Whoops, forgot to check this in last night.

diff --git a/lib/setup.php b/lib/setup.php
index ba893bb92a5f4b31e5b57338f95b9960a175260c..c5d36c90dd60f0f20919c1ff9f6e9fd7e0902c40 100644 (file)
--- a/lib/setup.php
+++ b/lib/setup.php
@@ -232,8 +232,10 @@
 /// majority of cases), use the stored locale specified by admin.
 
     if (isset($_GET['lang'])) {
-        $SESSION->lang = $lang;
-        $SESSION->encoding = get_string('thischarset');
+        if (!detect_munged_arguments($lang) and file_exists("$CFG->dirroot/lang/$lang")) {
+            $SESSION->lang = $lang;
+            $SESSION->encoding = get_string('thischarset');
+        }
     }
     if (empty($CFG->lang)) {
         $CFG->lang = "en";