在Yii2中拒绝未登录用户的视图站点

Question

I have this code in Yii2, where I define users (in models/Users.php):

<?php

namespace app\models;

class User extends \yii\base\Object implements \yii\web\IdentityInterface
{
    public $id;
    public $username;
    public $password;
    public $authKey;
    public $accessToken;

    private static $users = [
        '100' => [
            'id' => '100',
            'username' => 'admin',
            'password' => 'my_password',
            'authKey' => 'my_authkey',
            'accessToken' => 'my_accessyoken',

And this is my code in SiteController.php:

<?php

namespace app\controllers;

use Yii;
use yii\filters\AccessControl;
use yii\web\Controller;
use yii\filters\VerbFilter;
use app\models\LoginForm;
use app\models\ContactForm;

class SiteController extends Controller
{
    public function behaviors()
    {
        return [
            'access' => [
                'class' => AccessControl::className(),
                'only' => ['logout'],
                'rules' => [
                    [
                        'actions' => ['logout'],
                        'allow' => true,
                        'roles' => ['@'],
                    ],
                ],
            ],
            'verbs' => [
                'class' => VerbFilter::className(),
                'actions' => [
                    'logout' => ['post'],
                ],
            ],
        ];
    }

The problem is:

1) Right now, visitors can view any page in my website without being logged. Which is the easiest way to force users to be logged in to see any pages?

2) How can I let only specific users view some private pages?

I've already tried some options with no luck...

Thanks!

Answer 1

Well, you are preventing anybody that is not logged in to access your logout page. But you are not preventing guests from accessing any other page in the controller. You can do this: https://github.com/yiisoft/yii2-app-advanced/blob/master/frontend/controllers/SiteController.php

see how they defined that only logged in people have access to logout and only guests can signup.

Regarding the second part, only allow certain logged in customers to access some parts, you can always create your own filter: http://www.yiiframework.com/doc-2.0/guide-structure-filters.html or you can try just overwriting beforeAction of the controller.