block_url()
function block_url(string $block_path = ''): void
Description
Blocks direct browser access to a module or a specific module-method combination, while allowing unrestricted internal access from PHP code. This function provides fine-grained control over URL access, allowing you to protect entire modules or individual methods depending on where you call it.
When invoked, the function inspects the current URL segments and compares them
against the supplied module or module/method string in $block_path.
If a match is detected, the request is immediately terminated with a 403 Forbidden response.
Performance Note: This function performs a lightweight string comparison and exits early, making it fast and safe for preventing direct URL invocation.
Parameters
| Parameter | Type | Description |
|---|---|---|
| $block_path | string |
The module name or module/method combination to block.
Examples: 'reports' to block all methods in the module,
or 'reports/generate_pdf' to block a specific method.
|
Return Value
| Type | Description |
|---|---|
| void |
Does not return a value. If the URL matches the blocked target in $block_path,
execution stops immediately and a 403 response is sent.
|
Example 1: Blocking an Individual Method
Call block_url() at the start of any method to protect just that method
while leaving others accessible via URL:
The result:
/reports/dashboard→ ✓ Works/reports/generate_pdf→ ✗ Returns 403 Forbidden$this->reports->generate_pdf()→ ✓ Works from code
Example 2: Blocking an Entire Module
Call block_url() inside a constructor to block all methods in the module
from being accessed via URL. Ideal for utility modules like payment processors,
email handlers, or background workers:
The result:
/payment/process_charge→ ✗ Returns 403 Forbidden/payment/refund→ ✗ Returns 403 Forbidden$this->payment->process_charge(100)→ ✓ Works from code$this->payment->refund('txn_123')→ ✓ Works from code
Example 3: Child Module
For modules nested inside other modules, the pattern is identical:
Example 4: Standalone Utility Class
If your class does not extend Trongate, pass a hard-coded module name:
Warning: Do not use block_url() on modules that appear
in your custom routing
configuration. Mixing the two creates complex behaviour and hard-to-debug issues.
When to Use block_url()
In a method:
- Protect a specific method from direct URL access while allowing other methods to remain public
In a constructor:
- Block the entire module from URL access
- All methods remain callable from internal code
- Provides blanket protection with a single call