial TwitterId.html to render the field in the form. So you have to copy the folder EXT:femanager/Resources/Private/Partials (e.g.) to fileadmin/Partials and set the new partial path via TypoScript Constants (see exmple below). In addition you have to add the new Partials files.
TypoScript to enable new validation and set labels
plugin.tx_femanager {
settings.new.validation {
_enable.client = 1
_enable.server = 1
username {
# Custom Validator - check if value includes "abc"
custom = abc
}
}
_LOCAL_LANG {
default.validationErrorCustom = "abc" is missing
de.validationErrorCustom = "abc" wird erwartet
}
}
Copied!
Securing the usergroup selection
Why this matters
The registration-, edit- and invitation forms can render a usergroup selection. The frontend
template and the rendered <select> are not a security boundary: a crafted request can
submit any usergroup uid, regardless of what the dropdown offers. Without a server-side allowlist
a logged-in frontend user could therefore assign any frontend usergroup to their own account
(privilege escalation).
femanager enforces the allowed usergroups on the server. The following rules apply to the new,
edit and invitation forms.
How femanager decides which usergroups are allowed
The submitted usergroup relation is checked before the user is persisted:
Forced groups – if settings.<form>.overrideUserGroup is set, the configured group(s)
always win and the submitted value is ignored.
Field not editable – if the usergroup field is not part of the selected fields, any
submitted usergroup change is reverted.
Allowlist – if settings.<form>.validation.usergroup.inList is set, the submitted uids are
reduced to that list. This is the recommended way to let users choose a group.
Opt-in for unrestricted selection – if no allowlist is configured but
settings.<form>.misc.allowUnrestrictedUserGroupSelection = 1 is set, every offered group may
be selected (legacy behaviour).
Fail closed – if neither an allowlist nor the opt-in is configured, the submitted usergroup
change is ignored and a log entry (Profile update not authorized) is written.
Warning
If you want frontend users to choose their usergroup, you must configure an allowlist with
validation.usergroup.inList. Otherwise the selection is rejected. Only enable
allowUnrestrictedUserGroupSelection if you really want users to be able to pick any
frontend usergroup that the form offers.
The same setting exists for the new and invitation forms.
Behaviour in the form
The usergroup field reacts to the configuration:
An allowlist or the opt-in is configured: the selection is rendered.
overrideUserGroup is configured: the field is hidden (the group is assigned automatically).
Nothing is configured: a generic notice ("please contact the administrator") is shown instead of
the field. The specific missing configuration is not exposed in the frontend; instead a
warning with the details is written to the TYPO3 log.
Upgrade note
Installations that previously relied on an unconfigured usergroup selection (no
validation.usergroup.inList) will no longer accept user-submitted usergroups by default. Add an
allowlist via validation.usergroup.inList or set
misc.allowUnrestrictedUserGroupSelection = 1 to restore the former behaviour.
Auto admin confirmation
Introduction
Available since 4.0.0
If you turn on an adminconfirmation by adding an email address in the FlexForm field, admins normally have to confirm
new requests from users. But it's possible to implement some own magic to make a confirmation happen automaticly.
You can add own AutoAdminConfirmation classes to bring in own magic (auto confirmation for an IP-Range, etc...).
At the moment, femanager offers only one AutoAdminConfirmation class, which decided which users are auto-confirmed by
the top-level-domain of the email-address.
EmailDomainConfirmation
Small example
Accept every user profile from domains de, it, ch and at:
plugin.tx_femanager.settings {
autoAdminConfirmation {
# Femanager autoAdminConfirmation classes
10 {
class = In2code\Femanager\Domain\Service\AutoAdminConfirmation\EmailDomainConfirmation
config {
# Just look at the domains of the given Email-Addresses
confirmByEmailDomains = .de, .it, .ch, .at
}
}
}
}
Copied!
