Check that course_info.txt file is inside the template directory before ...

...serving contents.

Die if the file is not under the templates directory.  Other files
were carefully checked, this one was omitted by accident.

The sites.conf file is still not protected -- that code can read any file and the location can be changed in course.conf, overriding default.config.
A reasonable fix for this is to set the permissions for course.conf so that it cannot be edited using FileManager (i.e. not editable by the server). Editing
that file from the web is dangerous in any case.

The die command gives error information that includes the line where it is called and a stack trace.  We should be able to turn this off for production.