@@ -, +, @@ error with Bad template path in the logs. sco/printslip.pl where an absolute path is passed to gettemplate or get_template_and_user. I already tried several regex variations while git grepping template_name, but you may still find one.. --- opac/sco/printslip.pl | 2 +- svc/members/search | 10 +++++++--- 2 files changed, 8 insertions(+), 4 deletions(-) --- a/opac/sco/printslip.pl +++ a/opac/sco/printslip.pl @@ -45,7 +45,7 @@ my $error = $input->param('error'); # patrons still need to be able to print receipts my ( $template, $loggedinuser, $cookie ) = get_template_and_user( { - template_name => "/sco/printslip.tt", + template_name => "sco/printslip.tt", query => $input, type => "opac", } --- a/svc/members/search +++ a/svc/members/search @@ -28,11 +28,15 @@ use Koha::DateUtils qw( output_pref dt_from_string ); use Koha::Patrons; my $input = new CGI; - -exit unless $input->param('template_path'); +my $template_path = $input->param('template_path'); +if( !$template_path || $template_path =~ /^\/|\.\./ ) { + # Do not allow absolute paths here + warn 'Bad template path'; + exit; +} my ($template, $user, $cookie) = get_template_and_user({ - template_name => scalar $input->param('template_path'), + template_name => $template_path, query => $input, type => "intranet", authnotrequired => 0, --