Another security vulnerability in Rails. Sigh