Fixed the security hole (really, I'm a moron - used $failed > $threshold instead of $failed >= $threashold) and patched up some...erm... math issues
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<title>{$lang_template_title}</title>
<script language="javascript" type="text/javascript" src="../../tiny_mce_popup.js"></script>
<script language="javascript" type="text/javascript" src="jscripts/template.js"></script>
<link href="css/template.css" rel="stylesheet" type="text/css" />
<base target="_self" />
</head>
<body onload="tinyMCEPopup.executeOnLoad('TPU.init();');" onresize="TPU.resizeInputs();">
<form onsubmit="insert();return false;">
<div id="frmbody">
<div class="title">{$lang_template_desc}</div>
<div class="frmRow"><label for="tpath" title="{$lang_template_select}">{$lang_template_label}:</label>
<select id="tpath" name="tpath" onfocus="tinyMCE.addSelectAccessibility(event, this, window);" onchange="TPU.selectTemplate(this.options[this.selectedIndex]);">
<option value="">{$lang_template_select}...</option>
</select>
<span id="warning"></span></div>
<div class="frmRow"><label for="tdesc">{$lang_template_desc_label}:</label>
<span id="tmpldesc"></span></div>
<fieldset>
<legend>{$lang_template_preview}</legend>
<iframe id="templatesrc" name="templatesrc" src="blank.htm" width="690" height="400" frameborder="0"></iframe>
</fieldset>
</div>
<div class="mceActionPanel">
<div style="float: left">
<input type="button" id="insert" name="insert" value="{$lang_insert}" onclick="TPU.insertTemplate();" />
</div>
<div style="float: right">
<input type="button" id="cancel" name="cancel" value="{$lang_cancel}" onclick="tinyMCEPopup.close();" />
</div>
</div>
</form>
</body>
</html>