Extended example
Accept every user profile from domains de, it, ch and at but not if they are using gmail.de or gmx.de:
plugin.tx_femanager.settings {
autoAdminConfirmation {
# Femanager autoAdminConfirmation classes
10 {
class = In2code\Femanager\Domain\Service\AutoAdminConfirmation\EmailDomainConfirmation
config {
# Just look at the domains of the given Email-Addresses
confirmByEmailDomains = .de, .it, .ch, .at
confirmByEmailDomainsExceptions = gmail.de, gmx.de
}
}
}
}
Copied!
YourAutoConfirmation
Of course you can add your own classes to bring in some own magic.
Example
TypoScript:
plugin.tx_femanager.settings {
autoAdminConfirmation {
# Femanager autoAdminConfirmation classes
100 {
# Classname that should be called with method isAutoAdminConfirmationFullfilled()
class = In2code\FemanagerExtended\Domain\Service\AutoAdminConfirmation\IpAddressConfirmation
# optional: Add configuration for your PHP
config {
ip = 127.0.0.1
foo = bar
fooCObject = TEXT
fooCObject.value = do something with this text
}
}
}
}
Copied!
PHP:
<?php
declare(strict_types=1);
namespace In2code\FemanagerExtended\Domain\Service\AutoAdminConfirmation;
use In2code\Femanager\Domain\Service\AutoAdminConfirmation\AbstractConfirmation;
use TYPO3\CMS\Core\Utility\GeneralUtility;
/**
* Class IpAddressConfirmation
*/
class IpAddressConfirmation extends AbstractConfirmation
{
/**
* @return bool
*/
public function isAutoConfirmed(): bool
{
return GeneralUtility::getIndpEnv('REMOTE_ADDR') === $this->config['ip']);
}
}
Copied!
Some notices
Called method in Confirmation class is always isAutoConfirmed()
Confirmation classes must implement In2codeFemanagerDomainServiceAutoAdminConfirmationConfirmationInterface or extend In2codeFemanagerDomainServiceAutoAdminConfirmationAbstractConfirmation
You have to take care, that your class is included from TYPO3 autoloader otherwise it's not included
Per default femanager offers only EmailDomainConfirmation class at the momment
ConfirmUser Confirmation Refused
Introduction
Available since 6.4.0
Some virus scanners are preloading all links in an email.
If this happens in an user confirmation mail, the user is deleted automatically.
This feature can prevent this behavior.
Configuration
This feature can be enabled via typoscript.automatically
The default value is 0, so this feature has to be enabled.
plugin.tx_femanager.settings {
new {
email.createUserConfirmation.confirmUserConfirmationRefused = 1
}
}
Copied!
Add own Finisher classes
Introduction
Let's say you want to easily add some own php functions,
that should be called after a user registered.
Maybe you want to handle the user input with:
Send it to an API
Store it in a logfile
Save it into a table
Something else...
Small example
Just define which classes should be used. Every method like *Finisher() will be called - e.g. myFinisher():
Add a php-file and extend your class with the AbstractFinisher from femanager:
<?php
namespace VendorExtFinisher;
use In2codeFemanagerFinisherAbstractFinisher;
/**
Class DoSomethingFinisher
@package VendorExtFinisher
*/
class DoSomethingFinisher extends AbstractFinisher
{
/**
MyFinisher
@return void
*/
public function myFinisher()
{
// ...
}
}
Extended example
See the advanced example with some configuration
in TypoScript and with the possibility to load the file
(useful if file could not be loaded from autoloader
because it's stored in fileadmin or elsewhere)
plugin.tx_femanager.settings {
finishers {
1 {
# Classname that should be called with method *Finisher()
class = Vendor\Ext\Finisher\DoSomethingFinisher
# optional: Add configuration for your PHP
config {
foo = bar
fooCObject = TEXT
fooCObject.value = do something with this text
}
# optional: If file will not be loaded from autoloader, add path and it will be called with require_once
require = fileadmin/femanager/finisher/DoSomethingFinisher.php
}
}
}
Copied!
