add role checking to controllers

This commit is contained in:
2015-11-05 17:24:09 +01:00
parent 43d5598f23
commit cc83ccf761
39 changed files with 362 additions and 78 deletions

View File

@@ -53,7 +53,7 @@ class AdminMenuStructure{
$items[] = ['label' => 'Beszerzések', 'url' => ['/procurement/index'] ];
$items[] = ['label' => 'Vendégek', 'url' => ['/customer/index'] ];
$items[] = ['label' => 'Bérletkártyák', 'url' => ['/card/index'] ];
$items[] = ['label' => 'Pénznem', 'url' => ['/currency/index'] ];
// $items[] = ['label' => 'Pénznem', 'url' => ['/currency/index'] ];
$items[] = ['label' => 'Tranzakciók', 'url' => ['/transfer/index' , 'TransferSearch[start]' =>$today,'TransferSearch[end]' => $tomorrow ] ];
$items[] = ['label' => 'Kassza müveletek', 'url' => ['/account-state/index'] ];

View File

@@ -14,6 +14,32 @@ use yii\filters\VerbFilter;
*/
class AccountController extends \backend\controllers\BackendController
{
public function behaviors()
{
return [
'access' => [
'class' => \yii\filters\AccessControl::className(),
'rules' => [
// allow authenticated users
[
'actions' => [ 'index','view' ],
'allow' => true,
'roles' => ['employee','admin','reception'],
],
// allow authenticated users
[
'actions' => [ 'create', 'update'],
'allow' => true,
'roles' => ['admin'],
],
// everything else is denied
],
],
];
}
/**
* Lists all Account models.

View File

@@ -28,7 +28,7 @@ class BackendController extends Controller
[
'actions' => ['create','index','view','update'],
'allow' => true,
'roles' => ['@'],
'roles' => ['admin','employee','reception'],
],
// everything else is denied
],

View File

@@ -47,7 +47,7 @@ class CollectionController extends \backend\controllers\BackendController
$searchModel->accounts = Account::read();
$searchModel->accountMap = Account::toAccaountMap($searchModel->accounts);
$searchModel->users = User::find()->all( );
$searchModel->users = User::read();
$dataProvider = $searchModel->search(Yii::$app->request->queryParams);
$searchModel->searchTotal();

View File

@@ -14,6 +14,30 @@ use yii\filters\VerbFilter;
*/
class DiscountController extends \backend\controllers\BackendController
{
public function behaviors()
{
return [
'access' => [
'class' => \yii\filters\AccessControl::className(),
'rules' => [
// allow authenticated users
[
'actions' => [ 'index','view' ],
'allow' => true,
'roles' => ['admin','employee','reception'],
],
[
'actions' => ['create','update'],
'allow' => true,
'roles' => ['admin' ],
],
// everything else is denied
],
],
];
}
/**
* Lists all Discount models.

View File

@@ -11,6 +11,7 @@ use yii\filters\VerbFilter;
use common\models\Warehouse;
use common\models\Product;
use common\models\User;
use common\components\Helper;
/**
* ProcurementController implements the CRUD actions for Procurement model.
@@ -118,14 +119,21 @@ class ProcurementController extends \backend\controllers\BackendController
$transaction->commit();
} else {
$transaction->rollback();
Helper::flash('error', "Hiba történt!");
throw new NotFoundHttpException( Yii::t('common/procurement' ,'Failed to fullfill procurement.' ));
}
Helper::flash('success', Yii::t('backend/procurement', 'Beszerzés mentve'));
} catch (\Exception $e) {
$transaction->rollback();
throw $e;
}
return $this->redirect(['index' ]);
if ( isset($_POST['_next'])){
return $this->redirect(['create' ]);
}else{
return $this->redirect(['index' ]);
}
} else {
return $this->render('create', [
'model' => $model,

View File

@@ -55,7 +55,7 @@ class ProductController extends \backend\controllers\BackendController
$model = new Product();
$model->stock = 0;
$model->status = Product::STATUS_ACTIVE;
$accounts = Account::readAccounts(null);
$accounts = Account::read(null);
$categories = ProductCategory::read(null);
if ($model->load(Yii::$app->request->post()) && $model->save()) {

