CVE-2019-16197: Cross-site scripting in Dolibarr

The vulnerability stems from improper input handling in the language detection mechanism. Though the CVE description mentions User-Agent header XSS, the actual patched code shows the vulnerability was in the Accept-Language header processing within Translate::setDefaultLang. The commit adds a critical regex filter (preg_replace('/[^_a-zA-Z]/', '', ...)) to sanitize the input, and the accompanying test case demonstrates XSS prevention by testing malicious header injection. The User-Agent mention in the CVE description appears to be an error, as the code changes and advisory context clearly point to Accept-Language handling in this function as the root cause.