getUser()->isAdmin()) { throw new Forbidden(); } return parent::actionList($params, $data, $request); } }