CAccessControlFilter

All Packages | Properties | Methods

CAccessControlFilter performs authorization checks for the specified actions.

By enabling this filter, controller actions can be checked for access permissions. Only when the user is allowed by one of the security rules, will he be able to access the action.

To specify the access rules, set the rules property, which should be an array of the rules. Each rule is specified as an array of the following structure:

array(
  'allow',  // or 'deny'
  // optional, list of action names (case insensitive) that this rule applies to
  'actions'=>array('edit, delete'),
  // optional, list of usernames (case insensitive) that this rule applies to
  // Use * to represent all users, ? guest users, and @ authenticated users
  'users'=>array('thomas', 'kevin'),
  // optional, list of roles that this rule applies to
  'roles'=>array('admin', 'editor'),
  // optional, list of IP address/patterns that this rule applies to
  // e.g. 127.0.0.1, 127.0.0.*
  'ips'=>array('127.0.0.1'),
  // optional, list of request types (case insensitive) that this rule applies to
  'verbs'=>array('GET', 'POST'),
  // optional, a PHP expression whose value indicates whether this rule applies
  // This option is available since version 1.0.3.
  'expression'=>'!$user->isGuest && $user->level==2',
)