I solved the problem.
Created a base controller in backend, made access.<?php
namespace backend\controllers;
use Yii;
use common\models\service\Rbac;
use yii\web\Controller;
use yii\filters\VerbFilter;
use yii\filters\AccessControl;
class AdminController extends Controller
{
public function behaviors()
{
return [
'verbs' => [
'class' => VerbFilter::className(),
'actions' => [
'logout' => ['GET'],
'delete' => ['POST'],
],
],
'access' => [
'class' => AccessControl::className(),
'rules' => [
//COMMON
[
'actions' => ['logout', 'index'],
'allow' => true,
'roles' => ['admin', 'content_manager'],
],
[
'actions' => ['login'],
'allow' => true,
'roles' => ['?']
],
[
'allow' => true,
'roles' => ['admin', 'content_manager'],
],
],
],
];
}
public function actions()
{
return [
'error' => [
'class' => 'yii\web\ErrorAction',
],
];
}
public function beforeAction($action)
{
if (!Yii::$app->user->isGuest) {
$rbac = new Rbac();
$rbac->checkPermissionsForContentManager();
}
return parent::beforeAction($action); // TODO: Change the autogenerated stub
}
}
All the other controllers inherited from the base.Rbac service<?php
namespace common\models\service;
use Yii;
use common\models\User;
use yii\web\ForbiddenHttpException;
class Rbac
{
/**
Backend controller ids array
for Content Manager
@var array
*/
public $permissionsContentManager = [
'auth',
'admin',
'announcement',
'complain',
'site'
];
/**
@param $username
@return bool
*/
public static function isUserAdmin($username)
{
$user = User::findOne(['username' => $username]);
if ($user) {
return in_array($user->id, Yii::$app->authManager->getUserIdsByRole('admin'));
}
return false;
}
/**
@param $username
@return bool
*/
public static function isUserContentManager($username)
{
$user = User::findOne(['username' => $username]);
if ($user) {
return in_array($user->id, Yii::$app->authManager->getUserIdsByRole('content_manager'));
}
return false;
}
public function checkPermissionsForContentManager()
{
if (self::isUserContentManager(Yii::$app->user->identity->username)) {
if (!in_array(Yii::$app->controller->id, $this->permissionsContentManager))
{
throw new ForbiddenHttpException('У вас нет доступа к этой странице ...', 403);
}
}
}
}
I am not sure of the correctness of the solution, as this code can be written without the use of RBAC.
