Fix output of wfSajaxSearch:

* Escape all messages
* Use pretty output for terms instead of urlencoded one

diff --git a/RELEASE-NOTES b/RELEASE-NOTES
index a2468f4..ba28b9f 100644 (file)
--- a/RELEASE-NOTES
+++ b/RELEASE-NOTES
@@ -361,6 +361,7 @@ Full API documentation is available at http://www.mediawiki.org/wiki/API
   now 500 / 5000, in line with other modules.
 * Added list=allcategories module
 * (bug 12321) API list=blocks reveals private data
+* Fix output of wfSajaxSearch
 
 === Languages updated in 1.12 ===
 

diff --git a/includes/AjaxFunctions.php b/includes/AjaxFunctions.php
index 4fb76dc..e16f6cc 100644 (file)
--- a/includes/AjaxFunctions.php
+++ b/includes/AjaxFunctions.php
@@ -79,6 +79,7 @@ function wfSajaxSearch( $term ) {
 
        $l = new Linker;
 
+       $term = trim( $term );
        $term = str_replace( ' ', '_', $wgContLang->ucfirst( 
                        $wgContLang->checkTitleEncoding( $wgContLang->recodeInput( js_unescape( $term ) ) )
                ) );
@@ -113,18 +114,19 @@ function wfSajaxSearch( $term ) {
        $subtitlemsg = ( Title::newFromText($term) ? 'searchsubtitle' : 'searchsubtitleinvalid' );
        $subtitle = $wgOut->parse( wfMsg( $subtitlemsg, wfEscapeWikiText($term) ) ); #FIXME: parser is missing mTitle !
 
-       $term = urlencode( $term );
+       $term_url = urlencode( $term );
+       $term_diplay = htmlspecialchars( str_replace( '_', ' ', $term ) );
        $html = '<div style="float:right; border:solid 1px black;background:gainsboro;padding:2px;"><a onclick="Searching_Hide_Results();">'
-               . wfMsg( 'hideresults' ) . '</a></div>'
-               . '<h1 class="firstHeading">'.wfMsg('search')
+               . wfMsgHtml( 'hideresults' ) . '</a></div>'
+               . '<h1 class="firstHeading">'.wfMsgHtml('search')
                . '</h1><div id="contentSub">'. $subtitle . '</div><ul><li>'
                . $l->makeKnownLink( $wgContLang->specialPage( 'Search' ),
-                                       wfMsg( 'searchcontaining', $term ),
-                                       "search=$term&fulltext=Search" )
+                                       wfMsgHtml( 'searchcontaining', $term_diplay ),
+                                       "search={$term_url}&fulltext=Search" )
                . '</li><li>' . $l->makeKnownLink( $wgContLang->specialPage( 'Search' ),
-                                       wfMsg( 'searchnamed', $term ) ,
-                                       "search=$term&go=Go" )
-               . "</li></ul><h2>" . wfMsg( 'articletitles', $term ) . "</h2>"
+                                       wfMsgHtml( 'searchnamed', $term_diplay ) ,
+                                       "search={$term_url}&go=Go" )
+               . "</li></ul><h2>" . wfMsgHtml( 'articletitles', $term_diplay ) . "</h2>"
                . '<ul>' .$r .'</ul>'.$more;
 
        $response = new AjaxResponse( $html );