php/yii2
1
0
Fork 0
mirror of https://github.com/yiisoft/yii2.git synced 2025-08-26 14:26:54 +08:00
Code Issues Packages Projects Releases Wiki Activity

Fixes issue #579: AccessControl deny rule by default

Browse Source
This commit is contained in:
Qiang Xue
2013-06-24 21:04:44 -04:00
parent 36655d3b1d
commit 051822075e
2 changed files with 3 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
docs/guide/upgrade-from-v1.md
View File

@ -288,7 +288,6 @@ public function behaviors()
'class' => 'yii\web\AccessControl',
'rules' => array(
array('allow' => true, 'actions' => array('admin'), 'roles' => array('@')),
array('allow' => false),
),
),
);

6
framework/yii/web/AccessControl.php
View File

@ -17,7 +17,7 @@ use yii\base\ActionFilter;
* AccessControl is an action filter. It will check its [[rules]] to find
* the first rule that matches the current context variables (such as user IP address, user role).
* The matching rule will dictate whether to allow or deny the access to the requested controller
* action.
* action. If no rule matches, the access will be denied.
*
* To use AccessControl, declare it in the `behaviors()` method of your controller class.
* For example, the following declarations will allow authenticated users to access the "create"
@ -105,7 +105,7 @@ class AccessControl extends ActionFilter
/** @var $rule AccessRule */
foreach ($this->rules as $rule) {
if ($allow = $rule->allows($action, $user, $request)) {
break;
return true;
} elseif ($allow === false) {
if (isset($rule->denyCallback)) {
call_user_func($rule->denyCallback, $rule);
@ -117,7 +117,7 @@ class AccessControl extends ActionFilter
return false;
}
}
return true;
return false;
}
/**