From 3f07317f308f7ec39973e18364e91ab9f97251e8 Mon Sep 17 00:00:00 2001
From: Laurent Destailleur <eldy@destailleur.fr>
Date: Mon, 22 Mar 2021 19:19:18 +0100
Subject: [PATCH] FIx #yogosha5695

---
 htdocs/install/fileconf.php | 2 +-
 htdocs/install/inc.php      | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/htdocs/install/fileconf.php b/htdocs/install/fileconf.php
index cfe42adc79f..0ca5805ba24 100644
--- a/htdocs/install/fileconf.php
+++ b/htdocs/install/fileconf.php
@@ -33,7 +33,7 @@ global $langs;
 
 $err = 0;
 
-$setuplang = GETPOST("selectlang", '', 3) ?GETPOST("selectlang", '', 3) : (isset($_GET["lang"]) ? $_GET["lang"] : 'auto');
+$setuplang = GETPOST("selectlang", '', 3) ? GETPOST("selectlang", '', 3) : (GETPOST('lang', 'alpha', 1) ? GETPOST('lang', 'alpha', 1) : 'auto');
 $langs->setDefaultLang($setuplang);
 
 $langs->loadLangs(array("install", "errors"));
diff --git a/htdocs/install/inc.php b/htdocs/install/inc.php
index 91ceae9eaaa..27a3fc01abd 100644
--- a/htdocs/install/inc.php
+++ b/htdocs/install/inc.php
@@ -518,7 +518,7 @@ function pFooter($nonext = 0, $setuplang = '', $jscheckfunction = '', $withpleas
 		}
 	}
 	if ($setuplang) {
-		print '<input type="hidden" name="selectlang" value="'.$setuplang.'">';
+		print '<input type="hidden" name="selectlang" value="'.dol_escape_htmltag($setuplang).'">';
 	}
 
 	print '</form>'."\n";