Learning about behaviour of a controller.
In this controller, I got a lot of action that should be access after login.
How can I make one special action in this controller without login ?
I just try it, not succces. This is my code.
class RequestController extends Controller {
public function behaviors() {
return [
'verbs' => [
'class' => VerbFilter::className(),
'actions' => [
'delete' => ['post'],
'bulk-delete' => ['post'],
],
],
'access' => [
'class' => AccessControl::className(),
'only' => ['approve'], /*Special action*/
'rules' => [
[
'actions' => ['approve'],
'allow' => false,
'roles' => ['?'],
],
],
],
];
}
Please advise.
You need use in rules
'allow' => true, this is described here:
Yii2 authorization
You should assign
'access' => [
'class' => AccessControl::className(),
'only' => ['approve'], /*Special action*/
'rules' => [
[
'actions' => ['approve'],
'allow' => true,
'roles' => ['?'],
],
],
],
Related
I have set some properties in behavior() method and I'm getting this error
public function behaviors()
{
return [
'access'=>[
'class'=> AccessControl::className(),
'only'=>['create','update'],
'rules'=>[
'allow'=>true,
'roles'=>['#'],
],
],
'verbs' => [
'class' => VerbFilter::className(),
'actions' => [
'delete' => ['POST'],
],
],
];
}
please someone see it to solve
AccessControl::$rules should be array of rules, so you need something like this:
'access' => [
'class' => AccessControl::className(),
'only' => ['create','update'],
'rules' => [
[
'allow' => true,
'roles' => ['#'],
],
],
],
Just change as per below code
'access'=>[
'class'=> AccessControl::className(),
'rules'=>[
'actions'=>['create','update'],
'allow'=>true,
'roles'=>['#'],
],
I have AdminController with behavior:
public function behaviors()
{
return [
'access' => [
'class' => AccessControl::className(),
'rules' => [
[
'actions' => ['login'],
'allow' => true,
'roles' => ['*'],
],
[
'actions' => ['index', 'logout'],
'allow' => true,
'roles' => ['admin', 'editor', 'expert'],
],
[
'actions' => ['update', 'delete'],
'allow' => true,
'roles' => ['admin'],
]
]
],
'verbs' => [
'class' => VerbFilter::className(),
'actions' => [
'logout' => ['get'],
],
],
];
}
Then i create child controllers for:
default controller
inf-courses controller
and other
How can i use rules on parent (AdminController) then its working?
If i add similar rules in deafult it works, but globally not.
P.S. I do admin panel and want next:
- any one can try to login
- access to admin pane: ['admin', 'editor', 'expert']
- logout can only ['admin', 'editor', 'expert']
It's globally rules for all module admin with parent AdminController.
Thank.
If you extend controller and then override behaviors() then you make sure to include parent's behaviors like this:
return ArrayHelper::merge(parent::behaviors(), [
// your behaviors here
]);
Done!
I make my AdminController like:
class AdminController extends Controller {
public function behaviors()
{
return [
'access' => [
'class' => AccessControl::className(),
'rules' => [
[
'allow' => true,
'roles' => ['admin', 'editor', 'expert'],
],
[
'actions' => ['login'],
'allow' => true,
'roles' => ['?'],
],
[
'actions' => ['delete'],
'allow' => true,
'roles' => ['admin'],
]
]
],
'verbs' => [
'class' => VerbFilter::className(),
'actions' => [
'logout' => ['get'],
],
],
];
}
}
And extends it for each controller in admin
This is backend SiteController.php access rules. When I going through this url site.com/backend/web/site/login. Its showing Forbidden (#403).
return [
'access' => [
'class' => AccessControl::className(),
'rules' => [
[
'actions' => ['login', 'error'],
'allow' => true,
],
[
'actions' => ['logout', 'index', 'addhotels'],
'allow' => true,
'roles' => ['#'],
],
],
],
'verbs' => [
'class' => VerbFilter::className(),
'actions' => [
'logout' => ['post'],
],
],
];
An Error occurred while handling another error: exception
'yii\web\ForbiddenHttpException' with message 'You are not allowed to
perform this action.' in
C:\wamp\www\k\kometonline\vendor\yiisoft\yii2\filters\AccessControl.php:151
I was getting this error too and found this page through Google so hopefully this will help other people.
