@@ -0,0 +1,966 @@
+package com.celements.web;%0A%0Aimport java.net.URI;%0A%0Aimport org.apache.commons.logging.Log;%0Aimport org.apache.commons.logging.LogFactory;%0Aimport org.apache.velocity.app.event.IncludeEventHandler;%0A%0Apublic class XWikiIncludeEventHandler implements IncludeEventHandler %7B%0A%0A  private static Log mLogger = LogFactory.getFactory().getInstance(%0A      XWikiIncludeEventHandler.class);%0A%0A  public String includeEvent(String includeResourcePath, String currentResourcePath,%0A      String directiveName) %7B%0A    mLogger.trace(%22velocity include event: %5B%22 + includeResourcePath + %22%5D, %5B%22%0A        + currentResourcePath + %22%5D, %5B%22 + directiveName + %22%5D%22);%0A    String template = URI.create(%22/templates/%22 + includeResourcePath).normalize(%0A        ).toString();%0A    if (!template.startsWith(%22/templates/%22)) %7B%0A        mLogger.warn(%22Illegal access, tried to use file %5B%22 + template%0A            + %22%5D as a template. Possible break-in attempt!%22);%0A        return null;%0A    %7D%0A    return template;%0A  %7D%0A%0A%7D%0A

fix velocity parse and include paths