Index: branches/5.0.x/core/kernel/nparser/nparser.php
===================================================================
diff -u -r12117 -r12229
--- branches/5.0.x/core/kernel/nparser/nparser.php	(.../nparser.php)	(revision 12117)
+++ branches/5.0.x/core/kernel/nparser/nparser.php	(.../nparser.php)	(revision 12229)
@@ -1,6 +1,6 @@
 <?php
 /**
-* @version	$Id: nparser.php 11934 2009-07-19 13:23:16Z alex $
+* @version	$Id: nparser.php 12229 2009-08-08 08:37:17Z alex $
 * @package	In-Portal
 * @copyright	Copyright (C) 1997 - 2009 Intechnic. All rights reserved.
 * @license      GNU/GPL
@@ -343,6 +343,11 @@
 
 	function Run($t, $silent=null)
 	{
+		if ((strpos($t, '../') !== false) || (trim($t) !== $t)) {
+			// when relative paths or special chars are found template names from url, then it's hacking attempt
+			return false;
+		}
+
 		$pre_parsed = $this->CheckTemplate($t, $silent);
 		if (!$pre_parsed) return false;
 		$backup_template = $this->TemplateName;
Index: branches/5.0.x/core/kernel/parser/template.php
===================================================================
diff -u -r12202 -r12229
--- branches/5.0.x/core/kernel/parser/template.php	(.../template.php)	(revision 12202)
+++ branches/5.0.x/core/kernel/parser/template.php	(.../template.php)	(revision 12229)
@@ -1,6 +1,6 @@
 <?php
 /**
-* @version	$Id: template.php 12202 2009-08-05 16:52:45Z dmitrya $
+* @version	$Id: template.php 12229 2009-08-08 08:37:17Z alex $
 * @package	In-Portal
 * @copyright	Copyright (C) 1997 - 2009 Intechnic. All rights reserved.
 * @license      GNU/GPL
@@ -227,10 +227,17 @@
 
 	function TemplateExists($filename)
 	{
+		if ((strpos($filename, '../') !== false) || (trim($filename) !== $filename)) {
+			// when relative paths or special chars are found template names from url, then it's hacking attempt
+			return false;
+		}
+
 		$real_file = $this->GetRealFilename( strtolower($filename) );
-		if (!preg_match('/\.tpl$/', $real_file)) {
+		if (substr($real_file, -4) != '.tpl') {
+			// add ".tpl" file extension, when not specified in template name
 			$real_file .= '.tpl';
 		}
+
 		return file_exists($real_file);
 	}