The error happens because you've added access control but you also need to explicitly allow the 'error' action in the site controller otherwise you'll get the same error. It's not immediately obvious because there isn't an action for it, also add the 'captcha' action, or you'll get the same problem with that.
In your site controller:
public function behaviors()
{
return [
'access' => [
'class' => AccessControl::className(),
'rules' => [
[
'actions' => ['register','login'],
'allow' => true,
'roles' => ['?'],
],
[
'actions' => ['logout'],
'allow' => true,
'roles' => ['#'],
],
[
//see captcha and error added here, this fixes the issue
'actions' => ['contact', 'about', 'terms', 'forgot', 'reset-password', 'captcha', 'error'],
'allow' => true,
'roles' => ['?', '#'],
],
],
],
'verbs' => [
'class' => VerbFilter::className(),
'actions' => [
'logout' => ['post'],
],
],
];
}
You need to remove login action from AccessControl list. or add ? as roles for guest user in AccessControl.
For Example,
return [
'access' => [
'class' => AccessControl::className(),
'rules' => [
[
'actions' => ['login', 'error'],
'allow' => true,
'roles' => ['?'], // " ? " for guest user
],
[
'actions' => ['logout', 'index', 'addhotels'],
'allow' => true,
'roles' => ['#'],
],
],
],
'verbs' => [
'class' => VerbFilter::className(),
'actions' => [
'logout' => ['post'],
],
],
];
I would also like to know how to allow non-logged in users to not receive Forbidden error in Backend. I am simply trying to renderPartial a test view with a single
<h1>Test</h1>
and I receive the Forbidden error.
Maybe you are already logged in as a user while trying to access the login page. This will throw a ForbiddenHttpException. Or you can customize this behavior by configuring the denyCallback property:
[
'class' => AccessControl::className(),
'rules' => [...],
'denyCallback' => function ($rule, $action) {
//Add your error handler here
throw new \Exception('You are not allowed to access this page');
}
]
See official guide/documentation here
I tried finding out from the documentation but it is not mentioned and from this answer here it should work fine with REST API. Here is my code which returns status code 401 whenever I do not send access token with my request.
public function behaviors()
{
return [
'compositeAuth' => [
'class' => CompositeAuth::className(),
'authMethods' => [
QueryParamAuth::className(),
],
],
'access' => [
'class' => AccessControl::className(),
'only' => ['index', 'logout'],
'rules' => [
[
'actions' => ['index'],
'allow' => true,
'roles' => ['?'],
],
[
'actions' => ['logout'],
'allow' => true,
'roles' => ['#'],
],
],
],
'verbs' => [
'class' => VerbFilter::className(),
'actions' => [
'logout' => ['post'],
],
],
];
}
Both actionIndex and actionLogout require access token on my query though I want only logout to do this. My controller extends my base class which extends \yii/rest/Controller
My access control code is not working on the modules default controller, but on all other pages it is working fine. Any idea what i am doing wrong?
EDIT: What is happening is : ../web/mymodule does not redirect but ../web/mymodule/mycontroller does. Also if o try ../web/mymodule/default it does not work also.
EDIT 2: Solved. The problem was with the public function beforeAction($action)
public function behaviors()
{
return [
'verbs' => [
'class' => VerbFilter::className(),
'actions' => [
'delete' => ['post'],
],
],
'access' => [
'class' => AccessControl::className(),
'rules' => [
[
'allow' => true,
'roles' => ['#'],
],
],
],
];
}
Seems you don't control the action. Try this in SiteController:
return [
'access' => [
'class' => AccessControl::className(),
'only' => ['logout', 'signup'],
'rules' => [
[
'actions' => ['signup'],
'allow' => true,
'roles' => ['?'],
],
[
'actions' => ['logout'],
'allow' => true,
'roles' => ['#'],
],
],
],
],
'verbs' => [
..............
],
];