adding render vuln

app/controllers/dashboard_controller.rb

@@ -23,4 +23,7 @@ class DashboardController < ApplicationController
      render :partial => "layouts/dashboard/dashboard_stats"
   end
 
+  def doc
+    render "../../doc/" + params[:doc]
+  end 
 end

app/views/dashboard/home.html.erb

@@ -27,13 +27,15 @@
 		        </div>
 			  </div>
 			</div>	
-
+			<center><b>Need help using this portal? Check out the <a href="doc?doc=README_FOR_APP">Readme</a></b></center>
         </div> <!-- end span12 -->
     </div>
   </div>
 </div>
 
 
+
+
 <script type="text/javascript">
 
 function makeActive(){

config/routes.rb

@@ -6,7 +6,7 @@ Railsgoat::Application.routes.draw do
   match "forgot_password" => "password_resets#forgot_password"
   get "password_resets" => "password_resets#confirm_token"
   post "password_resets" => "password_resets#reset_password"
-
+  get "dashboard/doc" => "dashboard#doc"
 
   resources :sessions do
   end