YII提出的安全Ajax请求

Question

i'm currently writing a Application based on YII.
My action for index:

  public function actionIndex() {
    $data = array();
    $data['server'] = Server::model()->findByPk(1);
    $data['dataProvider'] = new CActiveDataProvider('ServerUserPermission', array('criteria' => array('condition' => 'serverID=:id', 'params' => array(':id' => 1))));
    $this->render('index', $data);
}

my ajax action:

public function actionAddPermission($server) {
    if(Util::checkServerPower($server, Permission::MODIFY_SERVER)) {
        $perm = new ServerUserPermission;
        $perm->userID = 1;
        $perm->serverID = $server;
        $perm->power = 10;
        try {
            if ($perm->save()) {
                echo "OK";
            } else {
                echo Util::print_r($perm->getErrors());
            }
        } catch (Exception $e) {
            echo 'Critical Error Code: ' . $e->getCode();
        }
    } else {
        echo 'No Permissions';
    }
}

My view links to the addPermission action by using a button:

echo CHtml::ajaxButton("Insert New Player", array('addPermission', 'server' => $server->serverID), array('success'=>'refresh')); 

My function Util::checkServerPower(...) checks the current User of the Application. Consequence: Ajax requests in YII are handled by an Guest AuthWeb User, but i need to check whether the User is actually allowed to add permissions or not. I currently cannot think of a secured solution to protect malicious data send by other guests or not. Is it somehow possible to get the (server-side) userID of the Ajax-call?

Thanks anyway sincerly

Answer 1

I would do it by using the built in access control and extending CWebUser. It might seem lengthy but I think it's a clean solution. (We already have Yii::app()->user->isGuest and the like, so why not check all permissions here?)

1) Activate the access control filter.

(In one controller or in /components/controller.php for all your controllers at once)

public function filters()
{
    return array( 'accessControl' ); // Tell Yii to use access rules for this controller
}

2) Add an access rule

In the concerned controller. (Sorry, I didn't bother with your index-action.)

public function accessRules()
{
    return array(
        [
            'allow', 
            'actions'=>['AddPermission'], 
            'expression'=>'$user->has(Permission::MODIFY_SERVER)'
        ],
        ['deny'],  // Deny everything else. 
    );
}

3) Extend CWebUser

// components/WebUser.php
class WebUser extends CWebUser {
    public function has( $permission)
    {
            // Check database for permissions using Yii::app()->user->id
            ...
    }
}

4) Configure your app to use your new WebUser instead of CWebUser

// config/main.php
'components'=>[
    'user'=>[
        'class' => 'WebUser',
    ],
],