View File

@@ -15,6 +15,31 @@ use common\models\Account;
*/
class TicketTypeController extends \backend\controllers\BackendController
{
public function behaviors()
{
return [
'access' => [
'class' => \yii\filters\AccessControl::className(),
'rules' => [
// allow authenticated users
[
'actions' => [ 'index','view'],
'allow' => true,
'roles' => ['admin','employee','reception'],
],
[
'actions' => ['create' , 'update'],
'allow' => true,
'roles' => ['admin' ],
],
// everything else is denied
],
],
];
}
/**
* Lists all TicketType models.

View File

@@ -25,7 +25,7 @@ class TransferController extends \backend\controllers\BackendController
[
'actions' => [ 'index','view' ],
'allow' => true,
'roles' => ['@'],
'roles' => ['admin','employee','reception'],
],
// everything else is denied
],
@@ -43,7 +43,7 @@ class TransferController extends \backend\controllers\BackendController
$searchModel = new TransferSearch();
$dataProvider = $searchModel->search(Yii::$app->request->queryParams);
$accounts = Account::readAccounts();
$accounts = Account::read();
$searchModel->totalsTransfers();
@@ -54,7 +54,6 @@ class TransferController extends \backend\controllers\BackendController
'dataProvider' => $dataProvider,
'accounts' => $accounts,
'users' => $users,
// 'totals' =>$totals
]);
}

View File

@@ -13,6 +13,7 @@ use yii\base\Object;
use backend\models\UserUpdate;
use common\models\Account;
use common\models\UserAccountAssignment;
use common\components\RoleDefinition;
/**
* UserController implements the CRUD actions for User model.
@@ -21,6 +22,31 @@ class UserController extends \backend\controllers\BackendController
{
public function behaviors()
{
return [
'access' => [
'class' => \yii\filters\AccessControl::className(),
'rules' => [
// allow authenticated users
[
'actions' => [ 'index','view' ],
'allow' => true,
'roles' => ['employee','admin','reception'],
],
// allow authenticated users
[
'actions' => [ 'create', 'update'],
'allow' => true,
'roles' => ['admin'],
],
// everything else is denied
],
],
];
}
/**
* Lists all User models.
* @return mixed
@@ -99,6 +125,14 @@ class UserController extends \backend\controllers\BackendController
{
$model = UserUpdate::findOne(['id' => $id]);
if ( Yii::$app->authManager->checkAccess($model->id, 'admin')){
$model->role = 'admin';
} else if ( Yii::$app->authManager->checkAccess($model->id, 'employee')){
$model->role = 'employee';
}else if ( Yii::$app->authManager->checkAccess($model->id, 'reception')){
$model->role = 'reception';
}
if ( $model == null ){
throw new NotFoundHttpException('The requested page does not exist.');
}

View File

@@ -6,6 +6,7 @@ use Yii;
use yii\base\Model;
use yii\data\ActiveDataProvider;
use common\models\Account;
use common\components\RoleDefinition;
/**
* AccountSearch represents the model behind the search form about `common\models\Account`.
@@ -43,6 +44,12 @@ class AccountSearch extends Account
{
$query = Account::find();
if ( !RoleDefinition::isAdmin() ){
$query->innerJoin("user_account_assignment",'account.id_account = user_account_assignment.id_account' );
$query->andWhere(['user_account_assignment.id_user' => Yii::$app->user->id ]);
}
$dataProvider = new ActiveDataProvider([
'query' => $query,
]);

View File

@@ -6,6 +6,7 @@ use Yii;
use yii\base\Model;
use yii\data\ActiveDataProvider;
use common\models\AccountState;
use common\components\RoleDefinition;
/**
* AccountStateSearch represents the model behind the search form about `common\models\AccountState`.
@@ -53,6 +54,12 @@ class AccountStateSearch extends AccountState
{
$query = AccountState::find();
if ( !RoleDefinition::isAdmin() ){
$query->innerJoin("user_account_assignment",'account_state.id_account = user_account_assignment.id_account' );
$query->andWhere(['user_account_assignment.id_user' => Yii::$app->user->id ]);
}
$dataProvider = new ActiveDataProvider([
'query' => $query,
'sort' => false,

