Why do non-logged in users have access to the controller?

Question

Yii

With this code in the model, I define access to pages depending on the role (admin is role_id=1, user is role_id=2).

class User extends BaseUser
{


    public static function getNameById($id) {
        $row = self::find()->andWhere('id = :userId', array('userId' => $id))->one();
        if($row)
            return $row->username;
        return '';
    }



    public static function getMenuItemsByRoleUser($isAdmin,$isGuest) {

        if($isGuest)
            return [];

        if(Yii::$app->user->identity->role_id == 1) {
            return [
                ['label' => 'Пользователи', 'url' => ['/user/admin/index']],
                ['label' => 'Права доступа', 'url' => ['/access/index']],
                ['label' => 'Каталог разделов', 'url' => ['/catalog/index']],
                ['label' => 'Сверка дат', 'url' => ['/user/admin/index1']],
                ['label' => 'Импорт', 'url' => ['/user/admin/index1']],
                ['label' => 'Экспорт', 'url' => ['/user/admin/index1']],
                ['label' => '', 'url' => ['/user/admin/index1']],
                [
                    'label' => 'Выйти (' . Yii::$app->user->identity->username . ')',
                    'url' => ['/site/logout'],
                    'linkOptions' => ['data-method' => 'post']
                ],
            ];

        } else if(Yii::$app->user->identity->role_id == 2){
            return [
                ['label' => 'Каталог разделов', 'url' => ['/catalog/index']],
                ['label' => 'Каталог материалов', 'url' => ['/tasks-manager/index']],
                ['label' => 'Отчет', 'url' => ['/tasks-manager/index']],
                [
                    'label' => 'Выйти (' . Yii::$app->user->identity->username . ')',
                    'url' => ['/site/logout'],
                    'linkOptions' => ['data-method' => 'post']
                ],
            ];
        }
    }

    public function getRole()
    {
        return $this->hasOne(Role::className(), ['id' => 'role_id']);
    }
}

But if I manually follow the catalog/index link, for some reason this page is displayed for me even if I'm not logged in... why can this happen? if anything, this bug appeared after I needed to change the names of the controllers...

Answer 1

Here, only the menu is formed from the user role, you also need to configure access to controllers / actions. In yii there is an access control filter behavior for this