charlesportwoodii /
yii2-api-rest-components
| Conditions | 7 |
| Paths | 4 |
| Total Lines | 23 |
| Code Lines | 11 |
| Lines | 0 |
| Ratio | 0 % |
| Changes | 0 | ||
| 1 | <?php |
||
| 27 | public function run(array $args = []) |
||
| 28 | {
|
||
| 29 | $method = strtolower(Yii::$app->request->method); |
||
| 30 | |||
| 31 | // If the requested HTTP method exists AND an ACL is defined for it, apply ACL rules |
||
| 32 | if (isset($this->acl[$method]) && method_exists(get_called_class(), $method)) {
|
||
| 33 | foreach ($this->acl[$method] as $role) {
|
||
| 34 | // @ is a special symbol meaning a user must be authenticated |
||
| 35 | if ($role === '@') {
|
||
| 36 | if (Yii::$app->user->isGuest) {
|
||
| 37 | throw new UnauthorizedHttpException; |
||
| 38 | } |
||
| 39 | } else {
|
||
| 40 | // All other items are considered to be a role or permissions within RBAC |
||
| 41 | if (!Yii::$app->user->can($role)) {
|
||
| 42 | throw new ForbiddenHttpException; |
||
| 43 | } |
||
| 44 | } |
||
| 45 | } |
||
| 46 | } |
||
| 47 | |||
| 48 | return parent::run($args); |
||
| 49 | } |
||
| 50 | } |
