wikimedia / mediawiki

	 */

	protected function getTemplateFilename( $templateName ) {

		// Prevent upwards directory traversal using same methods as Title::secureAndSplit

		if (

			strpos( $templateName, '.' ) !== false &&

			(

				$templateName === '.' || $templateName === '..' ||

				strpos( $templateName, './' ) === 0 ||

				strpos( $templateName, '../' ) === 0 ||

				strpos( $templateName, '/./' ) !== false ||

				strpos( $templateName, '/../' ) !== false ||

				substr( $templateName, -2 ) === '/.' ||

				substr( $templateName, -3 ) === '/..'

			)

		) {

			throw new UnexpectedValueException( "Malformed \$templateName: $templateName" );

		}

		return "{$this->templateDir}/{$templateName}.mustache";

	}

		# Pages with "/./" or "/../" appearing in the URLs will often be un-

		# reachable due to the way web browsers deal with 'relative' URLs.

		# Also, they conflict with subpage syntax.  Forbid them explicitly.

		if (

			strpos( $dbkey, '.' ) !== false &&

			(

				$dbkey === '.' || $dbkey === '..' ||

				strpos( $dbkey, './' ) === 0 ||

				strpos( $dbkey, '../' ) === 0 ||

				strpos( $dbkey, '/./' ) !== false ||

				strpos( $dbkey, '/../' ) !== false ||

				substr( $dbkey, -2 ) == '/.' ||

				substr( $dbkey, -3 ) == '/..'

			)

		) {

			throw new MalformedTitleException( 'title-invalid-relative', $text );

		}

		# Magic tilde sequences? Nu-uh!

		if ( strpos( $dbkey, '~~~' ) !== false ) {