我使用YII框架，并使用accessRules和filter限制对某些页面的访问。关于如何在没有DB的情况下限制访问，或者如何在总是获取访问变量的情况下进行访问，有很多信息，但我如何才能只从数据库中获取角色，并在控制器中使用访问过滤器。
public function filters()
{
return array(
'accessControl', // perform access control for CRUD operations
'postOnly + delete', // we only allow deletion via POST request
);
}
public function accessRules()
{
return array(
array('allow', // allow authenticated user to perform 'create' and 'update' actions
'actions'=>array('create','update', 'view', 'index'),
'users'=>array('@'),
),
array('allow', // allow admin user to perform 'admin' and 'delete' actions
'actions'=>array('admin','delete', 'view', 'index'),
'users'=>array('admin'),
),
array('deny', // deny all users
'users'=>array('*'),
),
);
}
您是否已经建立了基于角色的层次结构？如果未检查此yii文档：http://www.yiiframework.com/doc/guide/1.1/en/topics.auth如果是这样的话，就这么简单：
public function accessRules()
{
return array(
array('allow', // allow authenticated user to perform 'create' and 'update' actions
'actions'=>array('create','update', 'view', 'index'),
'roles'=>array('role1'),
),
array('allow', // allow admin user to perform 'admin' and 'delete' actions
'actions'=>array('admin','delete', 'view', 'index'),
'roles'=>array('role2'),
),
array('deny', // deny all users
'users'=>array('*'),
),
);
}
中显示'postOnly + delete'的注释行
`public function filters()
{
return array(
'accessControl', // perform access control for CRUD operations
//'postOnly + delete', // we only allow deletion via POST request
);
}
`这将允许删除用户。