search

dmstr / yii2-adminlte-asset

AdminLTE Asset Bundle for Backend Theme in Yii2 Framework
1.14k stars 425 forks source link

A security issue. #165

Closed Legion112 closed 6 years ago

Legion112 commented 6 years ago

If a user is a guest. And a user will try to go to the not existing controller or action user will get all admin actions.

image

To fix this, you can add to the top of view error the following code:

if (Yii::$app->user->isGuest) {
    $this->context->layout = 'main-login';
}
schmunk42 commented 6 years ago

How is this related to this asset-bundle?

Legion112 commented 6 years ago

I got that problem once and wanted to share that. I think if in default, not login user cannot see the admin layout it will be good. Sorry for later answer.

schmunk42 commented 6 years ago

Which files of this extension are you using? Did you read https://github.com/dmstr/yii2-adminlte-asset#quick-start?

Legion112 commented 6 years ago

I had read all documentation. I am using Advanced Application Template. I extracted those files to the folder "frontend/views/" according to documentation.

schmunk42 commented 6 years ago

Logic should not be put into views, I think your problem is specific to your application setup. The layout and views we provide are just examples, which need to be adjusted to your needs.

I don't think we can do much about it.