* (bug 4165) Correct validation for user language selection (data taint)

diff --git a/RELEASE-NOTES b/RELEASE-NOTES
index fb6e492..b13845e 100644 (file)
--- a/RELEASE-NOTES
+++ b/RELEASE-NOTES
@@ -291,6 +291,7 @@ fully support the editing toolbar, but was found to be too confusing.
   patch by David Benbennick
 * (bug 4162) Add $wgThumbnailEpoch timestamp to force old thumbs to
   be rerendered on demand, sitewide
+* (bug 4165) Correct validation for user language selection (data taint)
 
 
 === Caveats ===

diff --git a/includes/Setup.php b/includes/Setup.php
index adacede..efcbbc9 100644 (file)
--- a/includes/Setup.php
+++ b/includes/Setup.php
@@ -217,7 +217,7 @@ $wgLanguageCode = $wgRequest->getText('uselang', '');
 if ($wgLanguageCode == '')
        $wgLanguageCode = $wgUser->getOption('language');
 # Validate $wgLanguageCode, which will soon be sent to an eval()
-if( empty( $wgLanguageCode ) || preg_match( '/^[^a-z-]*$/', $wgLanguageCode ) ) {
+if( empty( $wgLanguageCode ) || !preg_match( '/^[a-z]+(-[a-z]+)?$/', $wgLanguageCode ) ) {
        $wgLanguageCode = $wgContLanguageCode;
 }