Download the PHP package cinghie/yii2-user-extended without Composer

Yii2 User Extended

Yii2 User Extended to extend Yii2 User by Dektrium: https://github.com/dektrium/yii2-user

This is not an standalone module to manage users but a module to extend Yii2 User extension.

Current package version: 0.6.4 (see CHANGELOG.md).

Installation

The preferred way to install this extension is through composer.

Either run

or add this line to the require section of your composer.json file.

Configuration

1. Images folder

Copy img folder to your webroot

2. Update yii2 user database schema

Make sure that you have properly configured db application component and run the following command:

3. Add Yii2 RBAC migrations

Add to common config file

and run migration

4. Update yii2 user extended database schema

If the app already lists that path in console controllerMap.migrate.migrationPath (as CorimaCRM does), plain php yii migrate is enough.

This applies (among others):

• profile / user extended schema updates
• admin grid indexes (e.g. user.last_login_at)
• user.password_changed_at (password rotation / passwordMaxAgeDays)
• userextended_rate_limit — DB-backed login/registration lockout (default rateLimitStorage=db). Required on every environment after upgrading; without it the module falls back to cache and logs a warning.

5. Set configuration file

Set on your configuration file, in modules section

Put secrets and environment-specific overrides in web-local.php (example):

and in components section

If you have a Yii2 App Advanced or a CRM that must not expose public signup/password recovery, attach the userextended filter on the user module:

Alternative: set userextended.blockRegistrationAndRecovery = true (Bootstrap attaches the same filter if as backend is not already set).

Dektrium’s own filter also blocks profile and settings — prefer userextended on backend/CRM:

6. Set captcha in Controller

Required when registration captcha is enabled and/or login rate-limit captcha (loginCaptchaAfterAttempts) is used.

In your SiteController set in actions():

Allow guests to reach the captcha action in AccessControl (actions => ['error', 'captcha']).

Module parameters (0.6.4)

Parameters are validated in Module::init() (ranges clamped; invalid Turnstile/SameSite/password lengths throw InvalidConfigException).

Security presets (dev / prod)

Or set 'securityPreset' => 'auto' on the module and override only what you need.

prod highlights: sessionTimeout=1800, useAbsoluteAuthTimeout=true, rate limits + progressive delay on, captcha after 3 failures, password policy on, self-role block + audit on.
dev highlights: sessionTimeout=7200, no progressive delay / login captcha-after-attempts, Turnstile off, still keeps rate limit + password policy + audit.

Session expire

Docker / YII_DEBUG note: the Yii debug toolbar (and Gii) poll via AJAX. Those URLs are ignored for idle renewal (server + client). Still set an explicit sessionTimeout in web-local.php so securityPreset=auto (dev → 7200) does not diverge from your session.timeout. Prefer cookieParams.lifetime = 0 (session cookie) and let authTimeout own idle logout. | clientWarningOnce | true | Show toast at most once per idle cycle. | | clientSessionHeartbeatInterval | 0 | Optional heartbeat seconds (0 = off). While it succeeds, client + server idle timers renew. | | clientSessionHeartbeatUrl | null | Heartbeat URL; when null and interval > 0, uses /user/security/session-ping (204). | | disableAutoLogin | true | Disable remember-me so idle authTimeout works (CRM recommended). | | hardenSessionCookies | true | Apply HttpOnly / Secure / SameSite on session (and identity) cookies when missing. | | sessionCookieSecure | null | null = auto (HTTPS or prod); true/false force Secure. | | sessionSameSite | null | SameSite when unset (null → Lax). Must be Lax/Strict/None if set. | | regenerateSessionId | true | Extra session ID regenerate after login (logout uses Yii logout(true)). | | invalidateRememberMeOnAuthTimeout | true | Use WebUser so timeout clears remember-me without cookie re-login. |

Profile / registration UI flags

i18n

Category userextended (messages/en, messages/it, sourceLanguage=en). Covers session expire, login/registration security, password policy, avatar errors, and admin UI labels.