Add your php-file again and extend your class with the AbstractFinisher from femanager:
<?php
namespace Vendor\Ext\Finisher;
use In2code\Femanager\Domain\Model\User;
use In2code\Femanager\Finisher\AbstractFinisher;
/**
* Class DoSomethingFinisher
*
* @package Vendor\Ext\Finisher
*/
class DoSomethingFinisher extends AbstractFinisher
{
/**
* @var User
*/
protected $user;
/**
* @var array
*/
protected $configuration;
/**
* @var array
*/
protected $settings;
/**
* Will be called always at first
*
* @return void
*/
public function initializeFinisher()
{
}
/**
* Will be called before myFinisher()
*
* @return void
*/
public function initializeMyFinisher()
{
}
/**
* MyFinisher
*
* @return void
*/
public function myFinisher()
{
// get value from configuration
$foo = $this->configuration['foo'];
// get subject
$subject = $this->getMail()->getSubject();
// ...
}
}
Copied!
Some notices
All methods which are ending with "finisher" will be called - e.g. saveFinisher()
The method initializeFinisher() will always be called at first
Every finisher method could have its own initialize method, which will be called before. Like initializeMyFinisher() before myFinisher()
Classes in extensions (if namespace and filename fits) will be automaticly included from TYPO3 autoloader. If you place a single file in fileadmin, use "require" in TypoScript
Per default 10 and 20 is already in use from femanager itself (SaveToAnyTableFinisher, SendParametersFinisher) since version 2.0
Using SignalSlots (Hook pendant) to extend femanager
Introduction
SignalSlots (former Hooks) are the possibility for other developer to extend the runtime of a femanager process with their own code.
As an example let's build an extension which sends username and email address of a new registered user to a defined email address.
Note: this is a little bit useless because there is already a setting in flexform to inform administrators and there is a setting in TypoScript to POST values to a third-party-software, but let's use this case for an example.
SignalSlots List
File
Located in
Signal Name
Available Parameters
Description
NewController.php
createAction()
createActionBeforePersist
$user, $this
Use this signal if you want to hook into the process before the new user was persisted
NewController.php
confirmCreateRequestAction()
confirmCreateRequestActionBeforePersist
$user, $hash, $status, $this
Use this signal if you want to hook into the confirmation process
NewController.php
createAdminConfirmationRequest()
createAdminConfirmationRequestAutoConfirm
$user, $this
Signal if a user was auto-confirmed
NewController.php
createAdminConfirmationRequest()
createAdminConfirmationRequestManualConfirmation
$user, $this
Signal if a user was not auto-confirmed and must be confirmed manually
EditController.php
updateAction()
updateActionBeforePersist
$user, $this
Use this signal if you want to hook into the process before the user- profile was updated
EditController.php
confirmUpdateRequestAction()
confirmUpdateRequestActionAfterPersist
$user, $hash, $status, $this
Use this signal if you want to hook after a profile was accepted or refused
EditController.php
deleteAction()
deleteAction
$user, $this
Use this signal if you want to hook into the process before the user- profile will be deleted
InvitationController.php
createAction()
confirmUpdateRequestActionBeforePersist
$user, $hash, $status, $this
Use this signal if you want to hook into the process before a new user was persisted
InvitationController.php
createAllConfirmed()
createAllConfirmedAfterPersist
$user, $this
Use this signal if you want to hook into the process after a new user was persisted
InvitationController.php
editAction()
editActionAfterPersist
$user, $hash, $this
Use this signal if you want to hook into the process before a user adds a new password (step 1)
InvitationController.php
updateAction()
updateActionAfterPersist
$user, $this
Use this signal if you want to hook into the process after a user adds a new password (step 2)
UserController.php
loginAsAction()
loginAsAction
$user, $this
Use this signal if you want to hook into the process after you simulate a frontend user login
UserBackendController.php
confirmUserAction()
confirmUserAction
$user, $this
Signal if a user profile was confirmed in backend module
UserBackendController.php
refuseUserAction()
refuseUserAction
$user, $this
Signal if a user profile was refused in backend module
AbstractController.php
finalCreate()
finalCreateAfterPersist
$user, $action, $this
Use this signal if you want to hook into the process after the new user was persisted
AbstractController.php
updateAllConfirmed()
updateAllConfirmedAfterPersist
$user, $this
Use this signal if you want to hook into the process after the new user was persisted
This is an example how to use a signal from femanager – in this case we decided to use the signal “createActionBeforePersist” in class “In2codeFemanagerControllerNewController” and want to call a slot in class “In2codeFemanagersignalslotDomainServiceSendMailService” with methodname “send()”
This is our main class which is called every time a new registration process was initiated.
