Escape HTML in raw source of Cards

UI/Contacts/UIxContactActions.m

@@ -20,6 +20,8 @@
 
 #import <Foundation/NSArray.h>
 
+#import <NGExtensions/NSString+misc.h>
+
 #import <NGObjWeb/WOContext.h>
 #import <NGObjWeb/WORequest.h>
 #import <NGObjWeb/WOResponse.h>
@@ -140,7 +142,7 @@
   [content appendFormat: @"%@", [[self clientObject] contentAsString]];
   [response setHeader: @"text/plain; charset=utf-8" 
             forKey: @"content-type"];
-  [response appendContentString: content];
+  [response appendContentString: [content stringByEscapingHTMLString]];
 
   return response;
 }

UI/Templates/ContactsUI/UIxContactViewTemplate.wox

@@ -192,7 +192,7 @@
           </md-button>
         </md-card-actions>
         <md-card-content>
-          <pre>{{editor.rawSource}}</pre>
+          <pre ng-bind-html="editor.rawSource"><!-- raw --></pre>
         </md-card-content>
       </md-card>
     </div>