title: how can I limit user's access to information of their profile in YII framework
body: <p>how can i limit user's access to information of others. </p>
  
  <p>I've tried controller for Users and they can access to index of controller for other user. please describe me how to change setting in YII framework that each User just can access to their information.</p>
  
  <p>i am using version 1.1.X</p>
  
  <p>my Here again, I've got my previous problem 
  i want them to see only their note</p>
  
  <pre><code>&lt;?php
  
  class TextController extends Controller
  {
      /**
       * @var string the default layout for the views. Defaults to '//layouts/column2', meaning
       * using two-column layout. See 'protected/views/layouts/column2.php'.
       */
      public $layout='//layouts/column2';
  
      /**
       * @return array action filters
       */
      public function filters()
      {
          return array(
              'accessControl', // perform access control for CRUD operations
              'postOnly + delete', // we only allow deletion via POST request
          );
      }
  
      /**
       * Specifies the access control rules.
       * This method is used by the 'accessControl' filter.
       * @return array access control rules
       */
      public function accessRules()
      {
          return array(
              array('allow',  // allow all users to perform 'index' and 'view' actions
                  'actions'=&gt;array('index','view'),
                  'users'=&gt;array('*'),
              ),
              array('allow', // allow authenticated user to perform 'create' and 'update' actions
                  'actions'=&gt;array('create','update'),
                  'users'=&gt;array('@'),
              ),
              array('allow', // allow admin user to perform 'admin' and 'delete' actions
                  'actions'=&gt;array('admin','delete'),
                  'users'=&gt;array('admin'),
              ),
              array('deny',  // deny all users
                  'users'=&gt;array('*'),
              ),
          );
      }
  
      /**
       * Displays a particular model.
       * @param integer $id the ID of the model to be displayed
       */
      public function actionView($id)
      {
          $this-&gt;render('view',array(
              'model'=&gt;$this-&gt;loadModel($id),
          ));
      }
  
      /**
       * Creates a new model.
       * If creation is successful, the browser will be redirected to the 'view' page.
       */
      public function actionCreate()
      {
          $model=new Text;
  
          // Uncomment the following line if AJAX validation is needed
          // $this-&gt;performAjaxValidation($model);
  
          if(isset($_POST['Text']))
          {
              $model-&gt;attributes=$_POST['Text'];
              if($model-&gt;save())
                  $this-&gt;redirect(array('view','id'=&gt;$model-&gt;id));
          }
  
          $this-&gt;render('create',array(
              'model'=&gt;$model,
          ));
      }
  
      /**
       * Updates a particular model.
       * If update is successful, the browser will be redirected to the 'view' page.
       * @param integer $id the ID of the model to be updated
       */
      public function actionUpdate($id)
      {
          $model=$this-&gt;loadModel($id);
  
          // Uncomment the following line if AJAX validation is needed
          // $this-&gt;performAjaxValidation($model);
  
          if(isset($_POST['Text']))
          {
              $model-&gt;attributes=$_POST['Text'];
              if($model-&gt;save())
                  $this-&gt;redirect(array('view','id'=&gt;$model-&gt;id));
          }
  
          $this-&gt;render('update',array(
              'model'=&gt;$model,
          ));
      }
  
      /**
       * Deletes a particular model.
       * If deletion is successful, the browser will be redirected to the 'admin' page.
       * @param integer $id the ID of the model to be deleted
       */
      public function actionDelete($id)
      {
          $this-&gt;loadModel($id)-&gt;delete();
  
          // if AJAX request (triggered by deletion via admin grid view), we should not redirect the browser
          if(!isset($_GET['ajax']))
              $this-&gt;redirect(isset($_POST['returnUrl']) ? $_POST['returnUrl'] : array('admin'));
      }
  
      /**
       * Lists all models.
       */
      public function actionIndex()
      {
          $dataProvider=new CActiveDataProvider('Text');
          $this-&gt;render('index',array(
              'dataProvider'=&gt;$dataProvider,
          ));
      }
  
      /**
       * Manages all models.
       */
      public function actionAdmin()
      {
          $model=new Text('search');
          $model-&gt;unsetAttributes();  // clear any default values
          if(isset($_GET['Text']))
              $model-&gt;attributes=$_GET['Text'];
  
          $this-&gt;render('admin',array(
              'model'=&gt;$model,
          ));
      }
  
      /**
       * Returns the data model based on the primary key given in the GET variable.
       * If the data model is not found, an HTTP exception will be raised.
       * @param integer $id the ID of the model to be loaded
       * @return Text the loaded model
       * @throws CHttpException
       */
      public function loadModel($id)
      {
          $model=Text::model()-&gt;findByPk($id);
          if($model===null)
              throw new CHttpException(404,'The requested page does not exist.');
          return $model;
      }
  
      /**
       * Performs the AJAX validation.
       * @param Text $model the model to be validated
       */
      protected function performAjaxValidation($model)
      {
          if(isset($_POST['ajax']) &amp;&amp; $_POST['ajax']==='text-form')
          {
              echo CActiveForm::validate($model);
              Yii::app()-&gt;end();
          }
      }
  }
  </code></pre>
  
  <p>Limits for Show is solved. But User through the URL can access the notes made ​​by others To do this, give that person can change the top number Then he can have access to other user information What can I do for this problem?</p>