Fix SQL injection via nested hashes in conditions
CVE-2012-5664 options hashes should only be extracted if there are extra parameters
Merge remote-tracking branch 'rails/2-3-stable' into 2-3-stable
Merge pull request #6722 from adgear/2-3-stable

Backported rails 2.3 fix for CVE-2012-2695
CVE-2013-0156: Safe XML params parsing. Doesn't allow symbols or yaml.
bumping to 2.3.15 :cry::gun:
Revert "bump up rack version to the one that includes the Hash DoS fix"

Rack 1.1.3 also changes the Set-Cookie header to expects a
newline-delimited string instead of an Array, which breaks Rails 2.3's
expectations in a variety of ways.

This reverts commit 27a508c91e04b619c8a1eb50ef115b226b21182c.

Conflicts:
	actionpack/Rakefile
Fix for CVE-2013-0155
Add gemspecs for bundler
Merge pull request #9030 from johndouthat/2-3-stable

Add .gemspec files to 2-3-stable to help Bundler
fixing load error messages
Do not mark strip_tags result as html_safe

Thanks to Marek Labos & Nethemba
Squashed commit of the following:

commit 9ef905f19807c62fb549ae6fe3784be4bcda96dc
Author: Rafael Mendonça França <rafaelmfranca@gmail.com>
Date:   Tue Aug 7 22:38:40 2012 -0300

    Fix tests about single quote escaping

commit 780a718723cf87b49cfe204d355948c4e0932d23
Author: Santiago Pastorino <santiago@wyeworks.com>
Date:   Tue Jul 31 22:25:54 2012 -0300

    html_escape should escape single quotes

    https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet#RULE_.231_-_HTML_Escape_Before_Inserting_Untrusted_Data_into_HTML_Element_Content
    Closes #7215

    Conflicts:
    	actionpack/test/controller/new_base/render_template_test.rb
    	actionpack/test/template/asset_tag_helper_test.rb
    	actionpack/test/template/erb_util_test.rb
    	actionpack/test/template/javascript_helper_test.rb
    	actionpack/test/template/template_test.rb
    	activesupport/lib/active_support/core_ext/string/output_safety.rb
    	activesupport/test/core_ext/string_ext_test.rb
    	railties/test/application/assets_test.rb
backporting deep_munge
removing [nil] from the params
Add an OkJson backend and remove the YAML backend

Fixes CVE-2013-0333.  The ActiveSupport::JSON::Backends::Yaml class is present but the functionality has been removed entirely.
bumping version
Bump version on gemspecs too.
Merge pull request #9099 from pietro/2-3-gemspec-bump

Bump version on 2.3 gemspecs too.
use the decimal HTML escape code for single quotes instead of the hex one so webkit-based browsers properly translate the code in form fields