HumHub Documentation (unofficial)

HostControl extends ActionFilter
in package

HostControl provides simple control over requested host name.

This filter provides protection against 'host header' attacks, allowing action execution only for specified host names.

Application configuration example:

return [
    'as hostControl' => [
        'class' => 'yii\filters\HostControl',
        'allowedHosts' => [
            'example.com',
            '*.example.com',
        ],
    ],
    // ...
];

Controller configuration example:

use yii\web\Controller;
use yii\filters\HostControl;

class SiteController extends Controller
{
    public function behaviors()
    {
        return [
            'hostControl' => [
                'class' => HostControl::class,
                'allowedHosts' => [
                    'example.com',
                    '*.example.com',
                ],
            ],
        ];
    }

    // ...
}

Note: the best way to restrict allowed host names is usage of the web server 'virtual hosts' configuration. This filter should be used only if this configuration is not available or compromised.

Tags
author

Paul Klimov klimov.paul@gmail.com

since
2.0.11

Table of Contents

Properties

$allowedHosts  : array<string|int, mixed>|Closure|null
$denyCallback  : callable|null
$except  : array<string|int, mixed>
$fallbackHostInfo  : string|null
$only  : array<string|int, mixed>
$owner  : Component|null
$_attachedEvents  : array<string|int, mixed>

Methods

__call()  : mixed
Calls the named method which is not a class method.
__construct()  : mixed
Constructor.
__get()  : mixed
Returns the value of an object property.
__isset()  : bool
Checks if a property is set, i.e. defined and not null.
__set()  : mixed
Sets value of an object property.
__unset()  : mixed
Sets an object property to null.
afterAction()  : mixed
This method is invoked right after an action is executed.
afterFilter()  : mixed
attach()  : mixed
Attaches the behavior object to the component.
beforeAction()  : bool
This method is invoked right before an action is to be executed (after all possible filters.) You may override this method to do last-minute preparation for the action.
beforeFilter()  : mixed
canGetProperty()  : bool
Returns a value indicating whether a property can be read.
canSetProperty()  : bool
Returns a value indicating whether a property can be set.
className()  : string
Returns the fully qualified name of this class.
detach()  : mixed
Detaches the behavior object from the component.
events()  : array<string|int, mixed>
Declares event handlers for the [[owner]]'s events.
hasMethod()  : bool
Returns a value indicating whether a method is defined.
hasProperty()  : bool
Returns a value indicating whether a property is defined.
init()  : mixed
Initializes the object.
denyAccess()  : mixed
Denies the access.
getActionId()  : string
Returns an action ID by converting [[Action::$uniqueId]] into an ID relative to the module.
isActive()  : bool
Returns a value indicating whether the filter is active for the given action.

Properties

$allowedHosts

public array<string|int, mixed>|Closure|null $allowedHosts

list of host names, which are allowed. Each host can be specified as a wildcard pattern. For example:

[
    'example.com',
    '*.example.com',
]

This field can be specified as a PHP callback of following signature:

function (\yii\base\Action $action) {
    //return array of strings
}

where $action is the current [[\yii\base\Action|action]] object.

If this field is not set - no host name check will be performed.

$denyCallback

public callable|null $denyCallback

a callback that will be called if the current host does not match [[allowedHosts]]. If not set, [[denyAccess()]] will be called.

The signature of the callback should be as follows:

function (\yii\base\Action $action)

where $action is the current [[\yii\base\Action|action]] object.

Note: while implementing your own host deny processing, make sure you avoid usage of the current requested host name, creation of absolute URL links, caching page parts and so on.

$except

public array<string|int, mixed> $except = []

list of action IDs that this filter should not apply to.

