Exclude attributes starting "on" on HTML elements

Because:

* It doesn't work well with TW5's refresh mechanism, which relies on
being able to regenerate any portion of the DOM as required; this
frequently causes inline handlers to be re-executed at unexpected times
(see
http://tiddlywiki.com/static/TiddlyWiki%2520for%2520Developers.html)
* It mixes TW5 version-specific JavaScript with user content
* In multiuser environments there is a security risk to importing or
viewing tiddlers you didn't author if they can have JavaScript in them

core/modules/widgets/element.js

@@ -31,7 +31,7 @@ ElementWidget.prototype.render = function(parent,nextSibling) {
 	this.computeAttributes();
 	this.execute();
 	var domNode = this.document.createElementNS(this.namespace,this.parseTreeNode.tag);
-	this.assignAttributes(domNode);
+	this.assignAttributes(domNode,{excludeEventAttributes: true});
 	parent.insertBefore(domNode,nextSibling);
 	this.renderChildren(domNode,null);
 	this.domNodes.push(domNode);
@@ -65,7 +65,7 @@ ElementWidget.prototype.refresh = function(changedTiddlers) {
 		hasChangedAttributes = $tw.utils.count(changedAttributes) > 0;
 	if(hasChangedAttributes) {
 		// Update our attributes
-		this.assignAttributes(this.domNodes[0]);
+		this.assignAttributes(this.domNodes[0],{excludeEventAttributes: true});
 	}
 	return this.refreshChildren(changedTiddlers) || hasChangedAttributes;
 };

core/modules/widgets/widget.js

@@ -252,10 +252,17 @@ Widget.prototype.getAttribute = function(name,defaultText) {
 
 /*
 Assign the computed attributes of the widget to a domNode
+options include:
+excludeEventAttributes: ignores attributes whose name begins with "on"
 */
-Widget.prototype.assignAttributes = function(domNode) {
+Widget.prototype.assignAttributes = function(domNode,options) {
+	options = options || {};
 	var self = this;
 	$tw.utils.each(this.attributes,function(v,a) {
+		// Check exclusions
+		if(options.excludeEventAttributes && a.substr(0,2) === "on") {
+			v = undefined;
+		}
 		if(v !== undefined) {
 			// Setting certain attributes can cause a DOM error (eg xmlns on the svg element)
 			try {