Preventing user from viewing another user profile in Yii - php

Question

I have some question about my app. How can I prevent a user from viewing another user profile?
I mean, a user can only view their own profile. If user 123 is logged in, he is allowed in 'view&id=123' but denied in 'view&id=234' etc.
I know how to do this from the view page, but, am I able to deny it from my Controller? I'm thinking to use expression but I can't get it right. Here is my code
array('deny',
'actions'=>array('view'),
'expression'=>'$user->getName()!=??',
),
What is the right expression to replace the '??' part?
I tried to use $id (the actionView parameter) but it showed me an error..

Answer 1

I usually do this at controller level, I do something like this:
public function actionView($id){
if($id != Yii::app()->user->id) {
throw new CHttpException('403','You are not allowed to see this page');
}
//Continue with the code
}
Assumming that you've stored logged user id at the Yii:app()->user variable.
Also this might work:
array('deny',
'actions'=>array('view'),
'expression'=>'$_GET["id"] != Yii::app()->user->id',
),

Answer 2

Use option allow make it easier to get what you want.
'actions' => ['view', 'list-post', 'unsubscribe'],
'allow' => $_GET['id'] == Yii::$app->user->id,

Answer 3

The best practice is to create a custom filter (in application.components.controller, if you use it more than once):
public function filterCheckOwner($filterChain)
{
if ($id=Yii::app()->getRequest()->getParam('id'))
{
if($id != Yii::app()->user->id)
throw new CHttpException('403','You are not allowed to see this page');
else
$filterChain->run();
}
}
And then just add the actions that must run it in the filters() method with the same name (without 'filter'):
public function filters()
{
return array(
...
'checkOwner + view, update, whatever',
...
);
}