Tags
see
only

$fallbackHostInfo

public string|null $fallbackHostInfo = ''

fallback host info (e.g. https://www.yiiframework.com) used when [[\yii\web\Request::$hostInfo|Request::$hostInfo]] is invalid. This value will replace [[\yii\web\Request::$hostInfo|Request::$hostInfo]] before [[$denyCallback]] is called to make sure that an invalid host will not be used for further processing. You can set it to null to leave [[\yii\web\Request::$hostInfo|Request::$hostInfo]] untouched. Default value is empty string (this will result creating relative URLs instead of absolute).

Tags
see
Request::getHostInfo()

$only

public array<string|int, mixed> $only = []

list of action IDs that this filter should apply to. If this property is not set, then the filter applies to all actions, unless they are listed in [[except]]. If an action ID appears in both [[only]] and [[except]], this filter will NOT apply to it.

Note that if the filter is attached to a module, the action IDs should also include child module IDs (if any) and controller IDs.

Since version 2.0.9 action IDs can be specified as wildcards, e.g. site/*.

Tags
see
except

$_attachedEvents

private array<string|int, mixed> $_attachedEvents = []

Attached events handlers

Methods

__call()

Calls the named method which is not a class method.

public __call(string $name, array<string|int, mixed> $params) : mixed

Do not call this method directly as it is a PHP magic method that will be implicitly called when an unknown method is being invoked.

Parameters
$name : string

the method name

$params : array<string|int, mixed>

method parameters

Tags
throws
UnknownMethodException

when calling unknown method

Return values
mixed —

the method return value

__construct()

Constructor.

public __construct([array<string|int, mixed> $config = [] ]) : mixed

The default implementation does two things:

  • Initializes the object with the given configuration $config.
  • Call [[init()]].

If this method is overridden in a child class, it is recommended that

  • the last parameter of the constructor is a configuration array, like $config here.
  • call the parent implementation at the end of the constructor.
Parameters
$config : array<string|int, mixed> = []

name-value pairs that will be used to initialize the object properties

__get()

Returns the value of an object property.

public __get(string $name) : mixed

Do not call this method directly as it is a PHP magic method that will be implicitly called when executing $value = $object->property;.

Parameters
$name : string

the property name

Tags
throws
UnknownPropertyException

if the property is not defined

throws
InvalidCallException

if the property is write-only

see
__set()
Return values
mixed —

the property value

__isset()

Checks if a property is set, i.e. defined and not null.

public __isset(string $name) : bool

Do not call this method directly as it is a PHP magic method that will be implicitly called when executing isset($object->property).

Note that if the property is not defined, false will be returned.

Parameters
$name : string

the property name or the event name

Tags
see
https://www.php.net/manual/en/function.isset.php
Return values
bool —

whether the named property is set (not null).

__set()

Sets value of an object property.

public __set(string $name, mixed $value) : mixed

Do not call this method directly as it is a PHP magic method that will be implicitly called when executing $object->property = $value;.

Parameters
$name : string

the property name or the event name

$value : mixed

the property value

Tags
throws
UnknownPropertyException

if the property is not defined

throws
InvalidCallException

if the property is read-only

see
__get()

__unset()

Sets an object property to null.

public __unset(string $name) : mixed

Do not call this method directly as it is a PHP magic method that will be implicitly called when executing unset($object->property).

Note that if the property is not defined, this method will do nothing. If the property is read-only, it will throw an exception.

Parameters
$name : string

the property name

Tags
throws
InvalidCallException

if the property is read only.

see
https://www.php.net/manual/en/function.unset.php

afterAction()

This method is invoked right after an action is executed.

public afterAction(Action $action, mixed $result) : mixed

You may override this method to do some postprocessing for the action.

Parameters
$action : Action

the action just executed.

$result : mixed

the action execution result

Return values
mixed —

the processed action result.

attach()

Attaches the behavior object to the component.

public attach(mixed $owner) : mixed
Parameters
$owner : mixed

the component that this behavior is to be attached to.

beforeAction()

This method is invoked right before an action is to be executed (after all possible filters.) You may override this method to do last-minute preparation for the action.

public beforeAction(mixed $action) : bool
Parameters
$action : mixed

the action to be executed.

