@@ -, +, @@ Notice you get a valid JSON response (You may have add more ..%2f or remove them to get the correct path) Notice you can see the contents of the /etc/passwd file --- svc/members/search | 4 +++- svc/virtualshelves/search | 4 +++- 2 files changed, 6 insertions(+), 2 deletions(-) --- a/svc/members/search +++ a/svc/members/search @@ -29,9 +29,11 @@ use Koha::DateUtils qw( output_pref dt_from_string ); my $input = new CGI; exit unless $input->param('template_path'); +my $template_path= $input->param('template_path'); + $template_path =~ s/[^a-zA-Z_-]*//; #sanitzie my ($template, $user, $cookie) = get_template_and_user({ - template_name => $input->param('template_path'), + template_name => $template_path, query => $input, type => "intranet", authnotrequired => 0, --- a/svc/virtualshelves/search +++ a/svc/virtualshelves/search @@ -12,8 +12,10 @@ my $input = new CGI; exit unless $input->param('template_path'); +my $template_path= $input->param('template_path'); + $template_path =~ s/[^a-zA-Z_-]*//; #sanitzie my ($template, $user, $cookie) = get_template_and_user({ - template_name => $input->param('template_path'), + template_name => $template_path, query => $input, type => "intranet", authnotrequired => 0, --