YII2 How to allow debug/default/toolbar in accesscontrol

问题

I have the following configuration in the web.php file to force users to login first before using the app.

'as access' => [
        'class' => \yii\filters\AccessControl::className(), //AccessControl::className(),
        'rules' => [
            [
                'actions' => ['login', 'error'],
                'allow' => true,
            ],
            [
                'actions' => ['logout', 'index'], // add all actions to take guest to login page
                'allow' => true,
                'roles' => ['@'],
            ],

        ],
    ],

However I get a Forbidden (#403) error in the http://localhost/yii2/debug/default/toolbar?tag=58759099581f2

How to allow in that in the rules?

回答1:

First of all, this config is incorrect. This part:

[
    'actions' => ['logout', 'index'], // add all actions to take guest to login page
    'allow' => true,
    'roles' => ['@'],
],

will additionally allow only logout and index actions to authenticated users. It needs to be changed to:

[
    'allow' => true,
    'roles' => ['@'],
],

to allow access to the entire site. Then you can customize access further in AccessControl or actions of specific controllers. So debug is not the only forbidden page in your case.

I think it was copy pasted from this answer to related question here on SO.

And by the way debug is already enabled in application config in basic app:

if (YII_ENV_DEV) {
    // configuration adjustments for 'dev' environment
    $config['bootstrap'][] = 'debug';
    $config['modules']['debug'] = [
        'class' => 'yii\debug\Module',
        // uncomment the following to add your IP if you are not connecting from localhost.
        //'allowedIPs' => ['127.0.0.1', '::1'],
    ];

    // Below Gii is enabled too, code is omitted for brevity
}

So when user is authenticated, you will have access to debug module without any problems.

Note: With this configuration login and error actions of every controller are allowed to non-authenticated users. Be careful with that. There is a chance of actions with similar names exist in other controllers.

Update: Actually you can go further and make this solution more flexible with $matchCallback:

'as access' => [
    'class' => \yii\filters\AccessControl::className(),
    'rules' => [
        [
            'matchCallback' => function ($rule, $action) {
                $allowedControllers = [
                    'debug/default',
                ];
                $allowedActions = [
                    'site/login',
                    'site/error',
                ];
                $isAllowedController = in_array($action->controller->uniqueId, $allowedControllers);
                $isAllowedAction = in_array($action->uniqueId, $allowedActions);

                return $isAllowedController || $isAllowedAction;
            },
            'allow' => true,
        ],
        [
            'allow' => true,
            'roles' => ['@'],
        ],
    ],
],

Place fully allowed controllers in $allowedControllers list (prefix it with module name if it's inside a module) to allow them completetely (allow all actions).
Place allowed actions in $allowedActions list (prefix it with controller name and with module name if it belongs to a module).

That way you can have full access to debug module on local server on every page (including login and error) which can be useful.

Also this prevents from action names coincidence from different modules / controllers.

来源：https://stackoverflow.com/questions/41581629/yii2-how-to-allow-debug-default-toolbar-in-accesscontrol

标签

yii2

yii2-basic-app