Return values
bool —

whether the action should continue to be executed.

canGetProperty()

Returns a value indicating whether a property can be read.

public canGetProperty(string $name[, bool $checkVars = true ]) : bool

A property is readable if:

  • the class has a getter method associated with the specified name (in this case, property name is case-insensitive);
  • the class has a member variable with the specified name (when $checkVars is true);
Parameters
$name : string

the property name

$checkVars : bool = true

whether to treat member variables as properties

Tags
see
canSetProperty()
Return values
bool —

whether the property can be read

canSetProperty()

Returns a value indicating whether a property can be set.

public canSetProperty(string $name[, bool $checkVars = true ]) : bool

A property is writable if:

  • the class has a setter method associated with the specified name (in this case, property name is case-insensitive);
  • the class has a member variable with the specified name (when $checkVars is true);
Parameters
$name : string

the property name

$checkVars : bool = true

whether to treat member variables as properties

Tags
see
canGetProperty()
Return values
bool —

whether the property can be written

className()

Returns the fully qualified name of this class.

public static className() : string
Tags
deprecated

since 2.0.14. On PHP >=5.5, use ::class instead.

Return values
string —

the fully qualified name of this class.

detach()

Detaches the behavior object from the component.

public detach() : mixed

events()

Declares event handlers for the [[owner]]'s events.

public events() : array<string|int, mixed>

Child classes may override this method to declare what PHP callbacks should be attached to the events of the [[owner]] component.

The callbacks will be attached to the [[owner]]'s events when the behavior is attached to the owner; and they will be detached from the events when the behavior is detached from the component.

The callbacks can be any of the following:

  • method in this behavior: 'handleClick', equivalent to [$this, 'handleClick']
  • object method: [$object, 'handleClick']
  • static method: ['Page', 'handleClick']
  • anonymous function: function ($event) { ... }

The following is an example:

[
    Model::EVENT_BEFORE_VALIDATE => 'myBeforeValidate',
    Model::EVENT_AFTER_VALIDATE => 'myAfterValidate',
]
Return values
array<string|int, mixed> —

events (array keys) and the corresponding event handler methods (array values).

hasMethod()

Returns a value indicating whether a method is defined.

public hasMethod(string $name) : bool

The default implementation is a call to php function method_exists(). You may override this method when you implemented the php magic method __call().

Parameters
$name : string

the method name

Return values
bool —

whether the method is defined

hasProperty()

Returns a value indicating whether a property is defined.

public hasProperty(string $name[, bool $checkVars = true ]) : bool

A property is defined if:

  • the class has a getter or setter method associated with the specified name (in this case, property name is case-insensitive);
  • the class has a member variable with the specified name (when $checkVars is true);
Parameters
$name : string

the property name

$checkVars : bool = true

whether to treat member variables as properties

Tags
see
canGetProperty()
see
canSetProperty()
Return values
bool —

whether the property is defined

init()

Initializes the object.

public init() : mixed

This method is invoked at the end of the constructor after the object is initialized with the given configuration.

denyAccess()

Denies the access.

protected denyAccess(Action $action) : mixed

The default implementation will display 404 page right away, terminating the program execution. You may override this method, creating your own deny access handler. While doing so, make sure you avoid usage of the current requested host name, creation of absolute URL links, caching page parts and so on.

Parameters
$action : Action

the action to be executed.

Tags
throws
NotFoundHttpException

getActionId()

Returns an action ID by converting [[Action::$uniqueId]] into an ID relative to the module.

protected getActionId(Action $action) : string
Parameters
$action : Action
Tags
since
2.0.7
Return values
string

isActive()

Returns a value indicating whether the filter is active for the given action.

protected isActive(Action $action) : bool
Parameters
$action : Action

the action being filtered

Return values
bool —

whether the filter is active for the given action.


        

        
    




    

    

                                

                

                                
    

        On this page

        
    


                

                            

            

    

        

            
Search results