CODEWITHSUNDEEP
phpframeworksyii2access-control
heron
heron

Reputation: 3661

Yii2 access controll rule doesn't deny guests

Here is code that I use for allowing authenticated users to do some actions

        'access' => [
            'class' => AccessControl::className(),
            'only' => ['logout', 'signup'],
            'rules' => [
                [
                    'actions' => ['show'],
                    'allow' => true,
                    'roles' => ['?'],
                ],
                [
                    'actions' => ['create', 'edit'],
                    'allow' => true,
                    'roles' => ['@'],
                ],
            ],
        ],

But this rules allow guests to enter create action. Afaik, by default guest users must be denied. What am I doing wrong?

Upvotes: 1

Views: 915

Answers (1)

Chinmay Waghmare
Chinmay Waghmare

Reputation: 5456

Modify your code to:

 'access' => [
            'class' => AccessControl::className(),
            'only' => ['logout', 'signup', 'create', 'edit'],
            'rules' => [
                [
                    'actions' => ['show'],
                    'allow' => true,
                    'roles' => ['?'],
                ],
                [
                    'actions' => ['create', 'edit'],
                    'allow' => true,
                    'roles' => ['@'],
                ],
            ],
        ],

Only array should contain List of action IDs that this filter should apply to.

Upvotes: 1

Related Questions