Fix SQL injection via nested hashes in conditions
CVE-2012-5664 options hashes should only be extracted if there are extra parameters
Merge remote-tracking branch 'rails/2-3-stable' into 2-3-stable
Merge pull request #6722 from adgear/2-3-stable

Backported rails 2.3 fix for CVE-2012-2695
CVE-2013-0156: Safe XML params parsing. Doesn't allow symbols or yaml.
bumping to 2.3.15 :cry::gun: