Fixes #3179: removed duplicate validation rules from User model in advanced app, removed User::create()

apps/advanced/common/models/User.php

@@ -28,26 +28,6 @@ class User extends ActiveRecord implements IdentityInterface
 
     const ROLE_USER = 10;
 
-    /**
-     * Creates a new user
-     *
-     * @param  array       $attributes the attributes given by field => value
-     * @return static|null the newly created model, or null on failure
-     */
-    public static function create($attributes)
-    {
-        /** @var User $user */
-        $user = new static();
-        $user->setAttributes($attributes);
-        $user->setPassword($attributes['password']);
-        $user->generateAuthKey();
-        if ($user->save()) {
-            return $user;
-        } else {
-            return null;
-        }
-    }
-
     /**
      * @inheritdoc
      */
@@ -181,28 +161,4 @@ class User extends ActiveRecord implements IdentityInterface
     {
         $this->password_reset_token = null;
     }
-
-    /**
-     * @inheritdoc
-     */
-    public function rules()
-    {
-        return [
-            ['status', 'default', 'value' => self::STATUS_ACTIVE],
-            ['status', 'in', 'range' => [self::STATUS_ACTIVE, self::STATUS_DELETED]],
-
-            ['role', 'default', 'value' => self::ROLE_USER],
-            ['role', 'in', 'range' => [self::ROLE_USER]],
-
-            ['username', 'filter', 'filter' => 'trim'],
-            ['username', 'required'],
-            ['username', 'unique'],
-            ['username', 'string', 'min' => 2, 'max' => 255],
-
-            ['email', 'filter', 'filter' => 'trim'],
-            ['email', 'required'],
-            ['email', 'email'],
-            ['email', 'unique'],
-        ];
-    }
 }

apps/advanced/frontend/controllers/SiteController.php

@@ -120,8 +120,7 @@ class SiteController extends Controller
     {
         $model = new SignupForm();
         if ($model->load(Yii::$app->request->post())) {
-            $user = $model->signup();
+            if ($user = $model->signup()) {
-            if ($user) {
                 if (Yii::$app->getUser()->login($user)) {
                     return $this->goHome();
                 }

apps/advanced/frontend/models/SignupForm.php

@@ -43,7 +43,13 @@ class SignupForm extends Model
     public function signup()
     {
         if ($this->validate()) {
-            return User::create($this->attributes);
+            $user = new User();
+            $user->username = $this->username;
+            $user->email = $this->email;
+            $user->setPassword($this->password);
+            $user->generateAuthKey();
+            $user->save(false);
+            return $user;
         }
 
         return null;

docs/guide/security-authorization.md

@@ -268,18 +268,19 @@ After executing the command we'll get the following hierarchy:
 Author can create post, admin can update post and do everything author can.
 
 If your application allows user signup you need to assign roles to these new users once. For example, in order for all
-signed up users to become authors you in advanced application template you need to modify `common\models\User::create()`
+signed up users to become authors you in advanced application template you need to modify `frontend\models\SignupForm::signup()`
 as follows:
 
 ```php
-public static function create($attributes)
+public function signup()
 {
-    /** @var User $user */
+    if ($this->validate()) {
-    $user = new static();
+        $user = new User();
-    $user->setAttributes($attributes);
+        $user->username = $this->username;
-    $user->setPassword($attributes['password']);
+        $user->email = $this->email;
-    $user->generateAuthKey();
+        $user->setPassword($this->password);
-    if ($user->save()) {
+        $user->generateAuthKey();
+        $user->save(false);
 
         // the following three lines were added:
         $auth = Yii::$app->authManager;
@@ -287,9 +288,9 @@ public static function create($attributes)
         $auth->assign($authorRole, $user->getId());
 
         return $user;
-    } else {
-        return null;
     }
+
+    return null;
 }
 ```