[FIXED] set default page for Forbidden (#403) when cant access in YII2

Issue

this is my behavior function in ShippingController :

 public function behaviors()
        {
        return [
            'access' => [
                'class' => \yii\filters\AccessControl::className(),
                'rules' => [
                    // deny all POST requests
//                        [
//                        'actions' => ['index', 'create'],
//                        'allow' => TRUE,
//                    ],
                        [
                        'actions' => ['index', 'create', 'init'],
                        'allow' => true,
                        'roles' => ['user2','user3'],
                        'denyCallback' => function()
                            {

                     redirect to address/index if user 2 cant access redirect to address/create if user3 cant access
                            //redirect here
                            }
                    ],
                // everything else is denied
                ],
            ],
        ];

        }

how to handle this problem !? i want redirect page to address/index if role :user2 cant access and redirect to address/create if role : user3 cant access

Solution

I assume you are using the RBAC system in yii. Check what config files for:

'authManager'  => [
    'class' => 'yii\rbac\DbManager',
],

or 'yii\rbac\PhpManager'.

Here is what worked for me:

'actions' => ['index', 'create', 'init'],
'allow' => false,
'roles' => ['user2','user3'],
'denyCallback' => function()
     {
        $user = Yii::$app->user;
        if ($user->can('user2')) {
           return Yii::$app->getResponse()->redirect(['/address/index']);
        } else {
           return Yii::$app->getResponse()->redirect(['/address/create']);
        }
     }

The 'allow' option of the rule should be set to false in order for denyCallback to be called. You can see that at "yiisoft/yii2/filters/AccessControl.php" line 120.

Answered By - Jannes Botis