View File

@@ -7,6 +7,7 @@ use yii\base\Model;
use yii\data\ActiveDataProvider;
use common\models\Collection;
use common\components\Helper;
use common\components\RoleDefinition;
/**
* CollectionSearch represents the model behind the search form about `common\models\Collection`.
@@ -31,7 +32,7 @@ class CollectionSearch extends Collection
{
return [
[[ 'start', ], 'date', 'format' =>Yii::$app->formatter->datetimeFormat , 'timestampAttribute' => 'timestampStart' ,'timestampAttributeFormat' => 'yyyy-MM-dd HH:mm' ,'timeZone' => 'UTC' ],
[[ 'end' , ], 'date' ,'format' =>Yii::$app->formatter->datetimeFormat , 'timestampAttribute' => 'timestampEnd' ,'timestampAttributeFormat' => 'yyyy-MM-dd HH:mm' ,'timeZone' => 'UTC' ],
[[ 'end' , ], 'date' ,'format' =>Yii::$app->formatter->datetimeFormat , 'timestampAttribute' => 'timestampEnd' ,'timestampAttributeFormat' => 'yyyy-MM-dd HH:mm' ,'timeZone' => 'UTC' ],
[['id_account','id_user'],'integer']
];
}
@@ -56,6 +57,12 @@ class CollectionSearch extends Collection
{
$query = Collection::find();
if ( !RoleDefinition::isAdmin() ){
$query->innerJoin("user_account_assignment",'collection.id_account = user_account_assignment.id_account' );
$query->andWhere(['user_account_assignment.id_user' => Yii::$app->user->id ]);
}
$dataProvider = new ActiveDataProvider([
'query' => $query,
]);
@@ -69,8 +76,8 @@ class CollectionSearch extends Collection
}
$query->andFilterWhere([
'id_user' => $this->id_user,
'id_account' => $this->id_account,
'collection.id_user' => $this->id_user,
'collection.id_account' => $this->id_account,
]);
Helper::inInterval($query, 'collection.end', $this->timestampStart, $this->timestampEnd);

View File

@@ -6,6 +6,7 @@ use Yii;
use yii\base\Model;
use yii\data\ActiveDataProvider;
use common\models\Procurement;
use common\components\RoleDefinition;
/**
* ProcurementSearch represents the model behind the search form about `common\models\Procurement`.
@@ -55,6 +56,10 @@ class ProcurementSearch extends Procurement
'query' => $query,
]);
if ( RoleDefinition::isReception()){
$query->andWhere(['id_user' => Yii::$app->user->id ]);
}
$this->load($params);
if (!$this->validate()) {

View File

@@ -6,6 +6,7 @@ use Yii;
use yii\base\Model;
use yii\data\ActiveDataProvider;
use common\models\Product;
use common\components\RoleDefinition;
/**
* ProductSearch represents the model behind the search form about `common\models\Product`.
@@ -43,6 +44,11 @@ class ProductSearch extends Product
{
$query = Product::find();
if ( !RoleDefinition::isAdmin() ){
$query->innerJoin("user_account_assignment",'product.id_account = user_account_assignment.id_account' );
$query->andWhere(['user_account_assignment.id_user' => Yii::$app->user->id ]);
}
$dataProvider = new ActiveDataProvider([
'query' => $query,
]);
@@ -56,9 +62,9 @@ class ProductSearch extends Product
}
$query->andFilterWhere([
'id_product_category' => $this->id_product_category,
'id_account' => $this->id_account,
'status' => $this->status,
'product.id_product_category' => $this->id_product_category,
'product.id_account' => $this->id_account,
'product.status' => $this->status,
]);
$query->andFilterWhere(['like', 'product_number', $this->product_number])

