Use `Base.strict_decode64` instead of `Base.decode64` just as we do in encoding;

Also reduce extra object allocation by creating string directly instead of join on Array
Fix AR#method_missing re-dispatching into overwritten attribute methods.

This was happening when a `super` call in an overwritten attribute method
was triggering a method_missing fallback, because attribute methods
haven't been generated yet.

  class Topic < ActiveRecord::Base
    def title
      # `super` would re-invoke this method if define_attribute_methods
      # hasn't been called yet resulting in double '!' appending
      super + '!'
    end
  end
Only use valid mime type symbols as cache keys

CVE-2013-6414
Escape the unit value provided to number_to_currency

Previously the unit values were trusted leading to potential XSS vulnerabilities.

Fixes: CVE-2013-6415
Ensure simple_format escapes its html attributes

The previous behavior equated the sanitize option for simple_format with the
escape option of content_tag, however these are two distinct concepts.

This fixes CVE-2013-6416

Conflicts:
	actionview/lib/action_view/helpers/text_helper.rb
Stop using i18n's built in HTML error handling.

i18n doesn't depend on active support which means it can't use our html_safe
code to do its escaping when generating the spans.  Rather than try to sanitize
the output from i18n, just revert to our old behaviour of rescuing the error
and constructing the tag ourselves.

Fixes: CVE-2013-4491
Deep Munge the parameters for GET and POST

The previous implementation of this functionality could be accidentally
subverted by instantiating a raw Rack::Request before the first Rails::Request
was constructed.

Fixes CVE-2013-6417
Use travel_to convention in existing test
Add support for localized date references

Ruby's Date class automatically gives us #yesterday, #today,
and #tomorrow. And ActiveSupport has a handy Time.zone.today
for getting a localized version. But there was no localized
version of #yesterday or #tomorrow. Until now.
fix email regex example code [ci skip]

different from the regex in EmailValidator
Merge pull request #13145 from acapilleri/fix_email_example

fix email regex example code [ci skip]
Merge pull request #12822 from cbartlett/master

Add support for localized date references
Added Date#all_week/month/quarter/year for generating date ranges
Merge pull request #9685 from dimko/patch-2

Added Date#all_week/month/quarter/year for generating date ranges
Changelog improvements [ci skip]
`connection.type_to_sql` returns a `String` for unmapped types.

Closes #13146.

This fixes an error when using:

```
change_colum :table, :column, :bigint, array: true
```
ActiveRecord migration exception message formatting
Merge branch 'master-sec'

* master-sec:
  Deep Munge the parameters for GET and POST
  Stop using i18n's built in HTML error handling.
  Ensure simple_format escapes its html attributes
  Escape the unit value provided to number_to_currency
  Only use valid mime type symbols as cache keys
Fix offset with last.

Closes #7441
Remove the escaping skip

We are generating safe strings in the paragraph, so we can escape the
tags