防止未授權用戶

Question

的頁面訪問，我想我已經在控制器使用此代碼做了一次成功登錄系統：

public function actionLogin() 
    { 
     if (!\Yii::$app->user->isGuest) { 
      return $this->redirect(Yii::$app->request->baseUrl.'/telephone/index'); 
     } 

     $model = new LoginForm(); 
     if ($model->load(Yii::$app->request->post()) && $model->login()) { 
      return $this->redirect(Yii::$app->request->baseUrl.'/telephone/add'); 
     } 
     return $this->render('login', [ 
      'model' => $model, 
     ]); 
    } 

但後來我意識到任何人都可以在不直接到URL記錄訪問/telephone/add。我如何防止訪問該頁面。

Answer 1

您可以在相關的控制器正確配置行爲

use yii\filters\AccessControl; 
use yii\filters\VerbFilter; 

/** 
* Site controller 
*/ 
class YourTelephoneController extends Controller 
{ 
    /** 
    * @inheritdoc 
    */ 
    public function behaviors() 
    { 
     return [ 
      'access' => [ 
       'class' => AccessControl::className(), 
       'rules' => [ 
        ....... 
        [ 
         'actions' => ['add', ], 
         'allow' => true, 
         'roles' => ['@'], 
        ], 
        ........ 
       ], 
      ], 
     ]; 
    } 
... 

看到更多http://www.yiiframework.com/doc-2.0/guide-structure-filters.html#access-control

http://www.yiiframework.com/doc-2.0/guide-structure-filters.html

http://www.yiiframework.com/doc-2.0/yii-base-actionfilter.html