HumHub Documentation (unofficial)

AccessControl extends ActionFilter
in package

AccessControl provides simple access control based on a set of rules.

AccessControl is an action filter. It will check its [[rules]] to find the first rule that matches the current context variables (such as user IP address, user role). The matching rule will dictate whether to allow or deny the access to the requested controller action. If no rule matches, the access will be denied.

To use AccessControl, declare it in the behaviors() method of your controller class. For example, the following declarations will allow authenticated users to access the "create" and "update" actions and deny all other users from accessing these two actions.

public function behaviors()
{
    return [
        'access' => [
            'class' => \yii\filters\AccessControl::class,
            'only' => ['create', 'update'],
            'rules' => [
                // deny all POST requests
                [
                    'allow' => false,
                    'verbs' => ['POST']
                ],
                // allow authenticated users
                [
                    'allow' => true,
                    'roles' => ['@'],
                ],
                // everything else is denied
            ],
        ],
    ];
}
Tags
author

Qiang Xue qiang.xue@gmail.com

since
2.0

Table of Contents

Properties

$denyCallback  : callable|null
$except  : array<string|int, mixed>
$only  : array<string|int, mixed>
$owner  : Component|null
$ruleConfig  : array<string|int, mixed>
$rules  : array<string|int, mixed>
$user  : User|array<string|int, mixed>|string|false
$_attachedEvents  : array<string|int, mixed>

Methods

__call()  : mixed
Calls the named method which is not a class method.
__construct()  : mixed
Constructor.
__get()  : mixed
Returns the value of an object property.
__isset()  : bool
Checks if a property is set, i.e. defined and not null.
__set()  : mixed
Sets value of an object property.
__unset()  : mixed
Sets an object property to null.
afterAction()  : mixed
This method is invoked right after an action is executed.
afterFilter()  : mixed
attach()  : mixed
Attaches the behavior object to the component.
beforeAction()  : bool
This method is invoked right before an action is to be executed (after all possible filters.) You may override this method to do last-minute preparation for the action.
beforeFilter()  : mixed
canGetProperty()  : bool
Returns a value indicating whether a property can be read.
canSetProperty()  : bool
Returns a value indicating whether a property can be set.
className()  : string
Returns the fully qualified name of this class.
detach()  : mixed
Detaches the behavior object from the component.
events()  : array<string|int, mixed>
Declares event handlers for the [[owner]]'s events.
hasMethod()  : bool
Returns a value indicating whether a method is defined.
hasProperty()  : bool
Returns a value indicating whether a property is defined.
init()  : mixed
Initializes the [[rules]] array by instantiating rule objects from configurations.
denyAccess()  : mixed
Denies the access of the user.
getActionId()  : string
Returns an action ID by converting [[Action::$uniqueId]] into an ID relative to the module.
isActive()  : bool
Returns a value indicating whether the filter is active for the given action.

Properties

$denyCallback

public callable|null $denyCallback

a callback that will be called if the access should be denied to the current user. This is the case when either no rule matches, or a rule with [[AccessRule::$allow|$allow]] set to false matches. If not set, [[denyAccess()]] will be called.

The signature of the callback should be as follows:

function ($rule, $action)

where $rule is the rule that denies the user, and $action is the current [[Action|action]] object. $rule can be null if access is denied because none of the rules matched.

$except

public array<string|int, mixed> $except = []

list of action IDs that this filter should not apply to.

Tags
see
only

$only

public array<string|int, mixed> $only = []

list of action IDs that this filter should apply to. If this property is not set, then the filter applies to all actions, unless they are listed in [[except]]. If an action ID appears in both [[only]] and [[except]], this filter will NOT apply to it.

Note that if the filter is attached to a module, the action IDs should also include child module IDs (if any) and controller IDs.

Since version 2.0.9 action IDs can be specified as wildcards, e.g. site/*.

