View | Details | Raw Unified | Return to bug 17989
Collapse All | Expand All

(-)a/opac/sco/printslip.pl (-1 / +1 lines)
Lines 45-51 my $error = $input->param('error'); Link Here
45
# patrons still need to be able to print receipts
45
# patrons still need to be able to print receipts
46
my ( $template, $loggedinuser, $cookie ) = get_template_and_user(
46
my ( $template, $loggedinuser, $cookie ) = get_template_and_user(
47
    {
47
    {
48
        template_name   => "/sco/printslip.tt",
48
        template_name   => "sco/printslip.tt",
49
        query           => $input,
49
        query           => $input,
50
        type            => "opac",
50
        type            => "opac",
51
    }
51
    }
(-)a/svc/members/search (-4 / +7 lines)
Lines 28-38 use Koha::DateUtils qw( output_pref dt_from_string ); Link Here
28
use Koha::Patrons;
28
use Koha::Patrons;
29
29
30
my $input = new CGI;
30
my $input = new CGI;
31
31
my $template_path = $input->param('template_path');
32
exit unless $input->param('template_path');
32
if( !$template_path || $template_path =~ /^\/|\.\./ ) {
33
    # Do not allow absolute paths here
34
    warn 'Bad template path';
35
    exit;
36
}
33
37
34
my ($template, $user, $cookie) = get_template_and_user({
38
my ($template, $user, $cookie) = get_template_and_user({
35
    template_name   => scalar $input->param('template_path'),
39
    template_name   => $template_path,
36
    query           => $input,
40
    query           => $input,
37
    type            => "intranet",
41
    type            => "intranet",
38
    authnotrequired => 0,
42
    authnotrequired => 0,
39
- 

Return to bug 17989