added permission check

and remove double tpl.php extension