UserController access controll

[monghuz]

I think there is a big security problem, that the full userController has not access control. In this case anybody could change all of the users' log-in name and password.

I inserted the following to require user to log-in

// name space
use yii\filters\AccessControl;
// access controll
'access' => [
            'class' => AccessControl::className(),
                'rules' => [
                       [
                           'actions' => ['index','view','update','delete','create'],
                           'allow' => true,
                           'roles' => ['@'],
                      ],
                 ],
            ],

[robregonm]

Thanks for reporting and contributing a fix.