- zope.app.form.browser.textwidgets: The TextAreaWidget was not escaping

  its content when the validation failed. This way <, > and & were put
  out unquoted.

backport from 3.4

editingwidgets.py

@@ -18,7 +18,7 @@
 from zope.interface import implements
 from zope.app.form.interfaces import IInputWidget
 from zope.app.form.browser import TextAreaWidget
-from zope.app.form.browser.widget import renderElement
+from zope.app.form.browser.widget import renderElement, escape
 from zope.app.pagetemplate.viewpagetemplatefile import ViewPageTemplateFile
 
 class SimpleEditingWidget(TextAreaWidget):
@@ -112,7 +112,7 @@ def __call__(self):
                              rows=self.height,
                              cols=self.width,
                              style=self.style,
-                             contents=self._getFormValue(),
+                             contents=escape(self._getFormValue()),
                              extra=self.extra)
 
     def contents(self):