Hehe, setup itself was using register_globals hack! ;-)

Now the lang menu is working again.

Note: I've used the PARAM_SAFEDIR flag because it's the
only one supporting alpha+digits+underscore. Its name
doesn't seem to be perfect for this. Perhaps we should
create some alias?

diff --git a/lib/setup.php b/lib/setup.php
index a350547b9189e4e13985ae8bed296ffd4444153a..f651012d2ebd3a13e59af4e7931bdf2e5631e5f0 100644 (file)
--- a/lib/setup.php
+++ b/lib/setup.php
@@ -493,7 +493,7 @@ $CFG->os = PHP_OS;
 /// then use the one from the default language.  Otherwise (and this is the
 /// majority of cases), use the stored locale specified by admin.
 
-    if (isset($_GET['lang'])) {
+    if ($lang = optional_param('lang', PARAM_SAFEDIR)) {
         if (!detect_munged_arguments($lang, 0) and (file_exists($CFG->dataroot .'/lang/'. $lang) or 
                                                     file_exists($CFG->dirroot .'/lang/'. $lang))) {
             $SESSION->lang = $lang;