Fixes for SkinLegacy::specialPagesList():

* Use XmlSelect, Html::rawElement() and Xml::submitButton() to make sure things are correctly escaped
* Get a Title object instead of using $wgContLang->specialPage()
* Redirect to index.php and changed the name of the <select> to title to use the common way instead of linking to redirect.php?wpDropDown=...

diff --git a/includes/SkinLegacy.php b/includes/SkinLegacy.php
index 26be282..c11b089 100644 (file)
--- a/includes/SkinLegacy.php
+++ b/includes/SkinLegacy.php
@@ -430,34 +430,18 @@ class LegacyTemplate extends BaseTemplate {
         * Show a drop-down box of special pages
         */
        function specialPagesList() {
-               global $wgContLang, $wgServer, $wgRedirectScript;
+               global $wgScript;
 
+               $select = new XmlSelect( 'title' );
                $pages = SpecialPageFactory::getUsablePages();
-
-               foreach ( $pages as $name => $page ) {
-                       $pages[$name] = $page->getDescription();
-               }
-
-               $go = wfMsg( 'go' );
-               $sp = wfMsg( 'specialpages' );
-               $spp = $wgContLang->specialPage( 'Specialpages' );
-
-               $s = '<form id="specialpages" method="get" ' .
-                 'action="' . htmlspecialchars( "{$wgServer}{$wgRedirectScript}" ) . "\">\n";
-               $s .= "<select name=\"wpDropdown\">\n";
-               $s .= "<option value=\"{$spp}\">{$sp}</option>\n";
-
-
-               foreach ( $pages as $name => $desc ) {
-                       $p = $wgContLang->specialPage( $name );
-                       $s .= "<option value=\"{$p}\">{$desc}</option>\n";
+               array_unshift( $pages, SpecialPageFactory::getPage( 'SpecialPages' ) );
+               foreach ( $pages as $obj ) {
+                       $select->addOption( $obj->getDescription(),
+                               $obj->getTitle()->getPrefixedDBkey() );
                }
 
-               $s .= "</select>\n";
-               $s .= "<input type='submit' value=\"{$go}\" name='redirect' />\n";
-               $s .= "</form>\n";
-
-               return $s;
+               return Html::rawElement( 'form', array( 'id' => 'specialpages', 'method' => 'get',
+                       'action' => $wgScript ), $select->getHTML() . Xml::submitButton( wfMsg( 'go' ) ) );
        }
 
        function pageTitleLinks() {