sanity check on language selection

settings/ajax/setlanguage.php

@@ -7,11 +7,17 @@ $l=OC_L10N::get('settings');
 
 OC_JSON::checkLoggedIn();
 
+
 // Get data
 if( isset( $_POST['lang'] ) ){
+	$languageCodes=OC_L10N::findAvailableLanguages();
 	$lang=$_POST['lang'];
-	OC_Preferences::setValue( OC_User::getUser(), 'core', 'lang', $lang );
-	OC_JSON::success(array("data" => array( "message" => $l->t("Language changed") )));
+	if(array_search($lang,$languageCodes) or $lang=='en'){
+		OC_Preferences::setValue( OC_User::getUser(), 'core', 'lang', $lang );
+		OC_JSON::success(array("data" => array( "message" => $l->t("Language changed") )));
+	}else{
+		OC_JSON::error(array("data" => array( "message" => $l->t("Invalid request") )));
+	}
 }else{
 	OC_JSON::error(array("data" => array( "message" => $l->t("Invalid request") )));
 }