Index: branches/5.0.x/core/kernel/utility/debugger/debugger_responce.php
===================================================================
diff -u -r12117 -r12277
--- branches/5.0.x/core/kernel/utility/debugger/debugger_responce.php	(.../debugger_responce.php)	(revision 12117)
+++ branches/5.0.x/core/kernel/utility/debugger/debugger_responce.php	(.../debugger_responce.php)	(revision 12277)
@@ -1,6 +1,6 @@
 <?php
 /**
-* @version	$Id: debugger_responce.php 11892 2009-07-01 08:35:06Z alex $
+* @version	$Id: debugger_responce.php 12277 2009-08-12 14:15:49Z alex $
 * @package	In-Portal
 * @copyright	Copyright (C) 1997 - 2009 Intechnic. All rights reserved.
 * @license      GNU/GPL
@@ -18,6 +18,12 @@
 
 	$sid = $_GET['sid'];
 	$path = isset($_GET['path']) ? $_GET['path'] : '/kernel/cache';
+
+	if ((strpos($path, '../') !== false) || (trim($path) !== $path)) {
+		// when relative paths or special chars are found template names from url, then it's hacking attempt
+		exit;
+	}
+
 	if (!preg_match('/^@([\d]+)@$/', $sid)) exit;
 
 	$debug_file = FULL_PATH.$path.'/debug_'.$sid.'.txt';