Tags
see
except

$ruleConfig

public array<string|int, mixed> $ruleConfig = ['class' => 'yii\filters\AccessRule']

the default configuration of access rules. Individual rule configurations specified via [[rules]] will take precedence when the same property of the rule is configured.

$rules

public array<string|int, mixed> $rules = []

a list of access rule objects or configuration arrays for creating the rule objects. If a rule is specified via a configuration array, it will be merged with [[ruleConfig]] first before it is used for creating the rule object.

Tags
see
ruleConfig

$user

public User|array<string|int, mixed>|string|false $user = 'user'

the user object representing the authentication status or the ID of the user application component. Starting from version 2.0.2, this can also be a configuration array for creating the object. Starting from version 2.0.12, you can set it to false to explicitly switch this component support off for the filter.

$_attachedEvents

private array<string|int, mixed> $_attachedEvents = []

Attached events handlers

Methods

__call()

Calls the named method which is not a class method.

public __call(string $name, array<string|int, mixed> $params) : mixed

Do not call this method directly as it is a PHP magic method that will be implicitly called when an unknown method is being invoked.

Parameters
$name : string

the method name

$params : array<string|int, mixed>

method parameters

Tags
throws
UnknownMethodException

when calling unknown method

Return values
mixed —

the method return value

__construct()

Constructor.

public __construct([array<string|int, mixed> $config = [] ]) : mixed

The default implementation does two things:

  • Initializes the object with the given configuration $config.
  • Call [[init()]].

If this method is overridden in a child class, it is recommended that

  • the last parameter of the constructor is a configuration array, like $config here.
  • call the parent implementation at the end of the constructor.
Parameters
$config : array<string|int, mixed> = []

name-value pairs that will be used to initialize the object properties

__get()

Returns the value of an object property.

public __get(string $name) : mixed

Do not call this method directly as it is a PHP magic method that will be implicitly called when executing $value = $object->property;.

Parameters
$name : string

the property name

Tags
throws
UnknownPropertyException

if the property is not defined

throws
InvalidCallException

if the property is write-only

see
__set()
Return values
mixed —

the property value

__isset()

Checks if a property is set, i.e. defined and not null.

public __isset(string $name) : bool

Do not call this method directly as it is a PHP magic method that will be implicitly called when executing isset($object->property).

Note that if the property is not defined, false will be returned.

Parameters
$name : string

the property name or the event name

Tags
see
https://www.php.net/manual/en/function.isset.php
Return values
bool —

whether the named property is set (not null).

__set()

Sets value of an object property.

public __set(string $name, mixed $value) : mixed

Do not call this method directly as it is a PHP magic method that will be implicitly called when executing $object->property = $value;.

Parameters
$name : string

the property name or the event name

$value : mixed

the property value

Tags
throws
UnknownPropertyException

if the property is not defined

throws
InvalidCallException

if the property is read-only

see
__get()

__unset()

Sets an object property to null.

public __unset(string $name) : mixed

Do not call this method directly as it is a PHP magic method that will be implicitly called when executing unset($object->property).

Note that if the property is not defined, this method will do nothing. If the property is read-only, it will throw an exception.

Parameters
$name : string

the property name

Tags
throws
InvalidCallException

if the property is read only.

see
https://www.php.net/manual/en/function.unset.php

afterAction()

This method is invoked right after an action is executed.

public afterAction(Action $action, mixed $result) : mixed

You may override this method to do some postprocessing for the action.

Parameters
$action : Action

the action just executed.

$result : mixed

the action execution result

Return values
mixed —

the processed action result.

attach()

Attaches the behavior object to the component.

public attach(mixed $owner) : mixed
Parameters
$owner : mixed

the component that this behavior is to be attached to.

beforeAction()

This method is invoked right before an action is to be executed (after all possible filters.) You may override this method to do last-minute preparation for the action.

public beforeAction(Action $action) : bool
Parameters
$action : Action

the action to be executed.

