Backported rails 2.3 fix for CVE-2012-2695

Verbatim as attached to http://seclists.org/oss-sec/2012/q2/504