fix rbac

parent 9c2c847d
...@@ -27,26 +27,34 @@ class RoleAdminController extends \common\components\AdminController ...@@ -27,26 +27,34 @@ class RoleAdminController extends \common\components\AdminController
public function actionChangeaccess() { public function actionChangeaccess() {
if(!empty($_GET['user_id']) && !empty($_GET['item']) && !empty($_GET['op'])) { if(!empty($_GET['user_id']) && !empty($_GET['item']) && !empty($_GET['op']))
{
$op = $_GET['op']; $op = $_GET['op'];
$user_id = $_GET['user_id']; $user_id = $_GET['user_id'];
$item = $_GET['item']; $item = $_GET['item'];
$r = \yii::$app->authManager->getPermission($item); $r = \yii::$app->authManager->getPermission($item);
if($op == 'assign')
if(!\yii::$app->authManager->checkAccess($user_id, $item)) {
if($op == 'assign')
{
if(!\yii::$app->authManager->checkAccess($user_id, $item))
{
\yii::$app->authManager->assign($r, $user_id); \yii::$app->authManager->assign($r, $user_id);
echo 'assigned'; echo 'assigned';
die(); die();
} }
}
else else
if(\yii::$app->authManager->checkAccess($user_id, $item)) { {
if(\yii::$app->authManager->checkAccess($user_id, $item))
{
\yii::$app->authManager->revoke($r, $user_id); \yii::$app->authManager->revoke($r, $user_id);
echo 'deassigned'; echo 'deassigned';
die(); die();
} }
} }
} }
}
public function actionCreate() public function actionCreate()
{ {
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment