Index: branches/5.0.x/core/kernel/nparser/nparser.php
===================================================================
diff -u -r12117 -r12229
--- branches/5.0.x/core/kernel/nparser/nparser.php	(.../nparser.php)	(revision 12117)
+++ branches/5.0.x/core/kernel/nparser/nparser.php	(.../nparser.php)	(revision 12229)
@@ -1,6 +1,6 @@
 <?php
 /**
-* @version	$Id: nparser.php 11934 2009-07-19 13:23:16Z alex $
+* @version	$Id: nparser.php 12229 2009-08-08 08:37:17Z alex $
 * @package	In-Portal
 * @copyright	Copyright (C) 1997 - 2009 Intechnic. All rights reserved.
 * @license      GNU/GPL
@@ -343,6 +343,11 @@
 
 	function Run($t, $silent=null)
 	{
+		if ((strpos($t, '../') !== false) || (trim($t) !== $t)) {
+			// when relative paths or special chars are found template names from url, then it's hacking attempt
+			return false;
+		}
+
 		$pre_parsed = $this->CheckTemplate($t, $silent);
 		if (!$pre_parsed) return false;
 		$backup_template = $this->TemplateName;