<?php
namespace In2code\Femanagersignalslot\Domain\Service;
class SendMailService
{
/**
* Send mail about user information
*
* @param \In2code\Femanager\Domain\Model\User $user
* @param \In2code\Femanager\Controller\NewController $pObj
* @return void
*/
public function send($user, $pObj)
{
$message = '
New user registered
Username: ' . $user->getUsername() . '
Email: ' . $user->getEmail() . '
';
mail('your@email.com', 'SignalSlot Test', $message);
}
}
Copied!
Resend User Confirmation Request
Introduction
Available since 4.2.0
This feature adds a new view in the backend module to list user, which did not confirm their user accounts. An frontend
user admin is now able to resend the confirmation mail or decline (and delete) the user via backend.
Frontend View
An editor can setup a new view "resend confirmation mail". Frontend users, who started their registration process and did
not confirm their email so far, can resend a confirmation mail.
Configuration. Add the plugin "Femanager" to a page and select "resend confirmation mail".
IMPORTANT: If you want to use these new views and you did use femanager version 4.1 or older, you need open existing plugins and save them again, in order to allow the
usage of this views.
|plugin3|
Sometimes unconfirmed users are trying to trigger the confirmation mail again by registering again with the same email or username. They get an error "username / email already existing". Since 4.2, an additional message with a "resend confirmation mail" link is displayed in those cases where the existing user has not yet confirmed his registration.
For this message to be displayed, you need to have the following typoscript setting configured:
The pid is the page uid where your "resend confirmation mail" plugin resides.
Backend View
Lists all frontend users, which did not confirm their email so far. An admin is able, to decline (delete) users or
resend an email with a confirmation link.
If you want prevent, that your registration forms, you can enable the rate limiter.
Note: The limiter is enabled by default.
TypoScript Settings
plugin.tx_femanager {
settings {
ratelimiter {
# Number of seconds for the sliding window rate limiter
timeframe = {$plugin.tx_femanager.settings.ratelimiter.timeframe}
# Request count. How many requests are allowed in the last <timeframe> seconds. Set to 0 to disable rate limiter.
limit = {$plugin.tx_femanager.settings.ratelimiter.limit}
}
}
}
Copied!
Frequently Asked Questions (FAQ)
Q: How to use static_info_tables for countryselection?
A: See code in best practice section
Q: How to add new fields to fe_users?
A: See code in best practice section
Q: How to add my own field validation?
A: See code in best practice section
Q: Class 'In2codeFemanagerDomainModelLog' not found - what can I do?
A: This problem normally occurs only if you have installed femanager without composer (btw: it's time for composer :),
so your instance is running in classic mode.
It's possible that you have added femanager via Extension Manager. Please go into the install tool by opening the URL
www.yourdomain.org/typo3/install (of course you have to add a file named ENABLE_INSTALL_TOOL to typo3conf/ folder
first) and click on Create autoload information for extensions in section Dump Autoload Information.
That will create a new autoload file.
Q: An exception occurred while executing 'SELECT uid FROM tx_femanager_domain_model_log WHERE ... doesn't exist
A: There are some tables missing in your database. Please open the install tool under
www.yourdomain.org/typo3/install (of course you have to add a file named ENABLE_INSTALL_TOOL to typo3conf/ folder
first) and click on Compare current database with specification.
Q: How can I disable the clientside/serverside validation?
A: Enable/Disable Validation via TypoScript – disable example:
Q: How can I configure the validation of my fields?
