MDL-11413 I hope now it is correct solution

lib/kses.php

@@ -470,7 +470,7 @@ function kses_bad_protocol_once($string, $allowed_protocols)
 ###############################################################################
 {
   return preg_replace('/^((&[^;]*;|[\sA-Za-z0-9])*)'.
-                      '(:|&#0*58;|&#[Xx]3[Aa];)\s*/e',
+                      '(:|&#0*58;|&#[Xx]0*3[Aa];)\s*/e',
                       'kses_bad_protocol_once2("\\1", $allowed_protocols)',
                       $string);
 } # function kses_bad_protocol_once

lib/weblib.php

@@ -1842,7 +1842,6 @@ function clean_text($text, $format=FORMAT_MOODLE) {
 
             /// Remove tags that are not allowed
                 $text = strip_tags($text, $ALLOWED_TAGS);
-                $text = str_replace(':', ':', $text);
 
             /// Clean up embedded scripts and , using kses
                 $text = cleanAttributes($text);
@@ -1939,7 +1938,6 @@ function cleanAttributes2($htmlArray){
                 $value = kses_decode_entities($value);
                 $value = preg_replace('/(&#[0-9]+)(;?)/', "\\1;", $value);
                 $value = preg_replace('/(&#x[0-9a-fA-F]+)(;?)/', "\\1;", $value);
-                $value = str_replace(':', '', $value); //better not have these characters in output at all
                 if ($value === $prevvalue) {
                     $arreach['value'] = $value;
                     break;