Fix #8832 - Parse '{"person":[]}' JSON/XML as {'person' => []}.
Fixing encoding to UTF-8 for OkJson backend
Merge pull request #9123 from renatosnrg/3-0-stable

Fixing encoding to UTF-8 for OkJson backend. Closes #9122.
Merge pull request #9111 from jsomara/3-0-json-fix

Fix #8832 - Parse '{"person":[]}' JSON/XML as {'person' => []}.
fixed failing JSON decoding in rails 3-0-stable
active_record: Quote numeric values compared to string columns.
mysql2 adapter fixed upstream to delegate quoting of BigDecimal.
Merge pull request #9210 from dylanahsmith/3-0-mysql-quote-numeric

[3.0] active_record: Quote numeric values compared to string columns.
Fix BigDecimal Typecast on 1.8.7
Merge pull request #9223 from robertomiranda/fix-bigdecimal-typecast

Fix BigDecimal Typecast on 1.8.7
Fix issue with attr_protected where malformed input could circumvent
protection

Fixes: CVE-2013-0276

Conflicts:
	activemodel/lib/active_model/attribute_methods.rb
	activerecord/test/cases/mass_assignment_security_test.rb
fix serialization vulnerability
Merge pull request #9126 from mbarb0sa/bugfix/json-decoding-in-rails-3-0-stable

fixed failing JSON decoding in rails 3-0-stable
Merge branch '3-0-sec' into 3-0-stable

* 3-0-sec:
  fix serialization vulnerability
  Fix issue with attr_protected where malformed input could circumvent protection
Revert "Merge pull request #9126 from mbarb0sa/bugfix/json-decoding-in-rails-3-0-stable"

This reverts commit 360af4eba60823c978bd5791d40f85c7c7739c80, reversing
changes made to f93d04677066b74ebb69f57028586126fc19228c.
Revert "Merge pull request #9210 from dylanahsmith/3-0-mysql-quote-numeric"

This reverts commit 663c9a6335b39f3b63d32619cbb11bece248f982, reversing
changes made to 10513d2eb9892c9e2bfe0ae04c9c16165c5c1544.
fix incorrect ^$ usage leading to XSS in sanitize_css [CVE-2013-1855]
JDOM XXE Protection [CVE-2013-1856]

Conflicts:
	activesupport/test/xml_mini/jdom_engine_test.rb
fix protocol checking in sanitization [CVE-2013-1857]

Conflicts:
	actionpack/lib/action_controller/vendor/html-scanner/html/sanitizer.rb
patch csrf token generation [bugid:4235]

port of commit 508dc457ece0708b6ba950619ad060f650047bb1

message from that commit:
  let the csrf token persist across all user sessions in a single browser (and expire it when the browser closes).
  shouldn't be a security risk and should eliminate a lot of stale-browser-window authenticity token issues.