- Patch #1513520 by pdrake: Fixed locale_language_from_browser() incorrectly matches invalid strings.

core/includes/locale.inc

@@ -143,7 +143,7 @@ function locale_language_from_browser($languages) {
   //   language-range  = ( ( 1*8ALPHA *( "-" 1*8ALPHA ) ) | "*" )
   // Samples: "hu, en-us;q=0.66, en;q=0.33", "hu,en-us;q=0.5"
   $browser_langcodes = array();
-  if (preg_match_all('@([a-zA-Z-]+|\*)(?:;q=([0-9.]+))?(?:$|\s*,\s*)@', trim($_SERVER['HTTP_ACCEPT_LANGUAGE']), $matches, PREG_SET_ORDER)) {
+  if (preg_match_all('@(?<=[, ]|^)([a-zA-Z-]+|\*)(?:;q=([0-9.]+))?(?:$|\s*,\s*)@', trim($_SERVER['HTTP_ACCEPT_LANGUAGE']), $matches, PREG_SET_ORDER)) {
     foreach ($matches as $match) {
       // We can safely use strtolower() here, tags are ASCII.
       // RFC2616 mandates that the decimal part is no more than three digits,

core/modules/locale/locale.test

@@ -1847,6 +1847,7 @@ class LocaleBrowserDetectionTest extends DrupalUnitTestCase {
       'EN' => 'en',
       ' en' => 'en',
       'en ' => 'en',
+      'en, fr' => 'en',
 
       // A less specific language from the browser matches a more specific one
       // from the website, and the other way around for compatibility with
@@ -1881,6 +1882,7 @@ class LocaleBrowserDetectionTest extends DrupalUnitTestCase {
       // Unresolvable cases.
       '' => FALSE,
       'de,pl' => FALSE,
+      'iecRswK4eh' => FALSE,
       $this->randomName(10) => FALSE,
     );