| Index: trunk/phase3/includes/Setup.php |
| — | — | @@ -217,7 +217,7 @@ |
| 218 | 218 | if ($wgLanguageCode == '') |
| 219 | 219 | $wgLanguageCode = $wgUser->getOption('language'); |
| 220 | 220 | # Validate $wgLanguageCode, which will soon be sent to an eval() |
| 221 | | -if( empty( $wgLanguageCode ) || preg_match( '/^[^a-z-]*$/', $wgLanguageCode ) ) { |
| | 221 | +if( empty( $wgLanguageCode ) || !preg_match( '/^[a-z]+(-[a-z]+)?$/', $wgLanguageCode ) ) { |
| 222 | 222 | $wgLanguageCode = $wgContLanguageCode; |
| 223 | 223 | } |
| 224 | 224 | |
| Index: trunk/phase3/RELEASE-NOTES |
| — | — | @@ -291,6 +291,7 @@ |
| 292 | 292 | patch by David Benbennick |
| 293 | 293 | * (bug 4162) Add $wgThumbnailEpoch timestamp to force old thumbs to |
| 294 | 294 | be rerendered on demand, sitewide |
| | 295 | +* (bug 4165) Correct validation for user language selection (data taint) |
| 295 | 296 | |
| 296 | 297 | |
| 297 | 298 | === Caveats === |