Access Control

Archives Yii 1.0.x Discussions
1

I'm using Skeleton app.

In PostController i have:

So, i think in this case no actions allowed. Am i right?

But i can process any actions.

In CAccessControlFilter.php preFilter function (line 98) return true.

What can it be?

2

Really strange.

Try to add the 'allow' property with a blank array.

3

hmmm, all controllers ignore access rules :(

4

If you are using my skeleton app, then that is because I have extended it.

see AccessControlFilter.php in /components

Quote

/*

With my modifications, access rules can be defined like so:

class UserController extends Controller {

public function accessRules() {





	return array(





		'logout, update', //'logout' and 'user update' actions require logon





		'login, create, recover' => array(Group::GUEST, 'equal'), //these actions require the user to NOT be logged on





		'delete' => array(Group::ADMIN, 'min'), //the user delete actions required rank of admin or higher





	);





}











//..

}

as you see, if you don't define specific settings, it will assume them to be the following:

array(Group::USER, 'min')

Which means the current must have at lease rank of USER.

As you see you can define very specific settings with little typeing.

If you do not like my extension of access control, you can edit the

Controller.php file and comment out the filterAccessControl() method

*/

5

Quote

If you are using my skeleton app, then that is because I have extended it.

see AccessControlFilter.php in /components

Quote

/*

With my modifications, access rules can be defined like so:

class UserController extends Controller {

public function accessRules() {





	return array(





		'logout, update', //'logout' and 'user update' actions require logon





		'login, create, recover' => array(Group::GUEST, 'equal'), //these actions require the user to NOT be logged on





		'delete' => array(Group::ADMIN, 'min'), //the user delete actions required rank of admin or higher





	);





}











//..

}

as you see, if you don't define specific settings, it will assume them to be the following:

array(Group::USER, 'min')

Which means the current must have at lease rank of USER.

As you see you can define very specific settings with little typeing.

If you do not like my extension of access control, you can edit the

Controller.php file and comment out the filterAccessControl() method

*/

lol, i saw it few minutes ago, and going to write it there :)