From 7c84c844f9e5b40e834aac0a2a3ff3294f0f8d8d Mon Sep 17 00:00:00 2001
From: skodak <skodak>
Date: Mon, 24 Sep 2007 15:26:58 +0000
Subject: [PATCH] MDL-11413 revisited; backported from HEAD

---
 lib/weblib.php | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/lib/weblib.php b/lib/weblib.php
index 9ccad9e7236..afeb78b0344 100644
--- a/lib/weblib.php
+++ b/lib/weblib.php
@@ -1659,10 +1659,10 @@ function clean_text($text, $format=FORMAT_MOODLE) {
         /// Fix non standard entity notations
             $text = preg_replace('/(&#[0-9]+)(;?)/', "\\1;", $text);
             $text = preg_replace('/(&#x[0-9a-fA-F]+)(;?)/', "\\1;", $text);
-            $text = str_replace('&#x03A;', ':', $text);
 
         /// Remove tags that are not allowed
             $text = strip_tags($text, $ALLOWED_TAGS);
+            $text = str_replace('&#x03A;', ':', $text);
 
         /// Clean up embedded scripts and , using kses
             $text = cleanAttributes($text);
@@ -1736,7 +1736,7 @@ function cleanAttributes2($htmlArray){
                 $value = kses_decode_entities($value);
                 $value = preg_replace('/(&#[0-9]+)(;?)/', "\\1;", $value);
                 $value = preg_replace('/(&#x[0-9a-fA-F]+)(;?)/', "\\1;", $value);
-                $value = str_replace('&#x03A;', ':', $value);
+                $value = str_replace('&#x03A;', '', $value); //better not have these characters in output at all
                 if ($value === $prevvalue) {
                     $arreach['value'] = $value;
                     break;