From b7f1d56fe0086e7fdbcebfdb4e69e20045070474 Mon Sep 17 00:00:00 2001
From: Jakub Vrana <jakub@vrana.cz>
Date: Thu, 6 Sep 2012 23:32:42 -0700
Subject: [PATCH] Switch language by POST

---
 adminer/include/lang.inc.php | 13 +++++++------
 changes.txt                  |  1 +
 tests/0-login.html           | 15 +++++++++++++++
 3 files changed, 23 insertions(+), 6 deletions(-)

diff --git a/adminer/include/lang.inc.php b/adminer/include/lang.inc.php
index db645086..c6fd7df2 100644
--- a/adminer/include/lang.inc.php
+++ b/adminer/include/lang.inc.php
@@ -70,17 +70,18 @@ function lang($idf, $number = null) {
 }
 
 function switch_lang() {
-	global $LANG, $langs;
-	echo "<form action=''>\n<div id='lang'>";
-	hidden_fields($_GET, array('lang'));
+	global $LANG, $langs, $token;
+	echo "<form action='' method='post'>\n<div id='lang'>";
 	echo lang('Language') . ": " . html_select("lang", $langs, $LANG, "this.form.submit();");
 	echo " <input type='submit' value='" . lang('Use') . "' class='hidden'>\n";
+	echo "<input type='hidden' name='token' value='$token'>\n";
 	echo "</div>\n</form>\n";
 }
 
-if (isset($_GET["lang"])) {
-	$_COOKIE["adminer_lang"] = $_GET["lang"];
-	$_SESSION["lang"] = $_GET["lang"]; // cookies may be disabled
+if (isset($_POST["lang"]) && $_SESSION["token"] == $_POST["token"]) { // $token and $error not yet available
+	cookie("adminer_lang", $_POST["lang"]);
+	$_SESSION["lang"] = $_POST["lang"]; // cookies may be disabled
+	redirect(remove_from_uri());
 }
 
 $LANG = "en";
diff --git a/changes.txt b/changes.txt
index 4755b9f7..d34c8418 100644
--- a/changes.txt
+++ b/changes.txt
@@ -5,6 +5,7 @@ Time out long running database list and select count
 Use VALUES() in INSERT+UPDATE export
 Style logout button as link
 Ctrl+click and Shift+click on button opens form to a blank window
+Switch language by POST
 selectQueryBuild() method (customization)
 Serbian translation
 
diff --git a/tests/0-login.html b/tests/0-login.html
index 384fce96..01e3c4e9 100644
--- a/tests/0-login.html
+++ b/tests/0-login.html
@@ -21,6 +21,21 @@
 	<td>adminer/?username=ODBC&amp;lang=en</td>
 	<td></td>
 </tr>
+<tr>
+	<td>click</td>
+	<td>name=lang</td>
+	<td></td>
+</tr>
+<tr>
+	<td>select</td>
+	<td>name=lang</td>
+	<td>label=English</td>
+</tr>
+<tr>
+	<td>clickAndWait</td>
+	<td>css=option[value=&quot;en&quot;]</td>
+	<td></td>
+</tr>
 <tr>
 	<td>verifyTextPresent</td>
 	<td>Logged as</td>