svn: /web/php/trunk/include/ languages.inc

bjori Wed, 29 Dec 2010 11:03:16 +0000 Revision: http://svn.php.net/viewvc?view=revision&revision=306815 Log: Fix potentional XSS by cleaning the langcode input Changed paths: U web/php/trunk/include/languages.inc Modified: web/php/trunk/include/languages.inc =================================================================== --- web/php/trunk/include/languages.inc 2010-12-29 10:38:03 UTC (rev 306814) +++ web/php/trunk/include/languages.inc 2010-12-29 11:03:16 UTC (rev 306815) @@ -89,13 +89,19 @@ // is needed when communicating with the outside world] function language_convert($langcode, $to_phpweb_format = TRUE) { + global $LANGUAGES; if ($to_phpweb_format) { switch ($langcode) { case 'zh_cn': return 'zh'; case 'zh_hk': return 'hk'; case 'zh_tw': return 'tw'; case 'ko' : return 'kr'; - default: return $langcode; + default: + if (isset($LANGUAGES[$langcode])) { + return $langcode; + } + // Fallback on english if we got something wacky + return "en"; } } else { @@ -104,7 +110,12 @@ case 'hk': return 'zh_hk'; case 'tw': return 'zh_tw'; case 'kr': return 'ko'; - default: return $langcode; + default: + if (isset($LANGUAGES[$langcode])) { + return $langcode; + } + // Fallback on english if we got something wacky + return "en"; } } }