From 4e8f2e6ba3ed021c5dfe76504b2f80681bd0f1c2 Mon Sep 17 00:00:00 2001
From: stronk7 <stronk7>
Date: Wed, 4 May 2005 23:09:43 +0000
Subject: [PATCH] Changed call from preg_replace() to preg_replace_callback()
 to avoid some double backslashes present yet. This method doesn't
 addslashes() automatically like the old one (so kses_stripslashes() is not
 needed).

All we have to to is to stripslashes() before calling kses and addslashes()
after it. Only in clean_param(), because params arrive always slashed
to Moodle. This seems to be the correct approach documented in:
http://sourceforge.net/project/shownotes.php?group_id=81853&release_id=302996
---
 lib/moodlelib.php |  5 ++---
 lib/weblib.php    | 13 +++++++------
 2 files changed, 9 insertions(+), 9 deletions(-)

diff --git a/lib/moodlelib.php b/lib/moodlelib.php
index bca7b816f06..971aa4574cc 100644
--- a/lib/moodlelib.php
+++ b/lib/moodlelib.php
@@ -193,10 +193,9 @@ function clean_param($param, $options) {
     }
 
     if ($options & PARAM_CLEAN) {
+        $param = stripslashes($param);
         $param = clean_text($param);     // Sweep for scripts, etc
-        $param = str_replace('"', '\\\\"', $param);  // Because clean_text will strip them 
-                                                     // when checking HTML tags ...  I'm not 
-                                                     // sure if this is really necessary to replace
+        $param = addslashes($param);
     }
 
     if ($options & PARAM_INT) {
diff --git a/lib/weblib.php b/lib/weblib.php
index ab209ccb0cb..4d545e65ee7 100644
--- a/lib/weblib.php
+++ b/lib/weblib.php
@@ -1247,9 +1247,9 @@ function clean_text($text, $format=FORMAT_MOODLE) {
  * @return string
  */
 function cleanAttributes($str){
-    $result = preg_replace(
-            '%(<[^>]*(>|$)|>)%me', #search for html tags
-            "cleanAttributes2('\\1')",
+    $result = preg_replace_callback(
+            '%(<[^>]*(>|$)|>)%m', #search for html tags
+            "cleanAttributes2",
             $str
             );
     return  $result;
@@ -1261,15 +1261,16 @@ function cleanAttributes($str){
  * It calls ancillary functions in kses which are prefixed by kses
 *        17/08/2004              ::          Eamon DOT Costello AT dcu DOT ie
  *
- * @param string $htmlTag An html tag to be examined
+ * @param array $htmlArray An array from {@link cleanAttributes()}, containing in its 1st
+ *              element the html to be cleared
  * @return string
  */
-function cleanAttributes2($htmlTag){
+function cleanAttributes2($htmlArray){
 
     global $CFG, $ALLOWED_PROTOCOLS;
     require_once($CFG->libdir .'/kses.php');
 
-    $htmlTag = str_replace('\\\\"', '"', $htmlTag);
+    $htmlTag = $htmlArray[1];
     if (substr($htmlTag, 0, 1) != '<') {
         return '&gt;';  //a single character ">" detected
     }