如何拒绝具有角色成员的用户访问 yii2 中的后端？答案

【问题标题】：How can I deny access for users withe role member from access the backend in yii2?如何拒绝具有角色成员的用户访问 yii2 中的后端？
【发布时间】：2023-04-04 06:20:01
【问题描述】：

我想限制角色成员的用户访问后端。我正在使用yii2 高级的默认RBAC 进行授权，但是我无法在规则的访问规则中添加任何角色：

rules => [
    [                       
        'actions' => ['login', 'error'],
        'allow' => TRUE,                                              
    ]

在后端的 siteController 中。如果有任何方法可以做到这一点，我将不胜感激。

【问题讨论】：

标签： php yii2 authorization access-control rbac

【解决方案1】：

试试这个，

public function behaviors()
{
    return [
        'verbs' => [
            'class' => VerbFilter::className(),
            'actions' => [
                'delete' => ['post'],
            ],
        ],
        'access' => [
            'class' => AccessControl::className(),
            // We will override the default rule config with the new  AccessRule class
            'ruleConfig' => [
                'class' => AccessRule::className(),
            ],
            'only' => ['index','create', 'update', 'delete'],
            'rules' => [
                [
                    'actions' => ['index','create'],
                    'allow' => true,
                    // Allow users, moderators and admins to create
                    'roles' => [
                        User::ROLE_USER,
                        User::ROLE_MODERATOR,
                        User::ROLE_ADMIN
                    ],
                ],
                [
                    'actions' => ['update'],
                    'allow' => true,
                    // Allow moderators and admins to update
                    'roles' => [
                        User::ROLE_MODERATOR,
                        User::ROLE_ADMIN
                    ],
                ],
                [
                    'actions' => ['delete'],
                    'allow' => true,
                    // Allow admins to delete
                    'roles' => [
                        User::ROLE_ADMIN
                    ],
                ],
            ],
        ],
    ];
}

【讨论】：

【解决方案2】：

无需对每个后端控制器行为进行编码。您可以将相同的代码添加到 $config['components'] 数组 backend/config/main.php 的末尾：

'as beforeRequest' => [
    'class' => \yii\filters\AccessControl::className(),
    'rules' => [
        [                       
            'actions' => ['login', 'error'],
            'allow' => true,                                              
        ],
        [
            'allow' => false,
            'roles' => ['member'],
        ],
    ],
    'denyCallback' => function () {
        return Yii::$app->response->redirect(['frontend']);
    },
],

【讨论】：

【解决方案3】：

如果你只想拒绝访问成员并允许你的角色，你可以

public function behaviors()
{
    return [
        'access' => [
            'class' => AccessControl::className(),
            'rules' => [
                [
                   'allow' => false,
                   'roles' => ['member']
                ],
                [

                    'allow' => true,
                    'roles' => ['your_role'],
                ],
            ],
        ],
        'verbs' => [
            'class' => VerbFilter::className(),
            'actions' => [
                'logout' => ['post'],
            ],
        ],
    ];
}

【讨论】：