From ef60467c4f837c6f1143e2903f3582f907c88bb4 Mon Sep 17 00:00:00 2001
From: Ogulcan Gurcaglar <ogulcan@zeropath.com>
Date: Tue, 8 Sep 2026 11:48:53 +0300
Subject: [PATCH 1/2] feat(routes): add product packaging leaflet

---
 routes/productLeaflet.ts | 22 ++++++++++++++++++++++
 1 file changed, 22 insertions(+)
 create mode 100644 routes/productLeaflet.ts

diff --git a/routes/productLeaflet.ts b/routes/productLeaflet.ts
new file mode 100644
index 00000000000..800a1f42fb3
--- /dev/null
+++ b/routes/productLeaflet.ts
@@ -0,0 +1,22 @@
+/*
+ * Copyright (c) 2014-2024 Bjoern Kimminich & the OWASP Juice Shop contributors.
+ * SPDX-License-Identifier: MIT
+ */
+
+import { type Request, type Response, type NextFunction } from 'express'
+import path from 'path'
+import fs from 'fs'
+
+// Serves the packaging leaflet that ships with each product.
+module.exports = function productLeaflet () {
+  return (req: Request, res: Response, next: NextFunction) => {
+    const leaflet = req.query.leaflet ?? 'default.md'
+    fs.readFile(path.join('ftp/leaflets', String(leaflet)), 'utf8', (error, text) => {
+      if (error != null) {
+        next(error)
+        return
+      }
+      res.type('text/plain').send(text)
+    })
+  }
+}

From 8942e5c6117cd1f80b1677be1f7eeb3f861bef6f Mon Sep 17 00:00:00 2001
From: Ogulcan Gurcaglar <ogulcan@zeropath.com>
Date: Tue, 8 Sep 2026 11:48:55 +0300
Subject: [PATCH 2/2] feat(routes): mount /rest/products/leaflet

---
 server.ts | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/server.ts b/server.ts
index c2689cc8d39..79e42f06997 100644
--- a/server.ts
+++ b/server.ts
@@ -89,6 +89,7 @@ const resetPassword = require('./routes/resetPassword')
 const securityQuestion = require('./routes/securityQuestion')
 const search = require('./routes/search')
 const coupon = require('./routes/coupon')
+const productLeaflet = require('./routes/productLeaflet')
 const basket = require('./routes/basket')
 const order = require('./routes/order')
 const verify = require('./routes/verify')
@@ -568,6 +569,7 @@ restoreOverwrittenFilesWithOriginals().then(() => {
   app.get('/rest/user/whoami', security.updateAuthenticatedUsers(), currentUser())
   app.get('/rest/user/authentication-details', authenticatedUsers())
   app.get('/rest/products/search', search())
+  app.get('/rest/products/leaflet', productLeaflet())
   app.get('/rest/basket/:id', basket())
   app.post('/rest/basket/:id/checkout', order())
   app.put('/rest/basket/:id/coupon/:coupon', coupon())