Added access control in controllers. An unprivileged user has uncontr…

.travis.yml

@@ -10,6 +10,9 @@ php:
 # faster builds on new travis setup not using sudo
 sudo: false
 
+services:
+  - mysql
+
 # cache vendor dirs
 cache:
   directories:
@@ -28,12 +31,12 @@ install:
     codecept build
     cd ..
 
-before_script:
+before_install:
   - mysql --version
 
   # initialize databases
-  - mysql -e 'CREATE DATABASE mdm_admin_test;';
-  
+  - mysql -e 'CREATE DATABASE IF NOT EXISTS mdm_admin_test;'
+
 script:
   - |
     cd tests/web

controllers/AssignmentController.php

@@ -8,6 +8,7 @@
 use yii\web\Controller;
 use yii\web\NotFoundHttpException;
 use yii\filters\VerbFilter;
+use mdm\admin\components\AccessControl;
 
 /**
  * AssignmentController implements the CRUD actions for Assignment model.
@@ -49,6 +50,9 @@ public function behaviors()
                     'revoke' => ['post'],
                 ],
             ],
+            'access' => [
+                'class' => AccessControl::class,
+            ],
         ];
     }
 

controllers/DefaultController.php

@@ -3,6 +3,7 @@
 namespace mdm\admin\controllers;
 
 use Yii;
+use mdm\admin\components\AccessControl;
 
 /**
  * DefaultController
@@ -13,6 +14,18 @@
 class DefaultController extends \yii\web\Controller
 {
 
+    /**
+     * @inheritdoc
+     */
+    public function behaviors()
+    {
+        return [
+            'access' => [
+                'class' => AccessControl::class,
+            ],
+        ];
+    }
+
     /**
      * Action index
      */

controllers/MenuController.php

@@ -9,6 +9,7 @@
 use yii\web\NotFoundHttpException;
 use yii\filters\VerbFilter;
 use mdm\admin\components\Helper;
+use mdm\admin\components\AccessControl;
 
 /**
  * MenuController implements the CRUD actions for Menu model.
@@ -31,6 +32,9 @@ public function behaviors()
                     'delete' => ['post'],
                 ],
             ],
+            'access' => [
+                'class' => AccessControl::class,
+            ],
         ];
     }
 

controllers/PermissionController.php

@@ -4,6 +4,7 @@
 
 use mdm\admin\components\ItemController;
 use yii\rbac\Item;
+use mdm\admin\components\AccessControl;
 
 /**
  * PermissionController implements the CRUD actions for AuthItem model.
@@ -14,6 +15,18 @@
 class PermissionController extends ItemController
 {
 
+    /**
+     * @inheritdoc
+     */
+    public function behaviors()
+    {
+        return [
+            'access' => [
+                'class' => AccessControl::class,
+            ],
+        ];
+    }
+
     /**
      * @inheritdoc
      */

controllers/RoleController.php

@@ -4,6 +4,7 @@
 
 use mdm\admin\components\ItemController;
 use yii\rbac\Item;
+use mdm\admin\components\AccessControl;
 
 /**
  * RoleController implements the CRUD actions for AuthItem model.
@@ -13,6 +14,18 @@
  */
 class RoleController extends ItemController
 {
+    /**
+     * @inheritdoc
+     */
+    public function behaviors()
+    {
+        return [
+            'access' => [
+                'class' => AccessControl::class,
+            ],
+        ];
+    }
+
     /**
      * @inheritdoc
      */

controllers/RouteController.php

@@ -6,6 +6,7 @@
 use mdm\admin\models\Route;
 use yii\web\Controller;
 use yii\filters\VerbFilter;
+use mdm\admin\components\AccessControl;
 
 /**
  * Description of RuleController
@@ -27,6 +28,9 @@ public function behaviors()
                     'refresh' => ['post'],
                 ],
             ],
+            'access' => [
+                'class' => AccessControl::class,
+            ],
         ];
     }
     /**

controllers/RuleController.php

@@ -10,6 +10,7 @@
 use yii\web\NotFoundHttpException;
 use mdm\admin\components\Helper;
 use mdm\admin\components\Configs;
+use mdm\admin\components\AccessControl;
 
 /**
  * Description of RuleController
@@ -32,6 +33,9 @@ public function behaviors()
                     'delete' => ['post'],
                 ],
             ],
+            'access' => [
+                'class' => AccessControl::class,
+            ],
         ];
     }
 

controllers/UserController.php

@@ -18,6 +18,7 @@
 use yii\web\BadRequestHttpException;
 use yii\web\Controller;
 use yii\web\NotFoundHttpException;
+use mdm\admin\components\AccessControl;
 
 /**
  * User controller
@@ -40,6 +41,9 @@ public function behaviors()
                     'activate' => ['post'],
                 ],
             ],
+            'access' => [
+                'class' => AccessControl::class,
+            ],
         ];
     }