Apply suggested workaround for CVE-2013-0156 as Dashboard does not use xml parameter parsing.
Update CHANGELOG, VERSION for 1.2.18
Merge branch '1.2rc'