SpotTheVuln.com

<?php
function qtrans_convertURL($url='',$lang='',$forceadmin = false) {
 global $q_config;
 
 // invalid language
 if($url=='') $url = clean_url($q_config['url_info']['url']);
 if($lang=='') $lang = $q_config['language'];
 if(defined('WP_ADMIN')&&!$forceadmin) return $url;
 if(!qtrans_isEnabled($lang)) return "";
 
 // &workaround
 $url = str_replace('&amp;','&',$url);
 $url = str_replace('&','&',$url);
 
 // check if it's an external link
 $urlinfo = qtrans_parseURL($url);
 $home = rtrim(get_option('home'),"/");
 if($urlinfo['host']!='') {
  // check for already existing pre-domain language information
  if($q_config['url_mode'] == QT_URL_DOMAIN &&preg_match("#^([a-z]{2}).#i",$urlinfo['host'],$match)) {
   if(qtrans_isEnabled($match[1])) {
    // found language information,remove it
    $url = preg_replace("/".$match[1]."\./i","",$url,1);
    // reparse url
    $urlinfo = qtrans_parseURL($url);
   }
  }
  if(substr($url,0,strlen($home))!=$home) {
   return $url;
  }
  // strip home path
  $url = substr($url,strlen($home));
 } else {
  // relative url,strip home path
  $homeinfo = qtrans_parseURL($home);
  if($homeinfo['path']==substr($url,0,strlen($homeinfo['path']))) {
   $url = substr($url,strlen($homeinfo['path']));
  }
 }
 
 // check for query language information and remove if found
 if(preg_match("#(&|\?)lang=([^&\#]+)#i",$url,$match) &&qtrans_isEnabled($match[2])) {
  $url = preg_replace("#(&|\?)lang=".$match[2]."&?#i","$1",$url);
 }
 
 // remove any slashes out front
 $url = ltrim($url,"/");
 
 // remove any useless trailing characters
 $url = rtrim($url,"?&");
 
 // reparse url without home path
 $urlinfo = qtrans_parseURL($url);
 
 // check if its a link to an ignored file type
 $ignore_file_types = preg_split('/\s*,\s*/',strtolower($q_config['ignore_file_types']));
 $pathinfo = pathinfo($urlinfo['path']);
 if(isset($pathinfo['extension']) &&in_array(strtolower($pathinfo['extension']),$ignore_file_types)) {
  return $home."/".$url;
 }
 
 switch($q_config['url_mode']) {
  case QT_URL_PATH: // pre url
   // might already have language information
   if(preg_match("#^([a-z]{2})/#i",$url,$match)) {
    if(qtrans_isEnabled ($match[1])) {
     // found language information,remove it
     $url = substr($url,3);
    }
   }
   if($lang!=$q_config['default_language']) $url = $lang."/".$url;
   break;
  case QT_URL_DOMAIN: // pre domain
   if($lang!=$q_config['default_language']) $home = preg_replace("#//#","//".$lang.".",$home,1);
   break;
  default:// query
   if($lang!=$q_config['default_language']){
    if(strpos($url,'?')===false) {
     $url .= '?';
    } else {
     $url .= '&';
    }
    $url .= "lang=".$lang;
   }
 }
 
 // see if cookies are activated
 if(!$q_config['cookie_enabled'] &&!$q_config['url_info']['internal_referer'] &&$urlinfo['path'] == '' &&$lang == $q_config['default_language'] &&$q_config['language'] != $q_config['default_language']) {
  //:( now we have to make unpretty URLs
  $url = preg_replace("#(&|\?)lang=".$match[2]."&?#i","$1",$url);
  if(strpos($url,'?')===false) {
   $url .= '?';
  } else {
   $url .= '&';
  }
  $url .= "lang=".$lang;
 }
 
 // &amp;workaround
 $complete = str_replace('&','&amp;',$home."/".$url);
 return $complete;
}

...<SNIP...

function qtrans_use($lang,$text,$show_available=false) {
        global $q_config;
        // return full string if language is not enabled
        if(!qtrans_isEnabled($lang)) return $text;
        if(is_array($text)) {
                // handle arrays recursively
                foreach($text as $key =>$t) {
                        $text[$key] = qtrans_use($lang,$text[$key],$show_available);
                }
                return $text;
        }
        
        if(is_object($text)) {
                foreach(get_object_vars($text) as $key =>$t) {
                        $text->$key = qtrans_use($lang,$text->$key,$show_available);
                }
                return $text;
        }
        
        // get content
        $content = qtrans_split($text);
        // find available languages
        $available_languages = array();
        foreach($content as $language =>$lang_text) {
                $lang_text = trim($lang_text);
                if(!empty($lang_text)) $available_languages[] = $language;
        }
        
        // if no languages available show full text
        if(sizeof($available_languages)==0) return $text;
        // if content is available show the content in the requested language
        $content[$lang] = trim($content[$lang]);
        if(!empty($content[$lang])) {
                return $content[$lang];
        }
        // content not available in requested language (bad!!) what now?
        if(!$show_available){
                // check if content is available in default language,if not return first language found. (prevent empty result)
                if($lang!=$q_config['default_language'])
                        return "(".$q_config['language_name'][$q_config['default_language']].") ".qtrans_use($q_config['default_language'],$text,$show_available);
                foreach($content as $language =>$lang_text) {
                        $lang_text = trim($lang_text);
                        if(!empty($lang_text)) {
                                return $lang_text;
                        }
                }
        }
        // display selection for available languages
        $available_languages = array_unique($available_languages);
        $language_list = "";
        if(preg_match('/%LANG:([^:]*):([^%]*)%/',$q_config['not_available'][$lang],$match)) {
                $normal_seperator = $match[1];
                $end_seperator = $match[2];
                // build available languages string backward
                $i = 0;
                foreach($available_languages as $language) {
                        if($i==1) $language_list  = $end_seperator.$language_list;
                        if($i>1) $language_list  = $normal_seperator.$language_list;
-                        $language_list = "<a href=\"".qtrans_convertURL($_SERVER['REQUEST_URI'],$language)."\">".$q_config['language_name'][$language]."</a>".$language_list;
+                       $language_list = "<a href=\"".qtrans_convertURL('',$language)."\">".$q_config['language_name'][$language]."</a>".$language_list;
                        $i++;
                }
        }
        return "<p>".preg_replace('/%LANG:([^:]*):([^%]*)%/',$language_list,$q_config['not_available'][$lang])."</p>";
}
 
?>