Dropped unsafe usage of preg_replace

It could be tricked by apending /e\x00 to execute arbitrary php code.
The new code does simple string replace, we don't really need any of
regex stuff here.
Prevent null-byte injection in preg_replace()
Security: remove dots in template to avoid a remote code execution vulnerability
Security: block another case of remote execution vulnerability
ChangeLog entries for security fixes
3.5.8.1 release
Fix merge conflicts