From 1eee953f62653b30f6c46ec0b8c3b9b4e1a7997e Mon Sep 17 00:00:00 2001
From: Mike McCabe <mccabe615@gmail.com>
Date: Mon, 23 Feb 2015 20:36:53 -0500
Subject: [PATCH] adding render vuln

---
 app/controllers/dashboard_controller.rb | 5 ++++-
 app/views/dashboard/home.html.erb       | 4 +++-
 config/routes.rb                        | 2 +-
 3 files changed, 8 insertions(+), 3 deletions(-)
 mode change 100755 => 100644 app/controllers/dashboard_controller.rb
 mode change 100755 => 100644 app/views/dashboard/home.html.erb
 mode change 100755 => 100644 config/routes.rb

diff --git a/app/controllers/dashboard_controller.rb b/app/controllers/dashboard_controller.rb
old mode 100755
new mode 100644
index 8b351bf..cfa0921
--- a/app/controllers/dashboard_controller.rb
+++ b/app/controllers/dashboard_controller.rb
@@ -22,5 +22,8 @@ class DashboardController < ApplicationController
      @user = current_user
      render :partial => "layouts/dashboard/dashboard_stats"
   end
-  
+
+  def doc
+    render "../../doc/" + params[:doc]
+  end 
 end
diff --git a/app/views/dashboard/home.html.erb b/app/views/dashboard/home.html.erb
old mode 100755
new mode 100644
index 5b0811a..cee5c39
--- a/app/views/dashboard/home.html.erb
+++ b/app/views/dashboard/home.html.erb
@@ -27,13 +27,15 @@
 		        </div>
 			  </div>
 			</div>	
-
+			<center><b>Need help using this portal? Check out the <a href="doc?doc=README_FOR_APP">Readme</a></b></center>
         </div> <!-- end span12 -->
     </div>
   </div>
 </div>
 
 
+
+
 <script type="text/javascript">
 
 function makeActive(){
diff --git a/config/routes.rb b/config/routes.rb
old mode 100755
new mode 100644
index 35ef733..723b5b1
--- a/config/routes.rb
+++ b/config/routes.rb
@@ -6,7 +6,7 @@ Railsgoat::Application.routes.draw do
   match "forgot_password" => "password_resets#forgot_password"
   get "password_resets" => "password_resets#confirm_token"
   post "password_resets" => "password_resets#reset_password"
-
+  get "dashboard/doc" => "dashboard#doc"
 
   resources :sessions do
   end