May I know how to have function of automatic logout if users have inactive more than 5 minutes in yii2 ?
Try this configuration :
'user' => [
'enableAutoLogin' => false,
'authTimeout' => 300,
],
authTimeout
Your answer lies in configuration of "user" component in your config files.
Everything you need to know is in this documentation Yii2 User Component, set authTimout property to 300 (that's in seconds) and your user should be logged out after 5 minutes of inactivity.
In your component configuration you need to add config in user component like this
'components'=>[
'user' => [
'class'=>'yii\web\User',
'identityClass' => 'common\models\User',
'loginUrl'=>['sign-in/login'],
'enableAutoLogin' => false,
'authTimeout'=>300, //Number of second to Automatic Logout if inactive
//this config is optional
'identityCookie' => [
'name' => '_backendUser', // unique for backend
'path'=>'#backend/web' // correct path for the backend app.
],
'as afterLogin' => 'common\behaviors\LoginTimestampBehavior'
],
],
Besides of setting up the main.php I have three suggestion to handle this situation.
You should set you application in production mode ..
customize the site/error.php to check if user is guest and if not display the div with message like "Session expires" and a link to "site/login".
Alternatively, To redirect to login page when clicks on any link, define the access-control in a controller behaviors function and then you are done.
Related
I use rbac (dektrium) and ACF to check to access users in my project (yii2). I created some role for example :admin, manager, suser,user,.. I have some actions that all user can use its for example view action. how can define in behaviors method that all user can use view action?
To do this we assigned actions to user '*' in yii1.
...
array('allow', // allow all users to perform 'index' and 'view' actions
'actions'=>array('view'),
'users'=>array('*'),
),
...
in yii2 use this code ()
...
[
'allow' => true,
'actions' => ['view'],
'roles' => ['?'],
],
...
but when admin user or manager user want to access to myController/view shows forbidden. only guests can access to myController/view, how can define a role or access to access to all user by default?
If you want to allow everyone to access action then there is no need to apply access filter for that action. To avoid applying access filter for specific actions you can use $except property of yii\filters\AccessControl. For example like this:
public function behaviors()
{
return [
'access' => [
'class' => AccessControl::className(),
'except' => ['view'],
'rules' => [
//rules for other actions ...
]
],
//other behaviors ...
];
}
Other option would be to use a combination of roles ? (guests) and # (all logged in users) like this:
[
'allow' => true,
'actions' => ['view'],
'roles' => ['?', '#'],
]
There is also $only property in yii\filters\AccessControl that allows to apply filter only to explicitly named actions. But it's better to use $except for security reasons.
Resources:
yii\filters\AccessControl
yii\filters\AccessRule::$roles
How/where do you set the controller/method Yii2 uses when a user is required to be logged in? Currently it goes to site/login and I'm trying to point it to auth/login.
Assuming you are using advanced template in your config/main.php (or main-local.php) you should define your user component g for frontented app
'user' => [
'identityClass' => 'app\models\web\User',
'enableAutoLogin' => true,
'loginUrl'=>['/frontend/auth/login'],
],
I am logging into Db using existing Yii logging API.
But I want to differentiate between Frontend logs and Backend logs inside DB.
Everything that appears is common for both, I face difficulty tracing frontend logs.
Below is the image of DB Logs where GREEN marked are for backend logs, RED marked are for Frontend Logs.
You can use prefix property for this. This is callable that returns a string to be prefixed to every exported message with signature function ($message).
As default getMessagePrefix() is used there which prefixes the message with user IP, user ID and session ID.
You can use it to add there frontend and backend.
Thanks to #Bizley!
Inside both backend/config/main and frontend/config/main, I configured below; This is how my entire log configuration for Frontend looks like(Similarly you can do it for Backend);
'log' => [
'traceLevel' => YII_DEBUG ? 3 : 0,
'targets' => [
[
'class' => 'yii\log\DbTarget',
'levels' => ['error'],
'prefix' => function ($message) {
return "[Frontend]";
},
],
[
'class' => 'yii\log\FileTarget',
'levels' => ['error','info'],
],
],
],
Below is the view on UI for logs. With the Help of Prefix I can now easily differentiate between channels.
If user is not logged in then user should have to be redirect on login page, for that i found function which is working fine for me, i used below function
public function beforeAction($action)
{
if (\Yii::$app->getUser()->isGuest &&
\Yii::$app->getRequest()->url !== Url::to(\Yii::$app->getUser()->loginUrl)
) {
\Yii::$app->getResponse()->redirect(\Yii::$app->getUser()->loginUrl);
}
return parent::beforeAction($action);
}
This is working fine for me, but for this i need to add function in every controller, what i want to do, i need common function where can i perform this action, So can anyone please tell me what is best way to do this ?
You need to add below code in config/web.php after components part.
'as beforeRequest' => [ //if guest user access site so, redirect to login page.
'class' => 'yii\filters\AccessControl',
'rules' => [
[
'actions' => ['login', 'error'],
'allow' => true,
],
[
'allow' => true,
'roles' => ['#'],
],
],
],
Actually if user does not have rights Yii redirects him to login page by it self.
You can change loginUrl if you have another one. Or you can implement own redirect if for example you use ajax.
http://www.yiiframework.com/doc-2.0/yii-web-user.html
Here is explanation of Yii security
http://www.yiiframework.com/doc-2.0/guide-security-authorization.html
my site start with a default language(which is English) then based on user's preference i should change it. is this possible in Yii2 ? is there any widget for this
I use contentNegotiator, without assign a language to the user the language is automatically assigned by the application.
for this
In config/main.php in bootstrap section start the component
'bootstrap' => [
'log',
'contentNegotiator',
],
in component section
'components' => [
'contentNegotiator' =>[
'class' => 'yii\filters\ContentNegotiator',
'languages' => [
'en-US',
'it-IT',
'fr-FR',
],
],
],
otherwise you can change when and where you want. Is application action eg you can do in any controller you chose. this way
\Yii::$app->language = 'zh-CN';