建个企业营销型网站,网络运营主要工作内容,网站还能赚钱吗,网站开发学校 优帮云今天遇到了权限控制的问题#xff0c;后台不同级别的用户登录后看到的内容是不一样的。网上查了下#xff0c;说Yii中有自带的RBAC权限控制#xff0c;大概看了下#xff0c;没理解太明白。然后就是采用filter进行过滤验证#xff0c;看着这个还不错。下面简单说下我是我怎… 今天遇到了权限控制的问题后台不同级别的用户登录后看到的内容是不一样的。网上查了下说Yii中有自带的RBAC权限控制大概看了下没理解太明白。然后就是采用filter进行过滤验证看着这个还不错。下面简单说下我是我怎么用的不对的地方希望大神们给予指教。1.在cp_user表里增加了一个level字段代表用户的级别1代表管理员admin2代表普通用户common_user2.在components的UserIdentity.php里添加用户角色class UserIdentity extends CUserIdentity
{/*** Authenticates a user.* The example implementation makes sure if the username and password* are both demo.* In practical applications, this should be changed to authenticate* against some persistent user identity storage (e.g. database).* return boolean whether authentication succeeds.*/public function authenticate(){$usernamestrtolower($this-username);$userUser::model()-find(LOWER(username)?,array($username));if($usernull)$this-errorCodeself::ERROR_USERNAME_INVALID;else if($user-password!$this-password)$this-errorCodeself::ERROR_PASSWORD_INVALID;else{$this-username$user-username;$this-setState(roles, $user-level1?admin:commen_user); //添加用户角色$this-errorCodeself::ERROR_NONE;}return $this-errorCodeself::ERROR_NONE;}}上面这句$this-setState(roles,$user-level1?admin:commen_user)非常重要这里表示添加了一个用户的角色3.重写CWebUser,放在components文件夹下(WebUser.php)class WebUser extends CWebUser
{/*** Overrides a Yii method that is used for roles in controllers (acce***ules).** param string $operation Name of the operation required (here, a role).* param mixed $params (opt) Parameters for this operation, usually the object to access.* return bool Permission granted?*/public function checkAccess($operation, $paramsarray()){if (empty($this-id)) {// Not identified no rightsreturn false;}$role $this-getState(roles);if ($role admin) { //管理员return true; // admin role has access to everything}// allow access if the operation request is the current users rolereturn ($operation $role);}
}4.控制器里修改public function filters(){return array(accessControl, // perform access control for CRUD operationspostOnly delete, // we only allow deletion via POST request);}/*** Specifies the access control rules.* This method is used by the accessControl filter.* return array access control rules*/public function acce***ules(){return array(array(allow, // allow all users to perform index and view actionsactionsarray(index,view,login,passwordupdate),usersarray(*),),array(allow, // allow authenticated user to perform create and update actionsactionsarray(create,update,getuser,delete),rolesarray(admin),//表示只有角色为admin的用户才能访问),array(deny, // deny all usersusersarray(*),),);}5.修改配置文件main.phpuserarray(// enable cookie-based authenticationclassWebUser,allowAutoLogintrue,loginUrl array(/user/login),),6.视图中如何用array(namestatus, typehtml, valueCustomer::showStatus($data-status, $data-id),visible Yii::app()-user-checkAccess(admin)),array(nameemployee_id, typehtml, valueCustomer::isDivided($data-employee_id, $data-id),visible Yii::app()-user-checkAccess(admin)),原理当用户登录的时候获取用户的level字段并添加相应的角色若是1则该用户为admin否则就是common_user.然后重写CWebUser中的checkAccess方法如果是admin则有权操作相应的权限。最后在控制器里rules里定义规则有一个roles属性我们给它设置为admin表示只有角色为admin的才能进行相关的action操作。 转载于:https://blog.51cto.com/php2013/1363163
