    noteRenderer: function(note) {
        var recordClass = Tine.Tinebase.data.RecordMgr.get(this.record_model),
            app = Tine.Tinebase.appMgr.get(this.app);

        note = Ext.util.Format.htmlEncode(note);
        
        if (recordClass) {
            Ext.each(recordClass.getFieldDefinitions(), function(field) {
                if (field.label) {
                    note = String(note).replace(field.name, '<br>' + app.i18n._hidden(field.label));
                    //map[field.name] = '<br>' + this.app.i18n._hidden(field.label);
                }
            }, this);
        }

        return note;
    },
The software does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.