@@ -, +, @@ --- help.pl | 4 +++- 1 files changed, 3 insertions(+), 1 deletions(-) --- a/help.pl +++ a/help.pl @@ -32,7 +32,9 @@ our $refer = $query->param('url'); $refer = $query->referer() if !$refer || $refer eq 'undefined'; $refer =~ /koha\/(.*)\.pl/; -my $from = "help/$1.tt"; +my $file = $1; +$file =~ s/[^a-zA-Z_\-\/]*//g; +my $from = "help/$file.tt"; my $template = C4::Templates::gettemplate($from, 'intranet', $query); $template->param( referer => $refer ); --