merged from MOODLE_15_STABLE

lib/moodlelib.php

@@ -109,6 +109,7 @@ define('PARAM_ALPHANUM', 0x0400);  //numbers or letters only
 define('PARAM_BOOL',     0x0800);  //convert to value 1 or 0 using empty()
 define('PARAM_CLEANHTML',0x1000);  //actual HTML code that you want cleaned and slashes removed
 define('PARAM_ALPHAEXT', 0x2000);  // PARAM_ALPHA plus the chars in quotes: "/-_" allowed
+define('PARAM_SAFEDIR',  0x4000);  // safe directory name, suitable for include() and require()
 
 /**
  * Definition of page types
@@ -237,6 +238,10 @@ function clean_param($param, $options) {
         $param = strip_tags($param);
     }
 
+    if ($options & PARAM_SAFEDIR) {     // Remove everything not a-zA-Z0-9_-
+        $param = eregi_replace('[^a-zA-Z0-9_-]', '', $param);
+    }
+
     if ($options & PARAM_CLEANFILE) {    // allow only safe characters
         $param = clean_filename($param);
     }

lib/weblib.php

@@ -2973,9 +2973,6 @@ function print_textarea($usehtmleditor, $rows, $cols, $width, $height, $name, $v
 
     if ($usehtmleditor) {
 
-        // cleanup bad html that may have made it to the db
-        $value = clean_text($value);
-
         if (!empty($courseid) and isteacher($courseid)) {
             echo ($scriptcount < 1) ? '<script type="text/javascript" src="'. $CFG->wwwroot .'/lib/editor/htmlarea.php?id='. $courseid .'"></script>'."\n" : '';
         } else {