I think any patch that goes in should work for any templating engine.
So a check for directory traversal needs to happen in this patch.

I would claim that the function reformTplName should do all the
security checks. This way we are protected even if we add another
templating engine someday.

I think that is preferable to adding a check for ../ to the
tal templating code.