---
title: "Club management and moderation"
manual: "clubdirectory"
version: "main"
permalink: "https://docs.typo3.org/permalink/jweiland/clubdirectory:moderation@main"
source: "Administrator/Moderation/Index.rst"
rendered: "2026-11-03T10:50:24+00:00"
---

# Club management and moderation {#moderation}

Frontend users can create and edit their own clubs with the plugin
`Club Directory Management`. Each created or changed club is hidden until
the administrator has checked and activated it.

## Requirements {#moderation-requirements}

-   A page with the plugin `Club Directory Management`, configured in
    [clubdirectory.pidOfManagementPage](https://docs.typo3.org/permalink/jweiland/clubdirectory:confval-site-setting-pidofmanagementpage@main).
-   A page with the plugin `Clubdirectory` for the list of clubs,
    configured in [clubdirectory.pidOfListPage](https://docs.typo3.org/permalink/jweiland/clubdirectory:confval-site-setting-pidoflistpage@main).
-   The frontend usergroup of the club owners in
    [clubdirectory.userGroup](https://docs.typo3.org/permalink/jweiland/clubdirectory:confval-site-setting-usergroup@main) and an
    access restriction of the management page to this group, see
    [Access control and error pages](https://docs.typo3.org/permalink/jweiland/clubdirectory:moderation-access@main).
-   The receiver and sender of the notification mails in
    [emailToAddress](https://docs.typo3.org/permalink/jweiland/clubdirectory:confval-ext-conf-emailtoaddress@main) and
    [emailFromAddress](https://docs.typo3.org/permalink/jweiland/clubdirectory:confval-ext-conf-emailfromaddress@main).
-   A storage folder for the POI records in
    [poiCollectionPid](https://docs.typo3.org/permalink/jweiland/clubdirectory:confval-ext-conf-poicollectionpid@main) and a working
    geocoding configuration of maps2. See
    [maps2](https://docs.typo3.org/p/jweiland/maps2/main/en-us/Configuration/Extension/Index.html#extensionSettings).

## Moderation flow {#moderation-flow}

1.  A logged-in frontend user fills out the club form. The form requires at
    least one address. For each chosen address type street, ZIP and city
    are required. The district is optional. The form offers the district
    records of the storage folder of the club records.
1.  `clubdirectory` geocodes each address with maps2. If an address can
    not be found, the user is asked to check the address. If the map
    service rejects the request (e.g. an API key restricted to other IP
    addresses) or is not available, the user gets a hint to inform the
    administrator. The technical message of the map service is written to
    the TYPO3 log only. The POI records are created only, if all addresses
    of the club were found.
1.  The club is saved as hidden record and assigned to the frontend user.
    In the next step the user can correct the position of the map marker.
1.  After confirming the map, the administrator gets a mail with the data
    of the club and two links: one to edit and one to activate the club.
    The user is redirected to the list page, which shows a message about
    the pending moderation.
1.  The administrator opens the edit link to check and correct the club,
    or the activate link to publish it. The activate link shows a summary
    of the club with a button. The club is activated after submitting this
    form only, so mail security scanners opening the link can not activate
    it. After the activation the administrator is redirected to the list
    page, which shows a confirmation message.

The list page is not cached, while it shows such a message. The
`Clubdirectory` plugin tags its cached list pages with
`tx_clubdirectory_domain_model_club` and its detail pages with
`tx_clubdirectory_domain_model_club_<uid>`. Saving a club in frontend or
backend flushes these tags, so new, activated and changed clubs are shown
right away. A `TCEMAIN.clearCacheCmd` for the list and detail pages is
not required anymore.

Each time an owner changes a club, the club is hidden again and the
administrator gets a new mail with new links. The map position of an
existing club is changed in the same edit form.

## Mail links and moderation token {#moderation-mail-links}

The edit and activate links of the mails point to the Management plugin
on the page configured in [clubdirectory.pidOfManagementPage](https://docs.typo3.org/permalink/jweiland/clubdirectory:confval-site-setting-pidofmanagementpage@main). They contain the argument
`moderationToken`, an HMAC of the club UID and the `tstamp` of the club
record:

-   A valid token grants access to the club without a frontend login, as
    the administrator is usually not logged in as the owner. The edit form
    submits the token as hidden field, so the administrator can save the
    form, too.
-   A club can be activated in frontend with a valid token only. Neither
    the owner nor a logged-in backend administrator can activate a club
    without it.
-   As soon as the club is changed again, in frontend or backend, the
    `tstamp` changes and the links of all older mails stop working. Only
    the links of the latest mail are valid.

If a link does not work anymore, use the links of the latest mail or
activate the club in the backend by removing the hidden flag of the
record.

> [!WARNING]
> **Attention**
>
> The page of the Management plugin must be accessible for the
> administrator. If you restrict this page to the usergroup of the club
> owners, the administrator has to log in with a member of this group
> before opening the links of the mail.

If you override the mail templates `Templates/Management/Update.html`
and `Templates/Map/Create.html`, keep the argument `moderationToken`
in both links and the hidden field `moderationToken` in
`Templates/Management/Edit.html` and
`Templates/Management/ConfirmActivation.html`.

## Access control and error pages {#moderation-access}

-   The links to create a new club and to list the own clubs are shown to
    members of the usergroup configured in
    [clubdirectory.userGroup](https://docs.typo3.org/permalink/jweiland/clubdirectory:confval-site-setting-usergroup@main) only
    (`<f:security.ifHasRole>` in the partial
    `Partials/Club/InsertEditLinks.html`). The list of the own clubs
    shows a message to all other users, that they have no access.
-   All actions of the Management plugin to create, edit, update and
    activate a club require a logged-in member of this usergroup or a
    valid moderation token. Access is denied before uploaded files are
    stored. Additionally restrict the access of the management page to the
    same usergroup in the page properties (field **Usergroup
    Access Rights**).
-   Members of this usergroup are allowed to edit and update the clubs
    assigned to them only (field **Assign Frontend Users** of the
    club record). Backend administrators are allowed to edit and update
    all clubs.
-   Addresses and POI records submitted with the form must belong to the
    edited club.
-   All other requests stop with the 403 error handling of the site.
-   The detail view of a hidden, deleted or unknown club stops with the
    404 error handling of the site.

Configure the [error handling](https://docs.typo3.org/m/typo3/reference-coreapi/14.3/en-us/ApiOverview/SiteHandling/ErrorHandling/Index.html#sitehandling-errorhandling)
of your site for the status codes 403 and 404 to show a helpful page.