	public function load_from_post()
	{
		$this->title  		= $_REQUEST['title'];
		$this->file			= $_REQUEST['file'];
		$this->permission	= intval($_REQUEST['permission']);
		$this->enabled		= intval($_REQUEST['enabled']);	
		
		// sections
		$this->sections		= array();
		for($s = 0; $s < count($_REQUEST['template-sections-code']); $s++)
		{
			if(empty($_REQUEST['template-sections-code'][$s])) continue;
			$this->sections[] = array(
			    'code' => $_REQUEST['template-sections-code'][$s],
				'name' => $_REQUEST['template-sections-name'][$s],
				'editor' => $_REQUEST['template-sections-editor'][$s],
				'width' => $_REQUEST['template-sections-width'][$s]
            );
		}
		if(empty($this->sections))
		{
			$this->sections = array(
				0 => array(
					'code' => 'id',
					'name' => '#main#',
					'editor' => 'tinymce',
					'width' => '960'
				)
			);
		}
		
		$this->gallery		= intval($_REQUEST['gallery']);	
		$this->comments		= intval($_REQUEST['comments']);	
		$this->tags			= intval($_REQUEST['tags']);	
		$this->statistics	= intval($_REQUEST['statistics']);								
	}

The software uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the software does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.