public function beforeDelete() { if ($this->to_user_id != Yii::app()->user->id) { throw new CHttpException(403); } return parent::beforeDelete(); }