how to restrict Yii2 url view get request -
here explain problem clearly, how can restrict request through url in yii2
this url:
http://localhost/school/backend/web/index.php?r=user%2fview&id=42
here if change view id = 43
, showing data of id
43
, don't want data through url. want restrict request through url or
how can encrypt id
value
if change url manager to
'urlmanager' => [ 'enableprettyurl' => true, 'showscriptname' => false, ],
then getting url below
http://localhost/school/admin/user/view?id=42
here if change id=43
getting data of id
43
how can this. appreciated.
assuming current scenario (let me know if misunderstood something):
company
can see/add/edit people
(that part did). now, each company
can actions on own people
, not others.
one solution:
in company
model must have like:
public function getpeoples() { return $this->hasmany(people::classname(), ['id_people' => 'id']); }
you can add function return ids of people
:
public function getpeoplesids() { return arrayhelper::map($this->peoples, 'id', 'id'); }
now in controler must rewrite beforeaction
function:
public function beforeaction($action){ $id = yii::$app->request->get('id'); if($id && !yii::$app->user->isguest) { $user = user::findone(yii::$app->user->getid()); $company = //do logic company's user if (! in_array($id, $company->peoplesids) { throw new notfoundhttpexception('the requested page not exist.'); } } return parent::beforeaction($action); }
with that, checking $id
before runing each action.
Comments
Post a Comment