Yii2 访问控制规则不拒绝访客

Question

这是我用于允许经过身份验证的用户执行某些操作的代码

        'access' => [
            'class' => AccessControl::className(),
            'only' => ['logout', 'signup'],
            'rules' => [
                [
                    'actions' => ['show'],
                    'allow' => true,
                    'roles' => ['?'],
                ],
                [
                    'actions' => ['create', 'edit'],
                    'allow' => true,
                    'roles' => ['@'],
                ],
            ],
        ],

但此规则允许客人进入创建操作。 Afaik，默认情况下必须拒绝来宾用户。我做错了什么？

Answer 1

将您的代码修改为：

 'access' => [
            'class' => AccessControl::className(),
            'only' => ['logout', 'signup', 'create', 'edit'],
            'rules' => [
                [
                    'actions' => ['show'],
                    'allow' => true,
                    'roles' => ['?'],
                ],
                [
                    'actions' => ['create', 'edit'],
                    'allow' => true,
                    'roles' => ['@'],
                ],
            ],
        ],

只有数组应包含此过滤器应应用到的操作 ID 列表。