CVE-2017-8052

@@ -11,6 +11,9 @@ Craft CMS Changelog
 ### Fixed
 - Fixed timezone bug when requesting data for a run chart in `\Craft\ChartHelper::getRunChartDataFromQuery()`
 
+### Security
+- Fixed an XSS vulnerability.
+
 ## 2.6.2973 - 2017-04-17
 
 ### Added

@@ -38,6 +38,19 @@ class TemplatesController extends BaseController
 	// Public Methods
 	// =========================================================================
 
+	/**
+	 * Prevent this controller from being accessed directly
+	 */
+	public function beforeAction($action)
+	{
+		$actionSegments = craft()->request->getActionSegments();
+		if (isset($actionSegments[0]) && $actionSegments[0] === 'templates') {
+			throw new HttpException(403);
+		}
+
+		return parent::beforeAction($action); // TODO: Change the autogenerated stub
+	}
+
 	/**
 	 * Renders a template.
 	 *