framework/filters/AccessControl.php
protected function denyAccess($user)
    {
        if ($user !== false && $user->getIsGuest()) {
            $user->loginRequired();
        } else {
            throw new ForbiddenHttpException(Yii::t('yii', 'You are not allowed to perform this action.'));
        }
    }
protected function denyAccess($user)
    {
        if ($user !== false && $user->getIsGuest()) {
            $user->loginRequired();
        } else {
            throw new ForbiddenHttpException(Yii::t('yii', 'You are not allowed to perform this action.'));
        }
    }
Denies the access of the user.
The default implementation will redirect the user to the login page if he is a guest;
if the user is already logged, a 403 HTTP exception will be thrown.
@param User|false $user the current user or boolean `false` in case of detached User component
@throws ForbiddenHttpException if the user is already logged in or in case of detached User component.