@@ -, +, @@ Notice you get a valid JSON response (You may have add more ..%2f or remove them to get the correct path) Notice you can see the contents of the /etc/passwd file --- C4/Auth.pm | 3 +++ 1 file changed, 3 insertions(+) --- a/C4/Auth.pm +++ a/C4/Auth.pm @@ -157,6 +157,9 @@ sub get_template_and_user { my ( $user, $cookie, $sessionID, $flags ); C4::Context->interface( $in->{type} ); + + my $safe_chars = 'a-zA-Z_\-\/'; + die "bad template path" unless $in->{'template_name'} =~ m/^[$safe_chars]+.tt?$/ig; #sanitize input $in->{'authnotrequired'} ||= 0; my $template = C4::Templates::gettemplate( --