CAccessControlFilter
CAccessControlFilter performs authorization checks for the specified actions.
By enabling this filter, controller actions can be checked for access permissions. When the user is not denied by one of the security rules or allowed by a rule explicitly, he will be able to access the action.
For maximum security consider adding
array('deny')
as a last rule in a list so all actions will be denied by default.
To specify the access rules, set the
rules property, which should be an array of the rules. Each rule is specified as an array of the following structure:
array(
'allow', // or 'deny'
// optional, list of action IDs (case insensitive) that this rule applies to
// if not specified or empty, rule applies to all actions
'actions'=>array('edit', 'delete'),
// optional, list of controller IDs (case insensitive) that this rule applies to
'controllers'=>array('post', 'admin/user'),
// optional, list of usernames (case insensitive) that this rule applies to
// Use * to represent all users, ? guest users, and @ authenticated users
'users'=>array('thomas', 'kevin'),
// optional, list of roles (case sensitive!) that this rule applies to.
'roles'=>array('admin', 'editor'),
// since version 1.1.11 you can pass parameters for RBAC bizRules
'roles'=>array('updateTopic'=>array('topic'=>$topic))
// optional, list of IP address/patterns that this rule applies to
// e.g. 127.0.0.1, 127.0.0.*
'ips'=>array('127.0.0.1'),
// optional, list of request types (case insensitive) that this rule applies to
'verbs'=>array('GET', 'POST'),
// optional, a PHP expression whose value indicates whether this rule applies
// The PHP expression will be evaluated using evaluateExpression.
// A PHP expression can be any PHP code that has a value. To learn more about what an expression is,
// please refer to the php manual.
'expression'=>'!$user->isGuest && $user->level==2',
// optional, the customized error message to be displayed
// This option is available since version 1.1.1.
'message'=>'Access Denied.',
// optional, the denied method callback name, that will be called once the
// access is denied, instead of showing the customized error message. It can also be
// a valid PHP callback, including class method name (array(ClassName/Object, MethodName)),
// or anonymous function (PHP 5.3.0+). The function/method signature should be as follows:
// function foo($user, $rule) { ... }
// where $user is the current application user object and $rule is this access rule.
// This option is available since version 1.1.11.
'deniedCallback'=>'redirectToDeniedMethod',
)
Public Properties
Property |
Type |
Description |
Defined By |
message | string | the error message to be displayed when authorization fails. | CAccessControlFilter |
rules | array | list of access rules. | CAccessControlFilter |
Property Details
public string $message;
the error message to be displayed when authorization fails. This property can be overridden by individual access rule via CAccessRule::message. If this property is not set, a default error message will be displayed.
public array getRules()
public void setRules(array $rules)
list of access rules.
Method Details
protected void accessDenied(IWebUser $user, string $message) |
$user | IWebUser | the current user |
$message | string | the error message to be displayed |
Denies the access of the user. This method is invoked when access check fails.
public array getRules() |
{return} | array | list of access rules. |
protected boolean preFilter(CFilterChain $filterChain) |
$filterChain | CFilterChain | the filter chain that the filter is on. |
{return} | boolean | whether the filtering process should continue and the action should be executed. |
Source Code: framework/web/auth/CAccessControlFilter.php#128 (
show)
protected function preFilter($filterChain)
{
$app=Yii::app();
$request=$app->getRequest();
$user=$app->getUser();
$verb=$request->getRequestType();
$ip=$request->getUserHostAddress();
foreach($this->getRules() as $rule)
{
if(($allow=$rule->isUserAllowed($user,$filterChain->controller,$filterChain->action,$ip,$verb))>0) // allowed
break;
elseif($allow<0) // denied
{
if(isset($rule->deniedCallback))
call_user_func($rule->deniedCallback, $rule);
else
$this->accessDenied($user,$this->resolveErrorMessage($rule));
return false;
}
}
return true;
}
Performs the pre-action filtering.
protected string resolveErrorMessage(CAccessRule $rule) |
$rule | CAccessRule | the access rule |
{return} | string | the error message |
Source Code: framework/web/auth/CAccessControlFilter.php#161 (
show)
protected function resolveErrorMessage($rule)
{
if($rule->message!==null)
return $rule->message;
elseif($this->message!==null)
return $this->message;
else
return Yii::t('yii','You are not authorized to perform this action.');
}
Resolves the error message to be displayed. This method will check message and CAccessRule::message to see what error message should be displayed.
public void setRules(array $rules) |
$rules | array | list of access rules. |
Source Code: framework/web/auth/CAccessControlFilter.php#102 (
show)
public function setRules($rules)
{
foreach($rules as $rule)
{
if(is_array($rule) && isset($rule[0]))
{
$r=new CAccessRule;
$r->allow=$rule[0]==='allow';
foreach(array_slice($rule,1) as $name=>$value)
{
if($name==='expression' || $name==='roles' || $name==='message' || $name==='deniedCallback')
$r->$name=$value;
else
$r->$name=array_map('strtolower',$value);
}
$this->_rules[]=$r;
}
}
}