README

Memberz

Front-end account areas for Craft CMS. Registration, profile fields, member photos and directories — built in the control panel, rendered on the front end, with no custom controller and no template surgery.

Free. Single edition. Everything switched on.

What it does


Registration	A form an author builds from the fields already on the user layout. Honeypot and signed-timestamp spam checks, email-domain rules, group assignment.
Profile fields	Craft's own user fields, rendered as plain front-end inputs — no control-panel JavaScript on your site.
Privacy	A site-wide ceiling per field, which each member may tighten but never loosen. One verdict, applied to profiles and directories alike.
Photos	Front-end upload, validated by content rather than by filename, re-encoded and scaled. Initials drawn locally when there is no photo — no Gravatar, so no member's address leaves your server.
Directories	Searchable, filterable, sortable member listings. Every parameter a visitor can send is checked against what the directory offers.
Account area	`/account` and `/members/<slug>`, routed for you, or route them yourself.

What it deliberately does not do

Memberz is one plugin in a stack, not a replacement for the stack.

Authentication is Craft's. Craft signs people in; Verbb Auth signs them in with Google, GitHub and the rest. Memberz never touches a session beyond the optional log-in-after-registration, and it never works around Craft's own public-registration, activation or email-verification settings. A registration form on a site whose owner has turned registration off is refused, and says so in the logs.
Paid membership is Headcount's. Subscriptions, tiers, content gating and drip content live there. Memberz holds no price, no plan and no paywall. The two are built to sit on the same site: Headcount decides what a member may read, Memberz draws the account area around it.

Requirements

Craft CMS 5.3+, PHP 8.2+. No runtime dependencies and no build step.

Installation

composer require justinholtweb/craft-memberz
php craft plugin/install memberz

Using it

Build a form under Memberz → Forms, then render it:

{{ craft.memberz.form('register') }}
{{ craft.memberz.directory('members') }}
{{ craft.memberz.profile(user) }}
{{ craft.memberz.avatar(user, 96) }}

Or point people at the account area, which Memberz routes for you:

<a href="{{ craft.memberz.accountUrl() }}">Your account</a>
<a href="{{ craft.memberz.profileUrl(user) }}">{{ user.fullName }}</a>

Reading a member's field in a template of your own goes through the privacy check:

{# Respects the member's settings. #}
{{ craft.memberz.value(member, 'jobTitle') }}

{# Does not. This is Craft's own accessor and knows nothing about them. #}
{{ member.jobTitle }}

Full documentation is in docs/.

The idea it is built on

The form is the allow-list.

Every write walks the rows of the form the submission names and reads the one parameter each row asks for. The POST body is never iterated and never handed to setFieldValuesFromRequest().

That is what makes a form a stranger can submit safe to have on a site: admin, groups, permissions and suspended are not rows, so nothing reads them. There is no list of forbidden keys to keep in step with Craft, because nothing is read by default.

The same shape runs through the rest of it. A directory answers ?sort= and ?f[…]= only for entries it was actually given. A privacy verdict is reached in exactly one function, so a field cannot be private on a profile and printed on a directory card.

Testing

ddev exec php /var/www/craft-memberz/tests/integration/checks.php

Licence

The Craft License. See LICENSE.md.

justinholtweb / craft-memberz

Package info

Security

Statistics