diff -Nru language-selector-0.32.orig/dbus_backend/ls-dbus-backend language-selector-0.32/dbus_backend/ls-dbus-backend
--- language-selector-0.32.orig/dbus_backend/ls-dbus-backend	2011-01-28 14:39:09.000000000 +0100
+++ language-selector-0.32/dbus_backend/ls-dbus-backend	2011-04-18 13:16:08.000000000 +0200
@@ -9,6 +9,7 @@
 import logging
 import os
 import os.path
+import re
 import shutil
 import string
 import subprocess
@@ -28,6 +29,7 @@
 					    bus=bus)
 	    dbus.service.Object.__init__(self, bus_name, '/')
             self._datadir = "/usr/share/language-selector/"
+            self._re_locale = re.compile(r'^[\w\.\-@:]+$')
 
     def _authWithPolicyKit(self, sender, connection, priv):
         logging.debug("_authWithPolicyKit")
@@ -63,7 +65,10 @@
         sysLanguage - the default system LANGUAGE and LC_MESSAGES
         """
         logging.debug("SetSystemDefaultLanguage")
-        self._authWithPolicyKit(sender, connection, "com.ubuntu.languageselector.setsystemdefaultlanguage")
+        if not self._authWithPolicyKit(sender, connection, "com.ubuntu.languageselector.setsystemdefaultlanguage"):
+            return False
+        if not self._re_locale.search(sysLanguage):
+            return False
         conffiles = ["/etc/default/locale", "/etc/environment"]
         findString = "LANGUAGE="
         setString = "LANGUAGE=\"%s\"\n" % sysLanguage
@@ -91,7 +96,10 @@
         sysLang: the default LANG (de_DE.UTF-8)
         """
         logging.debug("SetSystemDefaultLangEnv")
-        self._authWithPolicyKit(sender, connection, "com.ubuntu.languageselector.setsystemdefaultlanguage")
+        if not self._authWithPolicyKit(sender, connection, "com.ubuntu.languageselector.setsystemdefaultlanguage"):
+            return False
+        if not self._re_locale.search(sysLang):
+            return False
         conffiles = ["/etc/default/locale", "/etc/environment"]
         macr = LanguageSelector.macros.LangpackMacros(self._datadir, sysLang)
         findString = "LANG="