title: cakephp 3 Error with passed parameter in url
body: <p>I am making an app with cakephp 3, and i want to restric normal user ('alumnos' in this case) to see and edit only their profiles, so i try to compare the id of the logged user and the value send by the request in the url, but it does not working, it sends the following error "Notice (8): Undefined offset: 0 [APP/Controller\UsersController.php, line 144]", the $this->request->params['pass'][0] variable is empty. How i can fix this?</p>
  
  <p>This is my userController.php </p>
  
  <pre><code>class UsersController extends AppController{
  
  /**
   * Index method
   *
   * @return void
   */
  public function index()
  {
      $this-&gt;paginate = [
          'contain' =&gt; ['Grados']
      ];
      $this-&gt;set('users', $this-&gt;paginate($this-&gt;Users));
      $this-&gt;set('_serialize', ['users']);
  }
  
  /**
   * View method
   *
   * @param string|null $id User id.
   * @return void
   * @throws \Cake\Network\Exception\NotFoundException When record not found.
   */
  public function view($id = null)
  {
      $user = $this-&gt;Users-&gt;get($id, [
          'contain' =&gt; ['Grados', 'Clases', 'ConveniosUsuarios', 'Desvinculaciones', 'HistorialAlumnos', 'Pagos', 'Pedidos']
      ]);
      $this-&gt;set('user', $user);
      $this-&gt;set('_serialize', ['user']);
  }
  
  /**
   * Add method
   *
   * @return void Redirects on successful add, renders view otherwise.
   */
  public function add()
  {
      $user = $this-&gt;Users-&gt;newEntity();
      if ($this-&gt;request-&gt;is('post')) {
          $user = $this-&gt;Users-&gt;patchEntity($user, $this-&gt;request-&gt;data);
  
          if ($this-&gt;Users-&gt;save($user)) {
              $this-&gt;Flash-&gt;success(__('The user has been saved.'));
              return $this-&gt;redirect(['action' =&gt; 'index']);
          } else {
              $this-&gt;Flash-&gt;error(__('The user could not be saved. Please, try again.'));
          }
      }
      $grados = $this-&gt;Users-&gt;Grados-&gt;find('list', ['limit' =&gt; 200]);
      $this-&gt;set(compact('user', 'grados'));
      $this-&gt;set('_serialize', ['user']);
  }
  
  /**
   * Edit method
   *
   * @param string|null $id User id.
   * @return void Redirects on successful edit, renders view otherwise.
   * @throws \Cake\Network\Exception\NotFoundException When record not found.
   */
  public function edit($id = null)
  {
      $user = $this-&gt;Users-&gt;get($id, [
          'contain' =&gt; []
      ]);
      if ($this-&gt;request-&gt;is(['patch', 'post', 'put'])) {
          $user = $this-&gt;Users-&gt;patchEntity($user, $this-&gt;request-&gt;data);
          if ($this-&gt;Users-&gt;save($user)) {
              $this-&gt;Flash-&gt;success(__('The user has been saved.'));
              return $this-&gt;redirect(['action' =&gt; 'index']);
          } else {
              $this-&gt;Flash-&gt;error(__('The user could not be saved. Please, try again.'));
          }
      }
      $grados = $this-&gt;Users-&gt;Grados-&gt;find('list', ['limit' =&gt; 200]);
      $this-&gt;set(compact('user', 'grados'));
      $this-&gt;set('_serialize', ['user']);
  }
  
  /**
   * Delete method
   *
   * @param string|null $id User id.
   * @return void Redirects to index.
   * @throws \Cake\Network\Exception\NotFoundException When record not found.
   */
  public function delete($id = null)
  {
      $this-&gt;request-&gt;allowMethod(['post', 'delete']);
      $user = $this-&gt;Users-&gt;get($id);
      if ($this-&gt;Users-&gt;delete($user)) {
          $this-&gt;Flash-&gt;success(__('The user has been deleted.'));
      } else {
          $this-&gt;Flash-&gt;error(__('The user could not be deleted. Please, try again.'));
      }
      return $this-&gt;redirect(['action' =&gt; 'index']);
  }
  
  public function beforeFilter(Event $event)
  { 
      $this-&gt;Auth-&gt;allow(['logout']);
  }
  
  public function login()
  {
      if ($this-&gt;request-&gt;is('post')) {
          $user = $this-&gt;Auth-&gt;identify();
          if ($user) {
              $this-&gt;Auth-&gt;setUser($user);
              if ($this-&gt;Auth-&gt;user('rol') == 'Alumno') {
                  $this-&gt;redirect('users'.DS.'view'.DS.$this-&gt;Auth-&gt;user('id'));
              }else{
                  return $this-&gt;redirect($this-&gt;Auth-&gt;redirectUrl());
              }
          }else{
              $this-&gt;Flash-&gt;error(__('Usario o contraseña invalidos!'));    
          }
      }
  }
  
  public function logout()
  {
      return $this-&gt;redirect($this-&gt;Auth-&gt;logout());
  }
  
  public function isAuthorized($user)
  {
      $userid=$this-&gt;Auth-&gt;user('id');
      $id= $this-&gt;request-&gt;params['pass'][0];//here is the problem!!
      $action = $this-&gt;request-&gt;params['action'];
      if ($user['rol']=='Instructor') {
          return true;
      }else if ($user['rol']!='Instructor') {
          if (in_array($action, ['edit', 'view']) &amp;&amp; $userid == $id) {
              return true;
          }
          return false;
      }
      return parent::isAuthorized($user);
  }
  }
  </code></pre>
  
  <p>When if the user is correct debug($this->request->params) display:</p>
  
  <pre><code>    [
      'plugin' =&gt; null,
      'controller' =&gt; 'Users',
      'action' =&gt; 'view',
      '_ext' =&gt; null,
      'pass' =&gt; [
          (int) 0 =&gt; '4'
      ]
  ]
  </code></pre>
  
  <p>But if the user try to see other profile debug($this->request->params) display: </p>
  
  <pre><code>[
      'plugin' =&gt; null,
      'controller' =&gt; 'Users',
      'action' =&gt; 'index',
      '_ext' =&gt; null,
      'pass' =&gt; []
  ]
  </code></pre>
  
  <p><strong>AppController.php</strong></p>
  
  <pre><code>class AppController extends Controller
  {
  /**
   * Initialization hook method.
   *
   * Use this method to add common initialization code like loading components.
   *
   * @return void
   */
  public function initialize()
  {
      $this-&gt;loadComponent('Flash');
      $this-&gt;loadComponent('Auth', [
          'authorize' =&gt; ['Controller'],
          'loginRedirect' =&gt; [
              'controller' =&gt; 'Users',
              'action' =&gt; 'index'
          ],
          'logoutRedirect' =&gt; [
              'controller' =&gt; 'Users',
              'action' =&gt; 'login'
          ]
      ]);
  }
  
  public function beforeFilter(Event $event)
  {
      $this-&gt;Auth-&gt;allow(['login']);
  }
  
  public function isAuthorized($user)
  {
      // Admin can access every action
      if (isset($user['role']) &amp;&amp; $user['role'] === 'admin') {
          return true;
      }
      // Default deny
      return false;
  }
  }
  </code></pre>