From a0842b4f1cfe9f567bf30a855ca83c46848969e1 Mon Sep 17 00:00:00 2001
From: Giuseppe Criscione <giuseppepeocriscione@gmail.com>
Date: Mon, 18 Mar 2019 13:08:22 +0100
Subject: [PATCH] Improve `Template::insert()` providing filename checks

---
 formwork/Core/Template.php | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/formwork/Core/Template.php b/formwork/Core/Template.php
index 94a857d4..f6c42a88 100755
--- a/formwork/Core/Template.php
+++ b/formwork/Core/Template.php
@@ -141,15 +141,26 @@ class Template
     }
 
     /**
-     * Insert a partial template
+     * Insert a template
      *
-     * @param string $filename
+     * @param string $name
      * @param array  $vars
      */
-    protected function insert($filename, $vars = array())
+    protected function insert($name, $vars = array())
     {
+        if ($name[0] === '_') {
+            $name = 'partials' . DS . substr($name, 1);
+        }
+
+        $filename = $this->path . $name . $this->extension;
+
+        if (!FileSystem::exists($filename)) {
+            throw new RuntimeException('Template ' . $name . ' not found');
+        }
+
         extract(array_merge($this->vars, $vars));
-        include $this->path . str_replace('_', 'partials' . DS, $filename) . $this->extension;
+
+        include $filename;
     }
 
     /**