如何在Codeigniter框架中拒绝访问控制器功能

Question

how can i protect functions in my controller?
Lets say a user is logged in, it can directly access any function just by typing in the url.

Some say use private function .....
and Some say use underscore prefix to functions

But there was no clear explanation how to do it and how it works.

Hope you guys can make it clearer.

Thanks everyone.

Answer 1

According to the CI doc recommendations, and since checking whether or not a user is logged in is a common task which you'll likely want to perform in many of your controllers, you should first create a base controller class which has a method that checks whether a user is logged in. Something like this:

class MY_Controller extends CI_Controller
{
  function __construct()
  {
    parent::__construct();
  }

  protected function _user_is_logged_in()
  {
     // logic which checks various conditions and returns a boolean
  }
}

Then you can use this controller when you are declaring the various other controllers for your site:

class Welcome extends My_Controller
{
  public function index()
  {
     if(!$this->_user_is_logged_in()) 
     {
       // redirect, exit, show a 403, etc;
     }
  }

}

There is a feature of the CodeIgniter framework which will prevent underscore-prefixed methods from being used as page callbacks:

http://ellislab.com/codeigniter/user-guide/general/controllers.html#private

And defining these methods as private or protected when you declare them will obviously affect their scope, definition and extension respectively.

Answer 2

You can create private functions in your controller by using the underscore prefix.

http://ellislab.com/codeigniter/user-guide/general/controllers.html#private

In some cases you may want certain functions hidden from public access. To make a function private, simply add an underscore as the name prefix and it will not be served via a URL request. For example, if you were to have a function like this:

private function _utility()
{
  // some code
}

Trying to access it via the URL, like this, will not work:

example.com/index.php/blog/_utility/