From 22910187bfb9edae90c26e10100d8145b505b974 Mon Sep 17 00:00:00 2001
From: Spocke <spocke@moxiecode.com>
Date: Fri, 16 Nov 2012 11:08:03 +0100
Subject: [PATCH] Fixed security issue with google spellchecker

---
 changelog.txt           | 2 ++
 classes/GoogleSpell.php | 2 ++
 2 files changed, 4 insertions(+)

diff --git a/changelog.txt b/changelog.txt
index ed606cf..afe04fb 100644
--- a/changelog.txt
+++ b/changelog.txt
@@ -1,3 +1,5 @@
+Version 2.0.6.1 (2012-11-16)
+	Fixed security issue with google spellchecker.
 Version 2.0.6 (2011-09-29)
 	Fixed incorrect position of suggestion menu.
 	Fixed handling of mispelled words with no suggestions in PSpellShell engine.
diff --git a/classes/GoogleSpell.php b/classes/GoogleSpell.php
index 1821ca0..2d2f875 100644
--- a/classes/GoogleSpell.php
+++ b/classes/GoogleSpell.php
@@ -51,6 +51,8 @@ function &getSuggestions($lang, $word) {
 	}
 
 	function &_getMatches($lang, $str) {
+		$lang = preg_replace('/[^a-z\-]/i', '', $lang); // Sanitize, remove everything but a-z or -
+		$str = preg_replace('/[\x00-\x1F\x7F]/', '', $str); // Sanitize, remove all control characters
 		$server = "www.google.com";
 		$port = 443;
 		$path = "/tbproxy/spell?lang=" . $lang . "&hl=en";