ROLE_USER can't edit their profile

[seblanc]

Hi all,
I'm using Bolt 4.1.10 and building a website with frontend users that have access to private part of the website. The users have the ROLE_USER, so they can't modify the content of the website.

Nevertheless, I would like to let them change their profile (displayed name, email or password for example.). Once they login, they get a 403 error (access denied). How could I solve this?

Let me know if there is a better way to deal with frontend users.
Thank you in advance for your help.

[I-Valchev]

Hi @seblanc , there is a bolt/users extension that helps dealing with frontend users. It might also be possible to use it to change user's passwords, but I am not aware of anyone using this for that purpose yet.

[seblanc]

Hi @I-Valchev, thank you for the suggestion. It works like a charm for user login and frontend permissions.

Unfortunately, I was not able to make the example of the documentation work for letting the user edit their profile, even after correcting the "else if" to elseif at line 10:

<form method="post">
    {% for field in record.fields %}
        <label for="fields[{{ field.name }}]"></label>
        {% if field.type === 'text' %}
            <input type="text" name="fields[{{ field.name }}]" value="{{ field.parsedValue }}" />
        {% elseif field.type === 'textarea' %}
            <textarea name="fields[{{ field.name }}]">{{ field.parsedValue }}</textarea>
        {% elseif field.type === 'checkbox' %}
            <input type="checkbox" name="fields[{{ field.name}}]" value="{{ field.parsedValue }}" />
        {% elseif field.type === 'date' %}
            <input type="date" name="fields[{{ field.name }}]" value="{{ field.parsedValue }}" />
        {% endif %}
    {% endfor %}

    <!-- The input fields below are required for Bolt to process the form. Do not change them -->
    <input type="hidden" name="_csrf_token" value="{{ csrf_token('editrecord') }}">
    <input type="hidden" name="_edit_locale" value="{{ user.locale }}">
    <input type="hidden" name="status" value="published">
    <input type="submit" value="save">
</form>

When loading this page, record is not defined. Does anyone have a clue?

[seblanc]

Hi @I-Valchev, I found out that the example described in the bolt/users extensions is only for the member contentType, not the actual fields of a user (e.g. displayName, password, etc.).

Do you have any lead to let the users without ROLE_ADMIN role, to edit their profile, or at least password?

[I-Valchev]

Hi @seblanc , ah I see! I think you might be able to achieve this if you use the 5.0 beta release, which has detailed permissions, here's the yaml, it has explanations about the whole feature: https://github.com/bolt/core/blob/master/config/bolt/permissions.yaml

https://github.com/bolt/core/blob/master/src/Controller/Backend/UserEditController.php

Here's the controller than handles it.

I don't know if it is possible to securely make it work by using what is there by default. Otherwise, you might want to create your own controller that handles the form submit, and updates. It will probably look quite similar to UserEditController still.

Or, option 3 would be to create a PR in bolt/users that makes this feature possible, we'll merge it in and release it :-)

[seblanc]

Hi @I-Valchev, thanks for the suggestions! Is there a possibility to upgrade my Bolt 4.0 to 5.0 beta? Or I should reinstall it from scratch? If yes, how? I can see the latest commits are few days old regarding this beta release :)

[I-Valchev]

Hi @seblanc , you're welcome :-)

No need to setup a new project altogether, as the differences are not that many. you can update your composer.json to require bolt/core at 4.2 and set the minimum-stability to beta. If things break, best to ask on Slack slack.bolt.cm

Small tip: 4.2 beta will in fact become 5.0 :-)