我在谷歌上搜索、阅读教程、博客并进行了大量实验。因此,我能够定义对控制器操作的基于角色的访问。一切都很好。我想问的是,如何编写规则来显示、编辑和删除用户自己的帖子?
默认情况下,它显示所有帖子。然而,我们可以把数据提供者的标准来显示自己的帖子。但是我该如何控制CRUD呢??请帮帮我。我的密码如下。
public function accessRules() {
return array(
array('allow', // allow all users to perform 'index' and 'view' actions
'actions' => array('index', 'view'),
'users' => array('*'),
),
array('allow', // allow authenticated user to perform 'create' and 'update' actions
'actions' => array('create', 'update'),
'expression' => 'Yii::app()->controller->HaveAccess()',
//'users' => array('@'),
),
array('allow', // allow admin user to perform 'admin' and 'delete' actions
'actions' => array('admin', 'delete'),
'expression' => 'Yii::app()->controller->HaveAccess()',
),
array('deny', // deny all users
'users' => array('*'),
),
);
}
用于后期显示:
public function actionIndex() {
$dataProvider = new CActiveDataProvider('Advertisment');
if (!$this->IsAdmin()) {
$dataProvider = new CActiveDataProvider('Advertisment', array(
'criteria' => array(
'condition' => 'added_by='.$this->userId,
'order' => 'id DESC',
),
'pagination' => array(
'pageSize' => 20,
),
));
}
$this->render('index', array(
'dataProvider' => $dataProvider,
));
}
要将更新和删除操作限制为用户自己的帖子,您必须检查控制器操作内部的权限(这在控制器的accessRules
afaik中是不可能的,因为在评估accessRules
时,要检查权限的帖子的id是未知的。(
示例:
public function actionUpdate($id){
$model = $this->loadModel($id);
if($model->added_by === $this->userId){
// your code here
}else
throw new CHttpException(401,'You are not authorized to edit this post.');
}
使用范围:
http://www.yiiframework.com/doc/api/1.1/CActiveRecord#scopes-详细
在您的模型中:
public function scopes()
{
return array(
'own'=>array(
'condition'=>'userid=' . Yii::app()->user->id,
),
);
}
然后像这样选择你的数据:
Post::model()->own()->findAll();
我能想到的唯一方法是首先修改激活操作的链接:更新、删除、查看以发送added_by
字段和帖子的id(默认情况下发送帖子id(。然后在'expression'
中,您可以检查added_by
是否与您的userId
匹配。以下是视图示例(假设您在问题中说显示时是指视图(:
-
accessRule修改,为此,请确保在评估accessRules之前在
$this->userId
中有一个值,这可以在init()
方法中完成:return array( array('allow', // allow all users to perform 'index' actions 'actions' => array('index'), 'users' => array('*'), ), array('allow', // allow authenticated user to perform 'create' and 'update' actions 'actions' => array('create', 'admin'), 'expression' => 'Yii::app()->controller->HaveAccess()', //'users' => array('@'), ), array('allow', // allow admin user to perform 'admin' and 'delete' actions 'actions' => array('view', 'delete', 'update'), 'expression' => 'Yii::app()->controller->HaveAccess() && ($_REQUEST["added_by"]=='.$this->userId.")", ), array('deny', // deny all users 'users' => array('*'), ), );
-
视图修改以将
added_by
id添加到url参数。假设您有默认生成的crud视图,即index.php、_view.php、_form.php、_viewphp、update.php等,其中_view.php有链接到帖子的详细视图,这也是index.php中列表视图的itemView。在这里,我们做了一些更改(_view.php(:<div class="view"> <b><?php echo CHtml::encode($data->getAttributeLabel('id')); ?>:</b> <?php echo CHtml::link(CHtml::encode($data->id), array('view', 'id'=>$data->id,'added_by'=>$data->added_by)); ?> <br /> <b><?php echo CHtml::encode($data->getAttributeLabel('someattribute')); ?>:</b> <?php echo CHtml::encode($data->someattribute); ?> <br /> <!-- more attributes--> </div>
-
您必须修改删除、更新操作的链接,才能传递added_by字段。