<p>Why not just provide them with access to the backend, with only the permissions they need?</p>
<p>Anyway, if you need to provide a custom form in the frontend, you can write a form similar to the example in the knowledge base article on <a href="https://craftcms.com/knowledge-base/front-end-user-accounts" rel="nofollow noreferrer">front-end user accounts</a>. In particular the part about <a href="https://craftcms.com/knowledge-base/front-end-user-accounts#user-profile-form" rel="nofollow noreferrer">user profile forms</a>.</p>
<p><strike>As far as I know, the <code>users/save-user</code> controller action doesn't allow you to edit user groups for a given user. Maybe check if there's another controller action that does that you can use. If there isn't, you're gonna have to write your own, making sure to include safeguards to prevent privilege escalation vulnerabilities. Then you can just point your custom form to the custom controller endpoint. See the <a href="https://craftcms.com/docs/3.x/extend/controllers.html" rel="nofollow noreferrer">documentation on controllers</a> for details.</strike></p>
<p><strong>Edit:</strong> The <code>users/save-user</code> controller <em>does</em> support editing groups for existing users, it's just not documented. See the <a href="https://craftcms.stackexchange.com/a/39172/11705">answer by Mats Mikkel Rummelhoff</a> for details.</p>

CC BY-SA 4.0
2022-03-07T19:25:49.197Z
They will still have access to the backend, but I wanted them to have a nice user interface to easily change things to what they need to. But thanks for the response!
Keatyn Garton
CC BY-SA 4.0
2022-03-06T18:19:02.513Z
2022-03-07T09:44:33.363Z
2022-03-07T09:44:33.363Z
MoritzLost
<p>Assuming you're using the core <code>users/save-user</code> action to edit users (as per the official <a href="https://craftcms.com/knowledge-base/front-end-user-accounts#user-profile-form" rel="nofollow noreferrer">User Profile form example</a>) you can add a form input named <code>groups</code> to save group assignments from the frontend form.</p>
<p><em>Note that this only works when editing an existing user's profile, i.e. not when registering new users.</em></p>
<p>Before saving the user, Craft will handle permission checking for you (again, assuming you're posting the form to the core <code>users/save-user</code> action). Still, it's probably a good idea to make sure that only groups that the current user is able to save assignments for, are exposed as options in the form. Here's one way to achieve that – first pulling all user groups via the <code>craft.app.userGroups</code> service, and then filtering those groups, using the <a href="https://craftcms.com/docs/3.x/user-management.html#checking-permissions" rel="nofollow noreferrer"><code>currentUser.can()</code></a> method to check that the current user has the necessary <code>assignUserGroup:[UserGroupUID]</code> permission for each group:</p>
<pre><code>{% set userGroups = craft.app.userGroups.allGroups()|filter(group =&gt; currentUser.can(&quot;assignUserGroup:#{group.uid}&quot;)) %}
</code></pre>
<p>Once you have your <code>userGroups</code> array, you can build a dropdown:</p>
<pre><code>&lt;form method=&quot;post&quot; accept-charset=&quot;UTF-8&quot; enctype=&quot;multipart/form-data&quot;&gt;
    ...
    &lt;label for=&quot;group&quot;&gt;User group&lt;/label&gt;
    &lt;select id=&quot;group&quot; name=&quot;groups[]&quot;&gt;
        {% for userGroup in userGroups %}
            &lt;option value=&quot;{{ userGroup.id }}&quot;{% if user.isInGroup(userGroup) %} selected{% endif %}&gt;{{ userGroup.name }}&lt;/option&gt;
        {% endfor %}
    &lt;/select&gt;
    ...
&lt;/form&gt;
</code></pre>
<p>Or if you prefer, checkboxes. Notice the hidden input <code>name=&quot;groups&quot;</code> above the actual checkbox inputs – that's there to make it possible to submit the form without any groups checked:</p>
<pre><code>&lt;input type=&quot;hidden&quot; name=&quot;groups&quot; value/&gt;
&lt;fieldset&gt;
    &lt;legend&gt;User groups&lt;/legend&gt;
    {% for userGroup in userGroups %}
        &lt;label&gt;
            &lt;input type=&quot;checkbox&quot; name=&quot;groups[]&quot; value=&quot;{{ userGroup.id }}&quot;{% if user.isInGroup(userGroup) %} checked{% endif %} /&gt;
            &lt;span&gt;{{ userGroup.name }}&lt;/span&gt;
        &lt;/label&gt;
    {% endfor %}
&lt;/fieldset&gt;
</code></pre>
<p>Or radio buttons:</p>
<pre><code>&lt;fieldset&gt;
    &lt;legend&gt;User group&lt;/legend&gt;
    {% for userGroup in userGroups %}
        &lt;label&gt;
            &lt;input type=&quot;radio&quot; name=&quot;groups[]&quot; value=&quot;{{ userGroup.id }}&quot;{% if user.isInGroup(userGroup) %} checked{% endif %} /&gt;
            &lt;span&gt;{{ userGroup.name }}&lt;/span&gt;
        &lt;/label&gt;
    {% endfor %}
&lt;/fieldset&gt;
</code></pre>

