CAccessControlFilter

All Packages | Properties | Methods

CAccessControlFilter performs authorization checks for the specified actions.

By enabling this filter, controller actions can be checked for access permissions. Only when the user is allowed by one of the security rules, will he be able to access the action.

To specify the access rules, set the rules property, which should be an array of the rules. Each rule is specified as an array of the following structure:

array(
  'allow',  // or 'deny'
  // optional, list of action IDs (case insensitive) that this rule applies to
  'actions'=>array('edit', 'delete'),
  // optional, list of controller IDs (case insensitive) that this rule applies to
  // This option is available since version 1.0.3.
  'controllers'=>array('post', 'admin/user'),
  // optional, list of usernames (case insensitive) that this rule applies to
  // Use * to represent all users, ? guest users, and @ authenticated users
  'users'=>array('thomas', 'kevin'),
  // optional, list of roles (case sensitive!) that this rule applies to.
  'roles'=>array('admin', 'editor'),
  // optional, list of IP address/patterns that this rule applies to
  // e.g. 127.0.0.1, 127.0.0.*
  'ips'=>array('127.0.0.1'),
  // optional, list of request types (case insensitive) that this rule applies to
  'verbs'=>array('GET', 'POST'),
  // optional, a PHP expression whose value indicates whether this rule applies
  // This option is available since version 1.0.3.
  'expression'=>'!$user->isGuest && $user->level==2',
  // optional, the customized error message to be displayed
  // This option is available since version 1.1.1.
  'message'=>'Access Denied.',
)