Index: branches/5.0.x/core/kernel/parser/template_parser.php
===================================================================
diff -u -r12117 -r12281
--- branches/5.0.x/core/kernel/parser/template_parser.php	(.../template_parser.php)	(revision 12117)
+++ branches/5.0.x/core/kernel/parser/template_parser.php	(.../template_parser.php)	(revision 12281)
@@ -1,6 +1,6 @@
 <?php
 /**
-* @version	$Id: template_parser.php 11892 2009-07-01 08:35:06Z alex $
+* @version	$Id: template_parser.php 12281 2009-08-13 19:54:08Z alex $
 * @package	In-Portal
 * @copyright	Copyright (C) 1997 - 2009 Intechnic. All rights reserved.
 * @license      GNU/GPL
@@ -440,6 +440,11 @@
 
 	function ParseTemplate($name, $pre_parse = 1, $params=array(), $silent=0)
 	{
+		if ((strpos($name, '../') !== false) || (trim($name) !== $name)) {
+			// when relative paths or special chars are found template names from url, then it's hacking attempt
+			return false;
+		}
+
 		$this->FromPreParseCache = false;
 		if ($this->GetParam('from_inportal')) $pre_parse = 0;
 		if ($pre_parse) {