A: Have a look into TypoScript:
plugin.tx_femanager {
settings.new {
# validation of user input values
# possible validations for each field are: required, email, min, max, intOnly, lettersOnly, unicodeLettersOnly, uniqueInPage, uniqueInDb, date, mustInclude(number,letter,special,space), mustNotInclude(number,letter,special,space), inList(1,2,3), captcha, sameAs(password)
# see manual for an example how to add custom serverside and clientside validation
validation {
# Enable clientside Formvalidation (JavaScript)
_enable.client = 1
# Enable serverside Formvalidation (PHP)
_enable.server = 1
username {
required = 1
uniqueInDb = 1
mustNotInclude = special,space
}
email {
required = 1
email = 1
#uniqueInPage = 1
}
password {
required = 1
#min = 10
#mustInclude = number,letter,special
}
usergroup {
#inList = 1,2,3
}
}
}
}
Copied!
Note: If you use validation for passwords, values will be send via AJAX to server to check if all is right. It's recommended to use https connections for the registration form.
Q: System should generate random passwords – possible?
Since version 1.0.10 femanager is able to create passwords and username per random if there is no input. If you want to use this, please disable required settings of password (and username)
If no username given, try to get email (if set)
If no username and no email given, create a username by random
If no password given, create a password by random
It's possible to create a new user without filling out any field – this could be used as “onetimeaccount”
Q: How can I prefill form fields?
A: You can use TypoScript cObj to fill form fields in registration- or edit-form:
plugin.tx_femanager {
settings {
new {
prefill {
username = TEXT
username.value = ExampleUsername
email = TEXT
email.value = test@in2code.de
}
}
edit {
prefill {
# fill from GET or POST param like &username=Alex
username = TEXT
username.data = GP:username
# fill from GET or POST param like &email=info@test.de
email = TEXT
email.data = GP:email
}
}
}
}
Copied!
Q: JavaScript Validation won't work – what can I do?
A: Check if all needed JavaScript files are loaded (see frontend html- source). Add some JavaScript with constant editor or directly:
Q: How can I send user values to a third-party-software like a CRM?
A: Use some lines of TypoScript to send values after a registration to a tool like a CRM. Test it with a simple php file on your server which sends an email to you with the $_REQUEST Array.
TypoScript:
plugin.tx_femanager {
settings {
new {
# Send Form values via POST to another system (e.g. CRM like salesforce or eloqua)
sendPost {
# Activate sendPost (0/1)
_enable = TEXT
_enable.value = 1
# Target URL for POST values (like http://www.target.com/target.php)
targetUrl = https://www.salesforce.com/servlet/servlet.WebToLead?encoding=UTF-8
#targetUrl = http://eloqua.com/e/f.aspx
# build your post datas like ¶m1=value1¶m2=value2
data = COA
data {
10 = TEXT
10 {
# value from field {username}
field = username
wrap = &username=|
}
20 = TEXT
20 {
# value from field {email}
field = email
wrap = &email=|
}
30 = TEXT
30 {
# value from field {title}
field = title
wrap = &title=|
}
}
# activate debug mode - shows all configuration from curl settings (needs extension devlog)
debug = 0
}
}
}
}
Copied!
Q: How can I store values in another table?
A: With some lines of TypoScript it's possible to store values to any table in the TYPO3 database:
plugin.tx_femanager {
settings {
new {
# Save user values to one or more other tables (e.g. tt_address or something else)
# With .field=[fieldname] you have access to the user object
# Possible values are: uid, username, address, city, company, country, email, fax, firstName, lastName, middleName, name, password, telephone, fax, title, www, zip and lastGeneratedUid (to have access to the uid of the last loop in the next loop)
storeInDatabase {
tt_address {
_enable = TEXT
_enable.value = 0
pid = TEXT
pid.value = 21
name = TEXT
name.field = username
email = TEXT
email.field = email
first_name = TEXT
first_name.field = firstName
last_name = TEXT
last_name.field = lastName
}
}
}
}
}
Copied!
Q: How can I overwrite labels and errormessages with my own text?
