Restricting Access to Module

[mtangoo]

How do I suppose to restrict that? I know I can try the Application beforeAction but its a long route. I believe module should have a way of restricting users. I suggest to add property that limits by IDs or role something like

if(id_is_in_admin_array or role_is_in_roles_array)
{
    allow_access
}
else
    deny_access

what do you think?

[mdmunir]

I think not. "Restricting access" should be set via RBAC it self.

[mtangoo]

I mean restricting access to RBAC Module itself. for example, I can now access arbitrarily url localhost/admin Not sure if you get my point

[mdmunir]

• Create role and permission with admin/role and admin/permission.
• Register routes via admin/route.
• Assign route to role or permission.
• Assign role (or permission) to user.
• Apply access control guide

[mtangoo]

thanks!

[mtangoo]

I have added pull request to clarify what I mean

https://github.com/mdmsoft/yii2-admin/pull/105

[mtangoo]

updated PR

[mtangoo]

I have got a problem. I want to apply access ONLY to admin module not whole of site controllers. How do I do that?

[mdmunir]

attach filter to module

'modules'=>[
    'admin'=>[
        'class'=>'mdm\admin\Module',
        'as access'=>[
            'class'=>'mdm\admin\components\AccessControl'
        ],
    ]
]

[mtangoo]

That was it!

[unglevan]

Assign route to role or permission.

how can i assign?

[mtangoo]

assign what?