Fix #19581: Fix regression in CompositeAuth introduced in #19418

Author: samdark

CHANGELOG.md

@@ -20,6 +20,7 @@ Yii Framework 2 Change Log
 - Bug #19668: Fix Error null check PHP 8.1 `yii\validators\FilterValidator` (samuelexyz)
 - Bug #19670: Fix Error null check PHP 8.1 `yii\rbac\DbManager` (samuelexyz)
 - Bug #19520: Fix for TIMESTAMP & ROWVERSION columns in MSSQL insert query (darkdef)
+- Bug #19581: Fix regression in `CompositeAuth` introduced in #19418 (SamMousa, WinterSilence, samdark)
 
 
 2.0.46 August 18, 2022

filters/auth/CompositeAuth.php

@@ -8,6 +8,7 @@
 namespace yii\filters\auth;
 
 use Yii;
+use yii\base\ActionFilter;
 use yii\base\Controller;
 use yii\base\InvalidConfigException;
 
@@ -73,10 +74,17 @@ public function authenticate($user, $request, $response)
 
             if (
                 $this->owner instanceof Controller
-                && (!isset($this->owner->action) || !$auth->isActive($this->owner->action))
+                && (
+                    !isset($this->owner->action)
+                    || (
+                        $auth instanceof ActionFilter
+                        && !$auth->isActive($this->owner->action)
+                    )
+                )
             ) {
                 continue;
             }
+
             $identity = $auth->authenticate($user, $request, $response);
             if ($identity !== null) {
                 return $identity;