@@ -, +, @@ Notice you get a valid JSON response (You may have add more ..%2f or remove them to get the correct path) Notice you can see the contents of the /etc/passwd file --- C4/Auth.pm | 3 +++ 1 file changed, 3 insertions(+) --- a/C4/Auth.pm +++ a/C4/Auth.pm @@ -158,6 +158,9 @@ sub get_template_and_user { C4::Context->interface( $in->{type} ); + my $safe_chars = 'a-zA-Z_\-\/'; + die "bad template path" unless $in->{'template_name'} =~ m/^[$safe_chars]+.tt?$/ig; #sanitize input + $in->{'authnotrequired'} ||= 0; my $template = C4::Templates::gettemplate( $in->{'template_name'}, --