diff --git a/C4/Templates.pm b/C4/Templates.pm index eaec07d..1221600 100644 --- a/C4/Templates.pm +++ b/C4/Templates.pm @@ -181,6 +181,9 @@ sub themelanguage_lite { $lang = $query->cookie('KohaOpacLanguage') if ( defined $query and $query->cookie('KohaOpacLanguage') ); + # Sanitize the user input + $lang =~ s/[^a-zA-Z_-]*//; + # Fall back to English my @languages; if ( $interface eq 'intranet' ) { @@ -324,6 +327,10 @@ sub themelanguage { if $http_accept_language; # But, if there's a cookie set, obey it $lang = $query->cookie('KohaOpacLanguage') if (defined $query and $query->cookie('KohaOpacLanguage')); + + # Sanitize the user input + $lang =~ s/[^a-zA-Z_-]*//; + # Fall back to English my @languages; if ($interface eq 'intranet') {