fix backend user access, fix payout cart account change

backend/controllers/ContractController.php

@@ -15,20 +15,27 @@ use backend\models\ContractRequestSearch;
 
 /**
  * ContractController implements the CRUD actions for Contract model.
+ * 
+ * TODO: FIX CONTROLLER
  */
 class ContractController extends Controller
 {
-    public function behaviors()
-    {
-        return [
-            'verbs' => [
-                'class' => VerbFilter::className(),
-                'actions' => [
-                    'delete' => ['post'],
-                ],
-            ],
-        ];
-    }
+	public function behaviors()	{
+		return [
+				'access' => [
+						'class' => \yii\filters\AccessControl::className(),
+						'rules' => [
+								// allow authenticated users
+								[
+										'actions' => [ ],
+										'allow' => true,
+										'roles' => ['admin','employee','reception'],
+								],
+								// everything else is denied
+						],
+				],
+		];
+	}
 
     /**
      * Lists all Contract models.