防止未授权用户

Question

的页面访问，我想我已经在控制器使用此代码做了一次成功登录系统：

public function actionLogin() 
    { 
     if (!\Yii::$app->user->isGuest) { 
      return $this->redirect(Yii::$app->request->baseUrl.'/telephone/index'); 
     } 

     $model = new LoginForm(); 
     if ($model->load(Yii::$app->request->post()) && $model->login()) { 
      return $this->redirect(Yii::$app->request->baseUrl.'/telephone/add'); 
     } 
     return $this->render('login', [ 
      'model' => $model, 
     ]); 
    } 

但后来我意识到任何人都可以在不直接到URL记录访问/telephone/add。我如何防止访问该页面。

Answer 1

您可以在相关的控制器正确配置行为

use yii\filters\AccessControl; 
use yii\filters\VerbFilter; 

/** 
* Site controller 
*/ 
class YourTelephoneController extends Controller 
{ 
    /** 
    * @inheritdoc 
    */ 
    public function behaviors() 
    { 
     return [ 
      'access' => [ 
       'class' => AccessControl::className(), 
       'rules' => [ 
        ....... 
        [ 
         'actions' => ['add', ], 
         'allow' => true, 
         'roles' => ['@'], 
        ], 
        ........ 
       ], 
      ], 
     ]; 
    } 
... 

看到更多http://www.yiiframework.com/doc-2.0/guide-structure-filters.html#access-control

http://www.yiiframework.com/doc-2.0/guide-structure-filters.html

http://www.yiiframework.com/doc-2.0/yii-base-actionfilter.html