View File

@@ -12,6 +12,7 @@ use yii\db\Query;
use yii\helpers\ArrayHelper;
use common\models\Account;
use common\components\Helper;
use common\components\RoleDefinition;
/**
* TransferSearch represents the model behind the search form about `common\models\Transfer`.
@@ -67,6 +68,12 @@ class TransferSearch extends Transfer
{
$query = Transfer::find();
if ( !RoleDefinition::isAdmin() ){
$query->innerJoin("user_account_assignment",'transfer.id_account = user_account_assignment.id_account' );
$query->andWhere(['user_account_assignment.id_user' => Yii::$app->user->id ]);
}
$dataProvider = new ActiveDataProvider([
'query' => $query,
]);
@@ -105,7 +112,7 @@ class TransferSearch extends Transfer
];
$accounts = Account::find()->orderBy("name asc")->all();
$accounts = Account::read();
$accountMap = ArrayHelper::map( $accounts ,'id_account','name' );
$idUser = Yii::$app->user->id;

View File

@@ -2,6 +2,7 @@
use yii\helpers\Html;
use yii\grid\GridView;
use common\components\RoleDefinition;
/* @var $this yii\web\View */
/* @var $searchModel backend\models\AccountSearch */
@@ -15,9 +16,11 @@ $this->params['breadcrumbs'][] = $this->title;
<h1><?= Html::encode($this->title) ?></h1>
<?php // echo $this->render('_search', ['model' => $searchModel]); ?>
<?php if ( RoleDefinition::isAdmin()) {?>
<p>
<?= Html::a(Yii::t('common/account', 'Create Account'), ['create'], ['class' => 'btn btn-success']) ?>
</p>
<?php }?>
<?= GridView::widget([
'dataProvider' => $dataProvider,
@@ -35,7 +38,7 @@ $this->params['breadcrumbs'][] = $this->title;
'updated_at:datetime',
['class' => 'yii\grid\ActionColumn',
'template' => '{view} {update}'
'template' => RoleDefinition::getRoleTemplate( ['admin' => '{view} {update}','employee' => '{view}' , 'reception' => '{view}']),
],
],

View File

@@ -2,6 +2,7 @@
use yii\helpers\Html;
use yii\widgets\DetailView;
use common\components\RoleDefinition;
/* @var $this yii\web\View */
/* @var $model common\models\Account */
@@ -14,18 +15,11 @@ $this->params['breadcrumbs'][] = $this->title;
<h1><?= Html::encode($this->title) ?></h1>
<?php if ( RoleDefinition::isAdmin() ){?>
<p>
<?= Html::a(Yii::t('common/account', 'Update'), ['update', 'id' => $model->id_account], ['class' => 'btn btn-primary']) ?>
<?php
/*Html::a(Yii::t('common/account', 'Delete'), ['delete', 'id' => $model->id_account], [
'class' => 'btn btn-danger',
'data' => [
'confirm' => Yii::t('common/account', 'Are you sure you want to delete this item?'),
'method' => 'post',
],
]) */
?>
</p>
<?php }?>
<?= DetailView::widget([
'model' => $model,

View File

@@ -2,6 +2,7 @@
use yii\helpers\Html;
use yii\grid\GridView;
use common\components\RoleDefinition;
/* @var $this yii\web\View */
/* @var $searchModel backend\models\DiscountSearch */
@@ -15,9 +16,11 @@ $this->params['breadcrumbs'][] = $this->title;
<h1><?= Html::encode($this->title) ?></h1>
<?php // echo $this->render('_search', ['model' => $searchModel]); ?>
<?php if ( RoleDefinition::isAdmin() ) {?>
<p>
<?= Html::a(Yii::t('common/discount', 'Create Discount'), ['create'], ['class' => 'btn btn-success']) ?>
</p>
<?php }?>
<?= GridView::widget([
'dataProvider' => $dataProvider,
@@ -37,7 +40,7 @@ $this->params['breadcrumbs'][] = $this->title;
[
'class' => 'yii\grid\ActionColumn',
'template' => '{view} {update}'
'template' => RoleDefinition::getRoleTemplate( ['admin' => '{view} {update}','employee' => '{view}' , 'reception' => '{view}']),
],
],
]); ?>

