Question

我想限制角色成员的用户访问后端。我使用RBAC高级版的默认yii2进行授权，但我无法在规则的访问规则中添加任何角色：

rules => [
    [                       
        'actions' => ['login', 'error'],
        'allow' => TRUE,                                              
    ]

在后端的siteController中。如果有办法做到这一点，我将感激不尽。

Answer 1

如果您只想拒绝访问会员并允许使用your_role，则可以

public function behaviors()
{
    return [
        'access' => [
            'class' => AccessControl::className(),
            'rules' => [
                [
                   'allow' => false,
                   'roles' => ['member']
                ],
                [

                    'allow' => true,
                    'roles' => ['your_role'],
                ],
            ],
        ],
        'verbs' => [
            'class' => VerbFilter::className(),
            'actions' => [
                'logout' => ['post'],
            ],
        ],
    ];
}

Answer 2

无需对每个后端控制器行为进行编码。您可以在$ config [＆＃39;组件＆＃39;]数组后端/ config / main.php的末尾添加相同的代码：

'as beforeRequest' => [
    'class' => \yii\filters\AccessControl::className(),
    'rules' => [
        [                       
            'actions' => ['login', 'error'],
            'allow' => true,                                              
        ],
        [
            'allow' => false,
            'roles' => ['member'],
        ],
    ],
    'denyCallback' => function () {
        return Yii::$app->response->redirect(['frontend']);
    },
],

Answer 3

试试这个，

public function behaviors()
{
    return [
        'verbs' => [
            'class' => VerbFilter::className(),
            'actions' => [
                'delete' => ['post'],
            ],
        ],
        'access' => [
            'class' => AccessControl::className(),
            // We will override the default rule config with the new  AccessRule class
            'ruleConfig' => [
                'class' => AccessRule::className(),
            ],
            'only' => ['index','create', 'update', 'delete'],
            'rules' => [
                [
                    'actions' => ['index','create'],
                    'allow' => true,
                    // Allow users, moderators and admins to create
                    'roles' => [
                        User::ROLE_USER,
                        User::ROLE_MODERATOR,
                        User::ROLE_ADMIN
                    ],
                ],
                [
                    'actions' => ['update'],
                    'allow' => true,
                    // Allow moderators and admins to update
                    'roles' => [
                        User::ROLE_MODERATOR,
                        User::ROLE_ADMIN
                    ],
                ],
                [
                    'actions' => ['delete'],
                    'allow' => true,
                    // Allow admins to delete
                    'roles' => [
                        User::ROLE_ADMIN
                    ],
                ],
            ],
        ],
    ];
}

如何拒绝角色成员的用户访问yii2中的后端？

3 个答案: