diff -ubBr koha-3.18.08.orig/C4/Auth.pm koha-3.18.08/C4/Auth.pm --- koha-3.18.08.orig/C4/Auth.pm 2015-08-14 06:09:28.000000000 +0000 +++ koha-3.18.08/C4/Auth.pm 2015-08-14 06:10:04.000000000 +0000 @@ -157,7 +157,7 @@ C4::Context->interface( $in->{type} ); - my $safe_chars = 'a-zA-Z0-9_\-\/'; + my $safe_chars = 'a-zA-Z0-9_\.\-\/'; die "bad template path" unless $in->{'template_name'} =~ m/^[$safe_chars]+\.tt$/ig; #sanitize input $in->{'authnotrequired'} ||= 0;