View File

@@ -2,6 +2,7 @@
use yii\helpers\Html;
use yii\widgets\DetailView;
use common\components\RoleDefinition;
/* @var $this yii\web\View */
/* @var $model common\models\Discount */
@@ -14,18 +15,11 @@ $this->params['breadcrumbs'][] = $this->title;
<h1><?= Html::encode($this->title) ?></h1>
<p>
<?= Html::a(Yii::t('common/discount', 'Update'), ['update', 'id' => $model->id_discount], ['class' => 'btn btn-primary']) ?>
<?php
/* Html::a(Yii::t('common/discount', 'Delete'), ['delete', 'id' => $model->id_discount], [
'class' => 'btn btn-danger',
'data' => [
'confirm' => Yii::t('common/discount', 'Are you sure you want to delete this item?'),
'method' => 'post',
],
])*/
?>
</p>
<?php if ( RoleDefinition::isAdmin()) {?>
<p>
<?= Html::a(Yii::t('common/discount', 'Update'), ['update', 'id' => $model->id_discount], ['class' => 'btn btn-primary']) ?>
</p>
<?php }?>
<?= DetailView::widget([
'model' => $model,

View File

@@ -10,6 +10,7 @@ use yii\bootstrap\NavBar;
use yii\widgets\Breadcrumbs;
use common\widgets\Alert;
use backend\components\AdminMenuStructure;
use kartik\widgets\AlertBlock;
AppAsset::register($this);
@@ -49,7 +50,14 @@ $items = $adminMenu->run();
<?= Breadcrumbs::widget([
'links' => isset($this->params['breadcrumbs']) ? $this->params['breadcrumbs'] : [],
]) ?>
<?= Alert::widget() ?>
<?php //echo Alert::widget() ?>
<?php
echo AlertBlock::widget([
'useSessionFlash' => true,
'type' => AlertBlock::TYPE_GROWL,
'delay' => '1'
]);
?>
<?= $content ?>
</div>
</div>

View File

@@ -31,6 +31,7 @@ $warehouseOptions = ArrayHelper::map($warehouses, 'id_warehouse', 'name') ;
<div class="form-group">
<?= Html::submitButton($model->isNewRecord ? Yii::t('common/procurement', 'Create') : Yii::t('common/procurement', 'Update'), ['class' => $model->isNewRecord ? 'btn btn-success' : 'btn btn-primary']) ?>
<?= Html::submitButton( Yii::t('common/procurement', 'Save/Next'), [ 'class' => 'btn btn-primary' ,'name' => '_next']) ?>
</div>
<?php ActiveForm::end(); ?>

View File

@@ -23,7 +23,7 @@ $statusOptions = mkOptions( Product::statuses() );
$productCategories = mkOptions( ArrayHelper::map( ProductCategory::read(null) ,'id_product_category','name') );
$accounts = mkOptions( ArrayHelper::map( Account::readAccounts(null) ,'id_account','name'));
$accounts = mkOptions( ArrayHelper::map( Account::read(null) ,'id_account','name'));
?>
<div class="product-search">

View File

@@ -2,6 +2,7 @@
use yii\helpers\Html;
use yii\grid\GridView;
use common\components\RoleDefinition;
/* @var $this yii\web\View */
/* @var $searchModel backend\models\TicketTypeSearch */
@@ -13,11 +14,12 @@ $this->params['breadcrumbs'][] = $this->title;
<div class="ticket-type-index">
<h1><?= Html::encode($this->title) ?></h1>
<?php // echo $this->render('_search', ['model' => $searchModel]); ?>
<?php if ( RoleDefinition::isAdmin()) {?>
<p>
<?= Html::a(Yii::t('common/ticket_type', 'Create Ticket Type'), ['create'], ['class' => 'btn btn-success']) ?>
</p>
<?php }?>
<?= GridView::widget([
'dataProvider' => $dataProvider,
@@ -51,7 +53,7 @@ $this->params['breadcrumbs'][] = $this->title;
[
'class' => 'yii\grid\ActionColumn',
'template' =>'{view} {update}'
'template' => RoleDefinition::getRoleTemplate( ['admin' => '{view} {update}','employee' => '{view}' , 'reception' => '{view}']),
],
],