CC BY-SA 4.0
2022-03-07T08:41:26.503Z
Great answer! Are you sure that `users/save-user` supports setting user groups though? It's not listed as a [supported parameter](https://craftcms.com/docs/3.x/dev/controller-actions.html#supported-params-3) in the documentation – but maybe it's just missing?
MoritzLost
CC BY-SA 4.0
2022-03-07T09:39:02.530Z
@MoritzLost I did test it and it works. Maybe the reason why it's not mentioned in the docs is that assigning groups via `users/save-user` only works conditonally, specifically if the request is not a "public registration" – see https://github.com/craftcms/cms/blob/develop/src/controllers/UsersController.php#L1335. In the case where the form is used to edit existing users' profiles (which is how I interpreted the OP) `$isPublicRegistration`  should always be `false`, and hence assigning user groups should work.
Mats Mikkel Rummelhoff
CC BY-SA 4.0
2022-03-07T09:39:58.750Z
I'll make a note that the above only works when editing existing users and not when registering new ones, though – an important caveat :)
Mats Mikkel Rummelhoff
CC BY-SA 4.0
2022-03-07T09:45:23.597Z
Thanks for the research – good to know!
MoritzLost
CC BY-SA 4.0
2022-03-07T19:18:27.653Z
I appreciate this so much, exactly what I was looking for! Thank you!
Keatyn Garton
CC BY-SA 4.0
2022-03-06T20:47:16.623Z
2022-03-07T09:41:24.490Z
2022-03-07T09:41:24.490Z
Mats Mikkel Rummelhoff
<p>So, I'm trying to build a dashboard where the partner of the company I work for can edit users. And I want him to be able to have like a drop down to assign the user's group on the frontend. Is there a way to do this with just a form and input fields? Or does this have to be done with a custom plugin?</p>

<users><form><user-groups><drop-down><user-interface>
Is there a way for a user to assign another user to a group on the frontend?
# Is there a way for a user to assign another user to a group on the frontend?

(Asked by: username_0 on 2022-03-05)

So, I'm trying to build a dashboard where the partner of the company I work for can edit users. And I want him to be able to have like a drop down to assign the user's group on the frontend. Is there a way to do this with just a form and input fields? Or does this have to be done with a custom plugin?

**Tags:** users, form, user-groups, drop-down, user-interface

---

## 2 answers

### Answer by username_2 on 2022-03-06. Score: 4 | Accepted answer

Assuming you're using the core users/save-user action to edit users (as per the official User Profile form example) you can add a form input named groups to save group assignments from the frontend form.
Note that this only works when editing an existing user's profile, i.e. not when registering new users.
Before saving the user, Craft will handle permission checking for you (again, assuming you're posting the form to the core users/save-user action). Still, it's probably a good idea to make sure that only groups that the current user is able to save assignments for, are exposed as options in the form. Here's one way to achieve that – first pulling all user groups via the craft.app.userGroups service, and then filtering those groups, using the currentUser.can() method to check that the current user has the necessary assignUserGroup:[UserGroupUID] permission for each group:
{% set userGroups = craft.app.userGroups.allGroups()|filter(group => currentUser.can("assignUserGroup:#{group.uid}")) %}

Once you have your userGroups array, you can build a dropdown:

    ...
    User group
    
        {% for userGroup in userGroups %}
            {{ userGroup.name }}
        {% endfor %}
    
    ...


Or if you prefer, checkboxes. Notice the hidden input name="groups" above the actual checkbox inputs – that's there to make it possible to submit the form without any groups checked:


    User groups
    {% for userGroup in userGroups %}
        
            
            {{ userGroup.name }}
        
    {% endfor %}


Or radio buttons:

    User group
    {% for userGroup in userGroups %}
        
            
            {{ userGroup.name }}
        
    {% endfor %}

> **Comments:**
> **username_1**: Great answer! Are you sure that `users/save-user` supports setting user groups though? It's not listed as a [supported parameter](https://craftcms.com/docs/3.x/dev/controller-actions.html#supported-params-3) in the documentation – but maybe it's just missing?  
> **username_2**: @MoritzLost I did test it and it works. Maybe the reason why it's not mentioned in the docs is that assigning groups via `users/save-user` only works conditonally, specifically if the request is not a "public registration" – see https://github.com/craftcms/cms/blob/develop/src/controllers/UsersController.php#L1335. In the case where the form is used to edit existing users' profiles (which is how I interpreted the OP) `$isPublicRegistration`  should always be `false`, and hence assigning user groups should work.  
> **username_2**: I'll make a note that the above only works when editing existing users and not when registering new ones, though – an important caveat :)  
> **username_1**: Thanks for the research – good to know!  
> **username_0**: I appreciate this so much, exactly what I was looking for! Thank you!  

---

### Answer by username_1 on 2022-03-06. Score: 3

Why not just provide them with access to the backend, with only the permissions they need?

Anyway, if you need to provide a custom form in the frontend, you can write a form similar to the example in the knowledge base article on [front-end user accounts](https://craftcms.com/knowledge-base/front-end-user-accounts). In particular the part about [user profile forms](https://craftcms.com/knowledge-base/front-end-user-accounts#user-profile-form).

As far as I know, the `users/save-user` controller action doesn't allow you to edit user groups for a given user. Maybe check if there's another controller action that does that you can use. If there isn't, you're gonna have to write your own, making sure to include safeguards to prevent privilege escalation vulnerabilities. Then you can just point your custom form to the custom controller endpoint. See the [documentation on controllers](https://craftcms.com/docs/3.x/extend/controllers.html) for details.

**Edit:** The `users/save-user` controller *does* support editing groups for existing users, it's just not documented. See the [answer by Mats Mikkel Rummelhoff](https://craftcms.stackexchange.com/a/39172/11705) for details.

> **Comments:**
> **username_0**: They will still have access to the backend, but I wanted them to have a nice user interface to easily change things to what they need to. But thanks for the response!  

---