Assets

SessionExpireAsset publishes from assets/static/ (realpath, not @vendor/...). PHP asset classes stay outside sourcePath, so they are not web-exposed even when assetManager.linkAssets is enabled. In production (YII_ENV_PROD or !YII_DEBUG) it loads session-expire.min.js / .min.css; URLs append ?v=<mtime> for cache busting. Debug sets forceCopy so local edits appear without flushing web/assets. Optional app-wide: assetManager.appendTimestamp = true.

Tests

From the package directory (with the host app’s Composer autoload):

Covers login rate limit lock/clear, DB-backed lockout survives cache flush (DbRateLimitStoreTest), UserSearch role SQL-injection rejection, avatar upload validation rejects, admin switch forbidden, session ?expired=1 smoke (via SecurityController::actionLogin), Turnstile missing/invalid/valid (mock siteVerifyHandler), password policy, ModuleSettings validation/presets, i18n-safe login lock counting, and Yii2 best-practice checks (Yii2BestPracticesTest: AccessControl/VerbFilter/CSRF, AssetBundle sourcePath + appendTimestamp, Assignment safeAttributes, BootstrapInterface, parameterized UserSearch SQL, SafeHtml encoding).

CSRF / HTTP verbs

Mutating admin actions (block, confirm, delete, bulk activate/deactivate/delete, resend-password) and RBAC role/permission delete require POST. CSRF is enforced by the controller (enableCsrfValidation, default on); ActiveForm emits the token field automatically. Bulk user AJAX posts include the CSRF token explicitly.

XSS output

Bio and name fields are always stripped to plain text on save. Views encode usernames, roles, and attributes; use Profile::getBioHtml() / getSignatureHtml() for display.

Password policy

Hashing and verification use only dektrium\user\helpers\Password (Yii security). Map RecoveryForm to cinghie\userextended\models\RecoveryForm.

Avatar upload security

Uploads are renamed randomly, MIME/getimagesize checked, double extensions blocked, path confined under avatarPath.

Login rate limit

Failed login messages are generic (anti user enumeration).

Registration (when user.enableRegistration is true)

Remove BackendFilter / set blockRegistrationAndRecovery to false, then enable:

Map registration → cinghie\userextended\controllers\RegistrationController for throttle on register/resend.

Password recovery (when user.enablePasswordRecovery is true)

Hardened defaults are applied by Bootstrap via UserModuleHardening even while recovery stays disabled in CRM:

Map recovery → cinghie\userextended\controllers\RecoveryController.

Cloudflare Turnstile (optional)

Fail closed: missing/invalid token denies login. Script is loaded only when enabled and configured. Use together with rate limit (Turnstile first, rate limit second).

Caching / performance

Map rbac RoleController / PermissionController / AssignmentController to the userextended controllers so role-list cache is invalidated, deletes are POST-only, and assignments use the secured model.

RBAC assignment security

Assignment updates go through AdminController::actionAssignments (and /rbac/assignment/assign) with admin AccessControl, CSRF, and VerbFilter. Self-escalation attempts are blocked and audited.

Admin user grid uses eager loading for profile / roles. Impersonation (user/admin/switch) is disabled in this package (AdminController + enableImpersonateUser => false).

Overrides

Override controller example, on modules config

Override models example, on modules config

Override view example, on components config

Features

1. Add new fields to user profile (optional params)
   • avatar:
     1. The avatar can be uploaded
     2. The avatar can be updated
     3. On update avatar old image was deleted
     4. Hardened upload (MIME/extension whitelist, max size, safe rename, path confinement)
   • birthday
   • captcha
   • firstname
   • lastname
   • name (firstname + lastname)
   • signature
   • terms
2. Add yii2-user fields to user profile like optional params
   • bio
   • gravatar email
   • location
   • public email
   • website
3. Add default Role on User Registration
4. Session timeout with optional client redirect / warning
5. Login brute-force protection (rate limit, lockout, progressive delay, captcha after N failures)
6. Registration throttle (IP + email) + BackendFilter for CRM/backend (blocks registration/recovery)
7. RBAC assignment hardening (CSRF, admin-only, block self-escalation, audit)
8. Structured security audit (login, block/delete, Turnstile, session expire; no secrets)
9. Optional Cloudflare Turnstile on login (and registration)
10. Admin users grid performance (eager loading, role cache, DB indexes)
11. User impersonation disabled by default