Index: branches/5.1.x/core/kernel/utility/debugger/debugger_responce.php
===================================================================
diff -u -r12127 -r12657
--- branches/5.1.x/core/kernel/utility/debugger/debugger_responce.php	(.../debugger_responce.php)	(revision 12127)
+++ branches/5.1.x/core/kernel/utility/debugger/debugger_responce.php	(.../debugger_responce.php)	(revision 12657)
@@ -1,6 +1,6 @@
 <?php
 /**
-* @version	$Id: debugger_responce.php 11892 2009-07-01 08:35:06Z alex $
+* @version	$Id: debugger_responce.php 12657 2009-10-04 20:07:31Z alex $
 * @package	In-Portal
 * @copyright	Copyright (C) 1997 - 2009 Intechnic. All rights reserved.
 * @license      GNU/GPL
@@ -17,7 +17,13 @@
 	define('FULL_PATH', realpath(dirname(__FILE__).'/../../../..') );
 
 	$sid = $_GET['sid'];
-	$path = isset($_GET['path']) ? $_GET['path'] : '/kernel/cache';
+	$path = isset($_GET['path']) ? $_GET['path'] : '/system/cache';
+
+	if ((strpos($path, '../') !== false) || (trim($path) !== $path)) {
+		// when relative paths or special chars are found template names from url, then it's hacking attempt
+		exit;
+	}
+
 	if (!preg_match('/^@([\d]+)@$/', $sid)) exit;
 
 	$debug_file = FULL_PATH.$path.'/debug_'.$sid.'.txt';