diff -uNr maia-1.0.2/amavisd-maia maia-1.0.2a/amavisd-maia
--- maia-1.0.2/amavisd-maia	2007-01-05 14:37:42.000000000 +0900
+++ maia-1.0.2a/amavisd-maia	2007-07-07 06:34:10.000000000 +0900
@@ -403,9 +403,9 @@
 }
 
 $myproduct_name = 'amavisd-maia';
-$myversion_id = '1.0.2'; $myversion_date = '20070105';
+$myversion_id = '1.0.2a'; $myversion_date = '20070105';
 
-$myversion = "Maia Mailguard 1.0.2";
+$myversion = "Maia Mailguard 1.0.2a";
 $myversion_id_numeric =  # x.yyyzzz, allows numerical comparision, like Perl $]
   sprintf("%8.6f", $1 + ($2 + $3/1000)/1000)
   if $myversion_id =~ /^(\d+)(?:\.(\d*)(?:\.(\d*))?)?(.*)$/;
diff -uNr maia-1.0.2/amavisd.conf.dist maia-1.0.2a/amavisd.conf.dist
--- maia-1.0.2/amavisd.conf.dist	2007-01-05 14:17:04.000000000 +0900
+++ maia-1.0.2a/amavisd.conf.dist	2007-07-07 06:34:39.000000000 +0900
@@ -113,7 +113,7 @@
 $final_bad_header_destiny = D_DISCARD;
 
 $X_HEADER_TAG = 'X-Virus-Scanned';
-$X_HEADER_LINE = "Maia Mailguard 1.0.2";
+$X_HEADER_LINE = "Maia Mailguard 1.0.2a";
 
 @viruses_that_fake_sender_maps = (new_RE(
   [qr'\bEICAR\b'i => 0],            # av test pattern name
diff -uNr maia-1.0.2/php/constants.php maia-1.0.2a/php/constants.php
--- maia-1.0.2/php/constants.php	2006-12-23 14:23:12.000000000 +0900
+++ maia-1.0.2a/php/constants.php	2007-07-07 06:35:30.000000000 +0900
@@ -74,9 +74,9 @@
      *
      */
 
-    define("MAIA_VERSION", "1.0.2");
+    define("MAIA_VERSION", "1.0.2a");
 
     define("KILOBYTE", 1024);
     define("MEGABYTE", KILOBYTE * 1024);
     define("GIGABYTE", MEGABYTE * 1024);
-?>
\ No newline at end of file
+?>
diff -uNr maia-1.0.2/php/internal-init.php maia-1.0.2a/php/internal-init.php
--- maia-1.0.2/php/internal-init.php	2006-02-13 05:49:19.000000000 +0900
+++ maia-1.0.2a/php/internal-init.php	2007-07-07 06:30:43.000000000 +0900
@@ -86,7 +86,7 @@
     $sid = ""; 
 
     // Determine the user's language preference
-    if (isset($_GET["lang"])) {
+    if (isset($_GET["lang"]) && strlen($_GET["lang"]) == 2 ) {
        $display_language = trim($_GET["lang"]);
     } else {
        $display_language = $default_display_language;
@@ -97,7 +97,7 @@
     require_once ("./locale/$display_language/internal-init.php");
 
     // Determine the user's character set preference
-    if (isset($_GET["charset"])) {
+    if (isset($_GET["charset"]) && preg_match("/^[\x20-\x7e]{1,40}$/", $_GET["charset"])) {
         $html_charset = trim($_GET["charset"]);
     } else {
         $html_charset = $default_charset;
diff -uNr maia-1.0.2/php/login.php maia-1.0.2a/php/login.php
--- maia-1.0.2/php/login.php	2006-02-13 05:49:19.000000000 +0900
+++ maia-1.0.2a/php/login.php	2007-07-07 06:30:43.000000000 +0900
@@ -80,16 +80,20 @@
    // Get any special variables from the GET array
    if (isset($_GET["super"])) {
       $super = trim($_GET["super"]);
+      if($super != "register" && $super != "unregister") {
+        $logger->err("invalid super parameter");
+        $super = "";
+      }
    } else {
       $super = "";
    }
 
    // Determine the initial language preference,
-   // either from default or from manually selected link 
-   if (isset($_GET["lang"])) {
+   // either from default or from manually selected link
+   if (isset($_GET["lang"]) && strlen($_GET["lang"]) == 2 ) {
       $display_language = trim($_GET["lang"]);
       $display_language_is_default = false;
-   } elseif (isset($_GET["prevlang"])) {
+   } elseif (isset($_GET["prevlang"]) && strlen($_GET["prevlang"]) == 2) {
       $display_language = trim($_GET["prevlang"]);
       $display_language_is_default = true;
    } else {
@@ -110,7 +114,8 @@
 
 
    // Determine the user's character set preference
-   if (isset($_GET["charset"])) {
+   // Charset must be printable ascii, 1-40 characters.  /^[\x20-\x7e]{1,40}$/
+   if (isset($_GET["charset"]) && preg_match("/^[\x20-\x7e]{1,40}$/", $_GET["charset"])) {
        $html_charset = trim($_GET["charset"]);
    } else {
        $html_charset = $default_charset;
diff -uNr maia-1.0.2/php/xlogin.php maia-1.0.2a/php/xlogin.php
--- maia-1.0.2/php/xlogin.php	2006-12-20 08:53:59.000000000 +0900
+++ maia-1.0.2a/php/xlogin.php	2007-07-07 06:30:43.000000000 +0900
@@ -85,12 +85,12 @@
    $sid = ""; 
 
    // Get the expected form variables from the POST array
-   if (isset($_POST["language"])) {
+   if (isset($_POST["language"])   && strlen($_POST["language"]) == 2 ) {
       $display_language = trim($_POST["language"]);
    } else {
       $display_language = $default_display_language;
    }
-   if (isset($_POST["charset"])) {
+   if (isset($_POST["charset"]) && preg_match("/^[\x20-\x7e]{1,40}$/", $_POST["charset"])) {
       $html_charset = trim($_POST["charset"]);
    } else {
       $html_charset = $default_charset;