View File

@@ -2,6 +2,7 @@
use yii\helpers\Html;
use yii\widgets\DetailView;
use common\components\RoleDefinition;
/* @var $this yii\web\View */
/* @var $model common\models\TicketType */
@@ -14,20 +15,11 @@ $this->params['breadcrumbs'][] = $this->title;
<h1><?= Html::encode($this->title) ?></h1>
<?php if ( RoleDefinition::isAdmin()) {?>
<p>
<?= Html::a(Yii::t('common/ticket_type', 'Update'), ['update', 'id' => $model->id_ticket_type], ['class' => 'btn btn-primary']) ?>
<?php
/*
echo Html::a(Yii::t('common/ticket_type', 'Delete'), ['delete', 'id' => $model->id_ticket_type], [
'class' => 'btn btn-danger',
'data' => [
'confirm' => Yii::t('common/ticket_type', 'Are you sure you want to delete this item?'),
'method' => 'post',
],
])
*/
?>
</p>
<?php }?>
<?= DetailView::widget([
'model' => $model,

View File

@@ -16,9 +16,12 @@ $this->params['breadcrumbs'][] = $this->title;
<h1><?= Html::encode($this->title) ?></h1>
<?php echo $this->render('_search', ['model' => $searchModel]); ?>
<?php if ( RoleDefinition::isAdmin()){ ?>
<p>
<?= Html::a(Yii::t('app', 'Új felhasználó'), ['create'], ['class' => 'btn btn-success']) ?>
</p>
<?php } ?>
<?= GridView::widget([
'dataProvider' => $dataProvider,
@@ -39,7 +42,7 @@ $this->params['breadcrumbs'][] = $this->title;
] ,
['class' => 'yii\grid\ActionColumn',
'template' => '{view} {update}'
'template' => RoleDefinition::getRoleTemplate([ 'admin' => '{view} {update}', 'employee' => '{view}' ] )
],
],
]); ?>

View File

@@ -5,12 +5,10 @@ use yii\helpers\Html;
/* @var $this yii\web\View */
/* @var $model common\models\User */
$this->title = Yii::t('app', 'Update {modelClass}: ', [
'modelClass' => 'User',
]) . ' ' . $model->id;
$this->params['breadcrumbs'][] = ['label' => Yii::t('app', 'Users'), 'url' => ['index']];
$this->params['breadcrumbs'][] = ['label' => $model->id, 'url' => ['view', 'id' => $model->id]];
$this->params['breadcrumbs'][] = Yii::t('app', 'Update');
$this->title = Yii::t('backend/user', 'Edit user' );
$this->params['breadcrumbs'][] = ['label' => Yii::t('backend/user', 'Users'), 'url' => ['index']];
$this->params['breadcrumbs'][] = ['label' => $model->username, 'url' => ['view', 'id' => $model->id]];
$this->params['breadcrumbs'][] = Yii::t('backend/user', 'Update');
?>
<div class="user-update">

View File

@@ -2,21 +2,24 @@
use yii\helpers\Html;
use yii\widgets\DetailView;
use common\components\RoleDefinition;
/* @var $this yii\web\View */
/* @var $model common\models\User */
$this->title = $model->id;
$this->params['breadcrumbs'][] = ['label' => Yii::t('app', 'Felhasználók'), 'url' => ['index']];
$this->title = $model->username;
$this->params['breadcrumbs'][] = ['label' => Yii::t('backend/user', 'Users'), 'url' => ['index']];
$this->params['breadcrumbs'][] = $this->title;
?>
<div class="user-view">
<h1><?= Html::encode($this->title) ?></h1>
<?php if ( RoleDefinition::isAdmin()) {?>
<p>
<?= Html::a(Yii::t('app', 'Update'), ['update', 'id' => $model->id], ['class' => 'btn btn-primary']) ?>
<?= Html::a(Yii::t('backend/user', 'Update'), ['update', 'id' => $model->id], ['class' => 'btn btn-primary']) ?>
</p>
<?php }?>
<?= DetailView::widget([
'model' => $model,