我使用访问控制过滤器进行访问管理,但无法完成一件事 – 例如,我如何才能让项目经理更新项目并禁止其他人？我通过matchCallback尝试了它,但在这种情况下,所有项目经理都可以更新任何项目,因为返回了TRUE.
类似的更常用的规则 – 如何允许用户使用ACF更新/删除他是作者的帖子？
- 'access' => [
- 'class' => AccessControl::className(),'only' => ['index','view','create','update','delete'],'rules' => [
- [
- 'actions' => ['update'],'allow' => true,'roles' => ['@'],'matchCallback' => function ($rule,$action) {
- return Yii::$app->user->identity->getProjectParticipants()
- ->one()->isManager(Yii::$app->user->identity->id);
- }
- ],],
它可以实现如下：
- use Yii;
- use yii\web\Controller;
- use yii\filters\AccessControl;
- class MyController extends Controller
- {
- ...
- public function behaviors()
- {
- return [
- 'access' => [
- 'class' => AccessControl::className(),'only' => ['update','rules' => [
- [
- 'actions' => ['update',$action) {
- if (Yii::$app->user->can('admin') || $this->isUserAuthor()) {
- return true;
- }
- return false;
- }
- ],];
- }
- protected function findModel($id)
- {
- if (($model = MyModel::findOne($id)) !== null) {
- return $model;
- } else {
- throw new NotFoundHttpException('The requested page does not exist.');
- }
- }
- protected function isUserAuthor()
- {
- return $this->findModel(Yii::$app->request->get('id'))->author->id == Yii::$app->user->id;
- }
- ...
- }
