kernel/core/Security.php
public function checkSecurity() {

		foreach (Config::get('route') as $sHost => $oHost) {

			if ((!strstr($sHost, '/') && $sHost == $_SERVER['HTTP_HOST'])
				|| (strstr($sHost, '/') && strstr($_SERVER['HTTP_HOST'].$_SERVER['REQUEST_URI'], $sHost))) {

				if (strstr($sHost, '/') && strstr($_SERVER['HTTP_HOST'].$_SERVER['REQUEST_URI'], $sHost)) {

					$this->_sBaseUri = preg_replace('#^[^/]+#', '', $sHost);
				}

				if (isset($oSecurity->firewall)) { $oSecurity = $oHost->firewall; }
			}
		}

		if (isset($oSecurity)) {

			if (isset($oSecurity->authentification) && $oSecurity->authentification === 'http_basic') {

				if (!isset($_SERVER['PHP_AUTH_USER'])) {

					if (!isset($oSecurity->realm)) { $oSecurity->realm = 'Access'; }
					if (!isset($oSecurity->cancelled)) { $oSecurity->cancelled = 'Cancelled'; }

					header('WWW-Authenticate: Basic realm="'.$oSecurity->realm.'"');
					header('HTTP/1.0 401 Unauthorized');
					echo $oSecurity->cancelled;
					exit;
				} else {

					self::$_sLogin = $_SERVER['PHP_AUTH_USER'];
					self::$_sPassword = $_SERVER['PHP_AUTH_PW'];

					if (!$this->_checkPasswordIsGood()) { return false; }
					if (!$this->_checkAccess()) { return false; }
					if (!$this->_checkBlackListIps()) { return false; }
				}
			}
			else if (isset($oSecurity->authentification) && $oSecurity->authentification === 'http_basic_validate_by_controller') {

				if (!isset($_SERVER['PHP_AUTH_USER'])) {

					if (!isset($oSecurity->realm)) { $oSecurity->realm = 'Access'; }
					if (!isset($oSecurity->cancelled)) { $oSecurity->cancelled = 'Cancelled'; }

					header('WWW-Authenticate: Basic realm="'.$oSecurity->realm.'"');
					header('HTTP/1.0 401 Unauthorized');
					echo $oSecurity->cancelled;
					exit;
				} else {

					self::$_sLogin = $_SERVER['PHP_AUTH_USER'];
					self::$_sPassword = $_SERVER['PHP_AUTH_PW'];

					$sControllerName = $oSecurity->controller;
					$sActionName = $oSecurity->action;

					$oController = new $sControllerName;

					if (!$oController->$sActionName(self::$_sLogin, self::$_sPassword)) { return false; }
					if (!$this->_checkAccess()) { return false; }
					if (!$this->_checkBlackListIps()) { return false; }
				}
			} else if (isset($oSecurity->authentification) && $oSecurity->authentification === 'controller') {

				// it's an action of one controller that it return true or false for the authentification

				$sControllerName = $oSecurity->controller;
				$sActionName = $oSecurity->action;

				$oController = new $sControllerName;

				if (!$oController->$sActionName) { return false; }
				if (!$this->_checkAccess()) { return false; }
				if (!$this->_checkBlackListIps()) { return false; }
			}

			if (isset($oSecurity->ips) && !in_array($_SERVER['REMOTE_ADDR'], $oSecurity->ips)) { return false; }

			if (isset($oSecurity->requires_channel) && $oSecurity->requires_channel == 'https' && !Request::isHttpsRequest()) {

				return false;
			} else if (isset($oSecurity->requires_channel) && $oSecurity->requires_channel == 'http' && ((Request::isHttpRequest()
				&& Request::isHttpsRequest()) || !Request::isHttpRequest())) {

				return false;
			}
		}

		return true;
	}
public function checkSecurity() {

		foreach (Config::get('route') as $sHost => $oHost) {

			if ((!strstr($sHost, '/') && $sHost == $_SERVER['HTTP_HOST'])
				|| (strstr($sHost, '/') && strstr($_SERVER['HTTP_HOST'].$_SERVER['REQUEST_URI'], $sHost))) {

				if (strstr($sHost, '/') && strstr($_SERVER['HTTP_HOST'].$_SERVER['REQUEST_URI'], $sHost)) {

					$this->_sBaseUri = preg_replace('#^[^/]+#', '', $sHost);
				}

				if (isset($oSecurity->firewall)) { $oSecurity = $oHost->firewall; }
			}
		}

		if (isset($oSecurity)) {

			if (isset($oSecurity->authentification) && $oSecurity->authentification === 'http_basic') {

				if (!isset($_SERVER['PHP_AUTH_USER'])) {

					if (!isset($oSecurity->realm)) { $oSecurity->realm = 'Access'; }
					if (!isset($oSecurity->cancelled)) { $oSecurity->cancelled = 'Cancelled'; }

					header('WWW-Authenticate: Basic realm="'.$oSecurity->realm.'"');
					header('HTTP/1.0 401 Unauthorized');
					echo $oSecurity->cancelled;
					exit;
				} else {

					self::$_sLogin = $_SERVER['PHP_AUTH_USER'];
					self::$_sPassword = $_SERVER['PHP_AUTH_PW'];

					if (!$this->_checkPasswordIsGood()) { return false; }
					if (!$this->_checkAccess()) { return false; }
					if (!$this->_checkBlackListIps()) { return false; }
				}
			}
			else if (isset($oSecurity->authentification) && $oSecurity->authentification === 'http_basic_validate_by_controller') {

				if (!isset($_SERVER['PHP_AUTH_USER'])) {

					if (!isset($oSecurity->realm)) { $oSecurity->realm = 'Access'; }
					if (!isset($oSecurity->cancelled)) { $oSecurity->cancelled = 'Cancelled'; }

					header('WWW-Authenticate: Basic realm="'.$oSecurity->realm.'"');
					header('HTTP/1.0 401 Unauthorized');
					echo $oSecurity->cancelled;
					exit;
				} else {

					self::$_sLogin = $_SERVER['PHP_AUTH_USER'];
					self::$_sPassword = $_SERVER['PHP_AUTH_PW'];

					$sControllerName = $oSecurity->controller;
					$sActionName = $oSecurity->action;

					$oController = new $sControllerName;

					if (!$oController->$sActionName(self::$_sLogin, self::$_sPassword)) { return false; }
					if (!$this->_checkAccess()) { return false; }
					if (!$this->_checkBlackListIps()) { return false; }
				}
			} else if (isset($oSecurity->authentification) && $oSecurity->authentification === 'controller') {

				// it's an action of one controller that it return true or false for the authentification

				$sControllerName = $oSecurity->controller;
				$sActionName = $oSecurity->action;

				$oController = new $sControllerName;

				if (!$oController->$sActionName) { return false; }
				if (!$this->_checkAccess()) { return false; }
				if (!$this->_checkBlackListIps()) { return false; }
			}

			if (isset($oSecurity->ips) && !in_array($_SERVER['REMOTE_ADDR'], $oSecurity->ips)) { return false; }

			if (isset($oSecurity->requires_channel) && $oSecurity->requires_channel == 'https' && !Request::isHttpsRequest()) {

				return false;
			} else if (isset($oSecurity->requires_channel) && $oSecurity->requires_channel == 'http' && ((Request::isHttpRequest()
				&& Request::isHttpsRequest()) || !Request::isHttpRequest())) {

				return false;
			}
		}

		return true;
	}
check security of access

@access public
@return null|boolean