A: Every TYPO3 extension can be extended with own labels in any language. You have to search for the key, that you want to overwrite – have a look into the file EXT:femanager/Resources/Private/Language/locallang.xlf – example:
plugin.tx_femanager {
_LOCAL_LANG {
# Field Labels
default.tx_femanager_domain_model_user\.username = Email
de.tx_femanager_domain_model_user\.username = E-Mail
fr.tx_femanager_domain_model_user\.username = E-mail
# Errormessages
default.validationErrorRequired = This is a mandatory field
de.validationErrorRequired = Hierbei handelt es sich um ein Pflichtfeld
fr.validationErrorRequired = Ce champ est obligatoire
}
}
Copied!
Q: How to add a captcha for spam prevention
A: Since version 1.1.0 femanager allows sr_freecap as captcha extension. Import sr_freecap to your TYPO3. From this moment on, you can add a new fieldtype in your flexform “captcha”. In addition you have to enable captcha with TypoScript:
Q: “Please log in before” but I'm already logged in?
A: Check if the logged in user is really logged in (e.g. add a content-element which should not be viewed if the FE-User is not yet logged in). Check if the FE-Users have an empty value or 0 for column tx_extbase_type in your database.
A: Have a look into the TypoScript of femanager (see EXT:femanager/Configuration/TypoScript/Main/setup.txt) – here you see how to configure your mails, forceValues, redirect, autologin and much more...
Changelog
Version
Release Date
Release Description
Version
6.4.6
Date
2026-08-25
Changes
[BUGFIX] add UserGroupSanitizationService as public service
Version
6.4.5
Date
2026-08-25
Changes
[SECURITY] Dispatch ImpersonateEvent only after authorization check
[SECURITY] Use timing-safe comparison in HashUtility::validHash
[SECURITY] Prevent user disclosure via user argument in showAction
[SECURITY] Require valid adminHash for admin profile change confirmation
[SECURITY] Prevent usergroup privilege escalation in frontend forms
[SECURITY] Prevent admin confirmation bypass via resend confirmation mail
[SECURITY] Require valid adminHash for admin registration confirmation
Version
6.4.4
Date
2026-08-20
Changes
[BUGFIX] Activate invited user on password submit instead of on form open
Version
6.4.3
Date
2025-09-17
Changes
[BACKPORT][FEATURE] introduce new mail configuration option for replyTo
Version
6.4.2
Date
2025-07-22
Changes
[BUGFIX] Security: Avoid unintended persistence
Version
6.4.1
Date
2024-05-20
Changes
[BUGFIX] Security: Missing Hash Check for invitation controller - Invitation Templates must be updated (if a custom template is used)
Version
6.4.0
Date
2024-05-08
Changes
[FEATURE] Add confirmation form to delete profile during registration
[TASK] Remove unnecessary scrollIntoView property - thx to Felix Ranesberger (in2code)
[TASK] Replace jQuery scrollTop with vanilla scrollIntoView - thx to Felix Ranesberger (in2code)
[TASK] Build new JS distribution file - thx to Felix Ranesberger (in2code)
Version
6.3.6
Date
2023-04-26
Changes
[BUGFIX] Removes configPID from ext_typoscript_setup.typoscript: The removed configuration can only be overwritten by another preset file in another extension, it can not be overwritten by PageTS.
Version
6.3.5
Date
2023-03-23
Changes
[BUGFIX] Notification email to admin is also sent when adding recipient's address to flex form only
[BUGFIX] v5 backport: Notification mail to admin shows changes
Version
6.3.4
Date
2023-01-25
Changes
[BUGFIX] Security: Missing Hash Check for inviation controller - Invitation Templates must be updraded (if a custom template is used) - thx to Max Schäfer & Dennis Schober-Wenger
Version
6.3.3
Date
2021-11-02
Changes
[BUGFIX] (!!!) Security Fix - Broken Access Control in Usergroup Validation (Andreas Nedbal - in2code) - thx to TYPO3 Security Team
[BUGFIX] CleanUserGroup DataProcessor - thx to Daniel Hoffmann (in2code)
