title: Secure Ajax Requests made by YII
body: <p>i'm currently writing a Application based on YII.<br>
  My action for index:</p>
  
  <pre><code>  public function actionIndex() {
      $data = array();
      $data['server'] = Server::model()-&gt;findByPk(1);
      $data['dataProvider'] = new CActiveDataProvider('ServerUserPermission', array('criteria' =&gt; array('condition' =&gt; 'serverID=:id', 'params' =&gt; array(':id' =&gt; 1))));
      $this-&gt;render('index', $data);
  }
  </code></pre>
  
  <p>my ajax action:</p>
  
  <pre><code>public function actionAddPermission($server) {
      if(Util::checkServerPower($server, Permission::MODIFY_SERVER)) {
          $perm = new ServerUserPermission;
          $perm-&gt;userID = 1;
          $perm-&gt;serverID = $server;
          $perm-&gt;power = 10;
          try {
              if ($perm-&gt;save()) {
                  echo "OK";
              } else {
                  echo Util::print_r($perm-&gt;getErrors());
              }
          } catch (Exception $e) {
              echo 'Critical Error Code: ' . $e-&gt;getCode();
          }
      } else {
          echo 'No Permissions';
      }
  }
  </code></pre>
  
  <p>My view links to the addPermission action by using a button:</p>
  
  <pre><code>echo CHtml::ajaxButton("Insert New Player", array('addPermission', 'server' =&gt; $server-&gt;serverID), array('success'=&gt;'refresh')); 
  </code></pre>
  
  <p>My function Util::checkServerPower(...) checks the current User of the Application. Consequence: Ajax requests in YII are handled by an Guest AuthWeb User, but i need to check whether the User is actually allowed to add permissions or not. I currently cannot think of a secured solution to protect malicious data send by other guests or not. Is it somehow possible to get the (server-side) userID of the Ajax-call?</p>
  
  <p>Thanks anyway
  sincerly</p>