Ofcourse this is the correct way if it's not public yet, but in this case the issue was already released to the public. Since it's out there already, I agree having DA users warned about this too is a good thing.
So I'll add a fix, but as long as you've got check_referer=1 turned on, which it is by default, the only threat is that you can create pop-ups in your own browser.
The "cross" part of cross-site-scripting doesn't apply with check_referer=1, meaning a malicious external site has no effect on things, essentially nullifying the threat.
I'd still classify it as a bug though.
