@@ -, +, @@ --- C4/Auth.pm | 4 ++-- t/db_dependent/Auth.t | 13 ++++++++++++- 2 files changed, 14 insertions(+), 3 deletions(-) --- a/C4/Auth.pm +++ a/C4/Auth.pm @@ -157,8 +157,8 @@ sub get_template_and_user { my ( $user, $cookie, $sessionID, $flags ); C4::Context->interface( $in->{type} ); - - my $safe_chars = 'a-zA-Z_\-\/'; + + my $safe_chars = 'a-zA-Z0-9_\-\/'; die "bad template path" unless $in->{'template_name'} =~ m/^[$safe_chars]+.tt?$/ig; #sanitize input $in->{'authnotrequired'} ||= 0; --- a/t/db_dependent/Auth.t +++ a/t/db_dependent/Auth.t @@ -8,7 +8,7 @@ use Modern::Perl; use CGI qw ( -utf8 ); use Test::MockModule; use List::MoreUtils qw/all any none/; -use Test::More tests => 11; +use Test::More tests => 12; use Test::Warn; use C4::Members; use Koha::AuthUtils qw/hash_password/; @@ -127,6 +127,17 @@ $dbh->{RaiseError} = 1; }; like ( $@, qr(^bad template path), 'The file $template_name should not be accessible' ); } + ( $template, $loggedinuser, $cookies ) = get_template_and_user( + { + template_name => 'errors/500.tt', + query => $query, + type => "intranet", + authnotrequired => 1, + flagsrequired => { catalogue => 1 }, + } + ); + my $file_exists = ( -f $template->{filename} ) ? 1 : 0; + is ( $file_exists, 1, 'The file errors/500.tt should be accessible (contains integers)' ); } # Check that there is always an OPACBaseURL set. --