diff --git a/oml/item/api.py b/oml/item/api.py
index 16a66a3..c8c974d 100644
--- a/oml/item/api.py
+++ b/oml/item/api.py
@@ -247,17 +247,20 @@ def findMetadata(data):
     elif key == 'id':
         import user.models
         items = {}
-        for m in user.models.Metadata.query.filter_by(item_id=data[key]):
-            if m.data_hash not in items:
-                items[m.data_hash] = m.data
-                items[m.data_hash]['users'] = [m.user_id]
-                j = items[m.data_hash]
-                for key in [k['id'] for k in settings.config['itemKeys'] if isinstance(k['type'], list)]:
-                    if key in j and not isinstance(j[key], list):
-                        j[key] = [j[key]] if j[key] else []
-            else:
-                items[m.data_hash]['users'].append(m.user_id)
-            response['items'] = list(items.values())
+        for u in user.models.User.query.filter_by(peered=True):
+            peer = utils.get_peer(u.id)
+            if data[key] in peer.library:
+                h = peer.get_metahash(data[key])
+                if h not in items:
+                    items[h] = peer.library[data[key]].get('meta', {}).copy()
+                    items[h]['users'] = [u.id]
+                    j = items[h]
+                    for key in [k['id'] for k in settings.config['itemKeys'] if isinstance(k['type'], list)]:
+                        if key in j and not isinstance(j[key], list):
+                            j[key] = [j[key]] if j[key] else []
+                else:
+                    items[h]['users'].append(u.id)
+        response['items'] = list(items.values())
     return response
 actions.register(findMetadata)
 
diff --git a/static/js/identifyDialog.js b/static/js/identifyDialog.js
index da1299e..af74138 100644
--- a/static/js/identifyDialog.js
+++ b/static/js/identifyDialog.js
@@ -277,7 +277,8 @@ oml.ui.identifyDialog = function(data) {
             $list = Ox.TableList({
                     columns: [{
                         format: function(value, data) {
-                            return '<b>' + data.title + '</b> ' + data.author
+                            return '<b>' + Ox.encodeHTMLEntities(data.title) + '</b> '
+                                + Ox.encodeHTMLEntities(data.author);
                         },
                         id: 'index',
                         visible: true,