CAccessRule

Property Details

actions property

public array $actions;

list of action IDs that this rule applies to. The comparison is case-insensitive. If no actions are specified, rule applies to all actions.

allow property

public boolean $allow;

whether this is an 'allow' rule or 'deny' rule.

controllers property

public array $controllers;

list of controller IDs that this rule applies to. The comparison is case-insensitive.

deniedCallback property (available since v1.1.11)

public mixed $deniedCallback;

the denied method callback that will be called once the access is denied. It replaces the behavior that shows an error message. It can be a valid PHP callback including class method name (array(ClassName/Object, MethodName)), or anonymous function (PHP 5.3.0+). For more information, on different options, check

expression property

public string $expression;

a PHP expression whose value indicates whether this rule should be applied. In this expression, you can use $user which refers to Yii::app()->user. The expression can also be a valid PHP callback, including class method name (array(ClassName/Object, MethodName)), or anonymous function (PHP 5.3.0+). The function/method signature should be as follows:

function foo($user, $rule) { ... }

ips property

public array $ips;

IP patterns.

message property (available since v1.1.1)

public string $message;

the error message to be displayed when authorization is denied by this rule. If not set, a default error message will be displayed.

roles property

public array $roles;

list of roles this rule applies to. For each role, the current user's CWebUser::checkAccess method will be invoked. If one of the invocations returns true, the rule will be applied. Note, you should mainly use roles in an "allow" rule because by definition, a role represents a permission collection.

users property

public array $users;

list of user names that this rule applies to. The comparison is case-insensitive. If no user names are specified, rule applies to all users.

verbs property

public array $verbs;

list of request types (e.g. GET, POST) that this rule applies to.

Method Details

isActionMatched() method

protected boolean isActionMatched(CAction $action)

protected function isActionMatched($action)
{
    return empty($this->actions) || in_array(strtolower($action->getId()),$this->actions);
}

isControllerMatched() method

protected boolean isControllerMatched(CController $controller)

protected function isControllerMatched($controller)
{
    return empty($this->controllers) || in_array(strtolower($controller->getUniqueId()),$this->controllers);
}

isExpressionMatched() method

protected boolean isExpressionMatched(IWebUser $user)

protected function isExpressionMatched($user)
{
    if($this->expression===null)
        return true;
    else
        return $this->evaluateExpression($this->expression, array('user'=>$user));
}

isIpMatched() method

protected boolean isIpMatched(string $ip)

protected function isIpMatched($ip)
{
    if(empty($this->ips))
        return true;
    foreach($this->ips as $rule)
    {
        if($rule==='*' || $rule===$ip || (($pos=strpos($rule,'*'))!==false && !strncmp($ip,$rule,$pos)))
            return true;
    }
    return false;
}

isRoleMatched() method

protected boolean isRoleMatched(IWebUser $user)

protected function isRoleMatched($user)
{
    if(empty($this->roles))
        return true;
    foreach($this->roles as $key=>$role)
    {
        if(is_numeric($key))
        {
            if($user->checkAccess($role))
                return true;
        }
        else
        {
            if($user->checkAccess($key,$role))
                return true;
        }
    }
    return false;
}

isUserAllowed() method

public integer isUserAllowed(CWebUser $user, CController $controller, CAction $action, string $ip, string $verb)

public function isUserAllowed($user,$controller,$action,$ip,$verb)
{
    if($this->isActionMatched($action)
        && $this->isUserMatched($user)
        && $this->isRoleMatched($user)
        && $this->isIpMatched($ip)
        && $this->isVerbMatched($verb)
        && $this->isControllerMatched($controller)
        && $this->isExpressionMatched($user))
        return $this->allow ? 1 : -1;
    else
        return 0;
}

Checks whether the Web user is allowed to perform the specified action.

isUserMatched() method

protected boolean isUserMatched(IWebUser $user)

protected function isUserMatched($user)
{
    if(empty($this->users))
        return true;
    foreach($this->users as $u)
    {
        if($u==='*')
            return true;
        elseif($u==='?' && $user->getIsGuest())
            return true;
        elseif($u==='@' && !$user->getIsGuest())
            return true;
        elseif(!strcasecmp($u,$user->getName()))
            return true;
    }
    return false;
}

isVerbMatched() method

protected boolean isVerbMatched(string $verb)

protected function isVerbMatched($verb)
{
    return empty($this->verbs) || in_array(strtolower($verb),$this->verbs);
}