From a689abf0c1929348963e13fb754d83f7b260237b Mon Sep 17 00:00:00 2001
From: Jeremy Ruston <jeremy@osmosoft.com>
Date: Mon, 16 Jul 2012 12:57:19 +0100
Subject: [PATCH] Whoops, should be HTML encoding tiddler div fields

---
 core/modules/serializers.js | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/core/modules/serializers.js b/core/modules/serializers.js
index 47788e2d5..e044d4bb0 100644
--- a/core/modules/serializers.js
+++ b/core/modules/serializers.js
@@ -113,7 +113,7 @@ exports["application/x-tiddler-html-div"] = function(tiddler) {
 	pullField("title");
 	// Output the fields
 	for(f=0; f<fields.length; f++) {
-		result.push(" " + fields[f] + "=\"" + tiddler.getFieldString(fields[f]) + "\"");
+		result.push(" " + fields[f] + "=\"" + $tw.utils.htmlEncode(tiddler.getFieldString(fields[f])) + "\"");
 	}
 	result.push(">\n<pre>");
 	result.push($tw.utils.htmlEncode(tiddler.fields.text));