Return values
bool —

whether the action should continue to be executed.

canGetProperty()

Returns a value indicating whether a property can be read.

public canGetProperty(string $name[, bool $checkVars = true ]) : bool

A property is readable if:

  • the class has a getter method associated with the specified name (in this case, property name is case-insensitive);
  • the class has a member variable with the specified name (when $checkVars is true);
Parameters
$name : string

the property name

$checkVars : bool = true

whether to treat member variables as properties

Tags
see
canSetProperty()
Return values
bool —

whether the property can be read

canSetProperty()

Returns a value indicating whether a property can be set.

public canSetProperty(string $name[, bool $checkVars = true ]) : bool

A property is writable if:

  • the class has a setter method associated with the specified name (in this case, property name is case-insensitive);
  • the class has a member variable with the specified name (when $checkVars is true);
Parameters
$name : string

the property name

$checkVars : bool = true

whether to treat member variables as properties

Tags
see
canGetProperty()
Return values
bool —

whether the property can be written

className()

Returns the fully qualified name of this class.

public static className() : string
Tags
deprecated

since 2.0.14. On PHP >=5.5, use ::class instead.

Return values
string —

the fully qualified name of this class.

detach()

Detaches the behavior object from the component.

public detach() : mixed

events()

Declares event handlers for the [[owner]]'s events.

public events() : array<string|int, mixed>

Child classes may override this method to declare what PHP callbacks should be attached to the events of the [[owner]] component.

The callbacks will be attached to the [[owner]]'s events when the behavior is attached to the owner; and they will be detached from the events when the behavior is detached from the component.

The callbacks can be any of the following:

  • method in this behavior: 'handleClick', equivalent to [$this, 'handleClick']
  • object method: [$object, 'handleClick']
  • static method: ['Page', 'handleClick']
  • anonymous function: function ($event) { ... }

The following is an example:

[
    Model::EVENT_BEFORE_VALIDATE => 'myBeforeValidate',
    Model::EVENT_AFTER_VALIDATE => 'myAfterValidate',
]
Return values
array<string|int, mixed> —

events (array keys) and the corresponding event handler methods (array values).

hasMethod()

Returns a value indicating whether a method is defined.

public hasMethod(string $name) : bool

The default implementation is a call to php function method_exists(). You may override this method when you implemented the php magic method __call().

Parameters
$name : string

the method name

Return values
bool —

whether the method is defined

hasProperty()

Returns a value indicating whether a property is defined.

public hasProperty(string $name[, bool $checkVars = true ]) : bool

A property is defined if:

  • the class has a getter or setter method associated with the specified name (in this case, property name is case-insensitive);
  • the class has a member variable with the specified name (when $checkVars is true);
Parameters
$name : string

the property name

$checkVars : bool = true

whether to treat member variables as properties

Tags
see
canGetProperty()
see
canSetProperty()
Return values
bool —

whether the property is defined

init()

Initializes the [[rules]] array by instantiating rule objects from configurations.

public init() : mixed

denyAccess()

Denies the access of the user.

protected denyAccess(User|false $user) : mixed

The default implementation will redirect the user to the login page if he is a guest; if the user is already logged, a 403 HTTP exception will be thrown.

Parameters
$user : User|false

the current user or boolean false in case of detached User component

Tags
throws
ForbiddenHttpException

if the user is already logged in or in case of detached User component.

getActionId()

Returns an action ID by converting [[Action::$uniqueId]] into an ID relative to the module.

protected getActionId(Action $action) : string
Parameters
$action : Action
Tags
since
2.0.7
Return values
string

isActive()

Returns a value indicating whether the filter is active for the given action.

protected isActive(Action $action) : bool
Parameters
$action : Action

the action being filtered

Return values
bool —

whether the filter is active for the given action.


        

        
    




    

    

                                

                

                                
    

        On this page

        
    


                

                            

            

    

        

            
Search results