do not call afterAction() if beforeAction returned false

framework/CHANGELOG.md

@@ -9,6 +9,7 @@ Yii Framework 2 Change Log
 - Bug #5314: Fixed typo in the implementation of `yii\web\Session::getHasSessionId()` (qiangxue)
 - Bug #5323: Nested dropdown does not work for `yii\bootstrap\DropDown` (aryraditya)
 - Bug #5336: `yii\bootstrap\DropDown` should register bootstrap plugin asset (zelenin)
+- Bug #5379: `Module::afterAction()` was called even when `beforeAction()` returned false (cebe)
 - Bug: Date and time formatting now assumes UTC as the timezone for input dates unless a timezone is explicitly given (cebe)
 - Enh #4040: Added `$viewFile` and `$params` to the `EVENT_BEFORE_RENDER` and `EVENT_AFTER_RENDER` events for `View` (qiangxue) 
 - Enh #4275: Added `removeChildren()` to `yii\rbac\ManagerInterface` and implementations (samdark)

framework/base/Controller.php

@@ -134,6 +134,7 @@ class Controller extends Component implements ViewContextInterface
         $modules = [];
         $runAction = true;
 
+        // call beforeAction on modules
         foreach ($this->getModules() as $module) {
             if ($module->beforeAction($action)) {
                 array_unshift($modules, $module);
@@ -145,17 +146,18 @@ class Controller extends Component implements ViewContextInterface
 
         $result = null;
 
-        if ($runAction) {
-            if ($this->beforeAction($action)) {
+        if ($runAction && $this->beforeAction($action)) {
+            // run the action
             $result = $action->runWithParams($params);
+
             $result = $this->afterAction($action, $result);
-            }
-        }
 
+            // call afterAction on modules
             foreach ($modules as $module) {
                 /* @var $module Module */
                 $result = $module->afterAction($action, $result);
             }
+        }
 
         $this->action = $oldAction;