From 391f5270400be11d8e58edcae188a06769ccaa6b Mon Sep 17 00:00:00 2001
From: stronk7 <stronk7>
Date: Wed, 5 Apr 2006 23:29:46 +0000
Subject: [PATCH] Hehe, setup itself was using register_globals hack! ;-) Now
 the lang menu is working again.

Note: I've used the PARAM_SAFEDIR flag because it's the
only one supporting alpha+digits+underscore. Its name
doesn't seem to be perfect for this. Perhaps we should
create some alias?
---
 lib/setup.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/setup.php b/lib/setup.php
index a350547b91..f651012d2e 100644
--- a/lib/setup.php
+++ b/lib/setup.php
@@ -493,7 +493,7 @@ $CFG->os = PHP_OS;
 /// then use the one from the default language.  Otherwise (and this is the
 /// majority of cases), use the stored locale specified by admin.
 
-    if (isset($_GET['lang'])) {
+    if ($lang = optional_param('lang', PARAM_SAFEDIR)) {
         if (!detect_munged_arguments($lang, 0) and (file_exists($CFG->dataroot .'/lang/'. $lang) or 
                                                     file_exists($CFG->dirroot .'/lang/'. $lang))) {
             $SESSION->lang = $lang;
-- 
2.39.5