Bug in create action of \yii\rest\ActiveController

[aminkt]

What steps will reproduce the problem?

Consider that you are using ActiveController and want to create an entity in your db.
When you send post request to create action and want check access of user that requested.

What is the expected result?

You expect that the model object in checkAccess method filled by user input but it's not.

What do you get instead?

The model object is null.

Additional info

Q	A
Yii version	2.0.15.1
PHP version	7.1
Operating system	Docker ubuntu 16

[aminkt]

Please look at this line :

yii2/framework/rest/CreateAction.php

Line 42 in b070b5f

if ($this->checkAccess) {

I think it's better we change it to something like this:

    /**
     * Creates a new model.
     * @return \yii\db\ActiveRecordInterface the model newly created
     * @throws ServerErrorHttpException if there is any error when creating the model
     */
    public function run()
    {
        /* @var $model \yii\db\ActiveRecord */
        $model = new $this->modelClass([
            'scenario' => $this->scenario,
        ]);

        $model->load(Yii::$app->getRequest()->getBodyParams(), '');

       // Change checkAccess method to here.
        if ($this->checkAccess) {
            call_user_func($this->checkAccess, $this->id, $model);
        }

        if ($model->save()) {
            $response = Yii::$app->getResponse();
            $response->setStatusCode(201);
            $id = implode(',', array_values($model->getPrimaryKey(true)));
            $response->getHeaders()->set('Location', Url::toRoute([$this->viewAction, 'id' => $id], true));
        } elseif (!$model->hasErrors()) {
            throw new ServerErrorHttpException('Failed to create the object for unknown reason.');
        }

        return $model;
    }

[samdark]

While it looks like a good change, no enhancements are accepted into 2.0 anymore. You can propose your change there: https://github.com/yiisoft/yii-rest

[aminkt]

Thank you. i will create a new issue in that is create a pull request.