Merge pull request #11466 from jetthoughts/updated_tesing_guides

Fix `rake test` description in the guides [ci skip]
`mail()` without arguments is a getter for the current mail.

This behavior is documented in our guides (http://edgeguides.rubyonrails.org/action_mailer_basics.html#action-mailer-callbacks)
but was broken in the past. This commit short curcuits
the `mail` method if:

  1. mail() was previously called
  2. no headers are passed
  3. no block is passed

Closes #13090.

/cc @pixeltrix

Conflicts:
	actionmailer/CHANGELOG.md
Merge pull request #13134 from rubiii/patch-1

added missing require to active_support/tagged_logging
Only use valid mime type symbols as cache keys

CVE-2013-6414
Escape the unit value provided to number_to_currency

Previously the unit values were trusted leading to potential XSS vulnerabilities.

Fixes: CVE-2013-6415
Ensure simple_format escapes its html attributes

The previous behavior equated the sanitize option for simple_format with the
escape option of content_tag, however these are two distinct concepts.

This fixes CVE-2013-6416
Deep Munge the parameters for GET and POST

The previous implementation of this functionality could be accidentally
subverted by instantiating a raw Rack::Request before the first Rails::Request
was constructed.

Fixes CVE-2013-6417
Stop using i18n's built in HTML error handling.

i18n doesn't depend on active support which means it can't use our html_safe
code to do its escaping when generating the spans.  Rather than try to sanitize
the output from i18n, just revert to our old behaviour of rescuing the error
and constructing the tag ourselves.

Fixes: CVE-2013-4491
Remove dead comment from AS extensions guide [ci skip]
Merge pull request #12123 from aredondo/master

Add regression test for IpSpoofAttackError issue

Closes #10780
updating the changelog
bumping version
fixing changelog
Merge pull request #13143 from joker1007/fix_active_record_callbacks_document_bug

Fix ActiveRecord::Callbacks sample code [ci skip]
Merge pull request #13145 from acapilleri/fix_email_example

fix email regex example code [ci skip]
`connection.type_to_sql` returns a `String` for unmapped types.

Closes #13146.

This fixes an error when using:

```
change_colum :table, :column, :bigint, array: true
```

Conflicts:
	activerecord/CHANGELOG.md
	activerecord/test/cases/adapter_test.rb
Merge branch '4-0-sec' into 4-0-stable

* 4-0-sec:
  fixing changelog
  bumping version
  updating the changelog
  Stop using i18n's built in HTML error handling.
  Deep Munge the parameters for GET and POST
  Ensure simple_format escapes its html attributes
  Escape the unit value provided to number_to_currency
  Only use valid mime type symbols as cache keys

Conflicts:
	actionpack/CHANGELOG.md
	actionpack/lib/action_view/helpers/text_helper.rb
Remove the escaping skip

We are generating safe strings in the paragraph, so we can escape the
tags

Conflicts:
	actionpack/lib/action_view/helpers/text_helper.rb
Merge pull request #13149 from laurocaetano/fix_offset_last

Fix offset with last.

Edit: improve changelog.
Fix documentation of number_to_currency helper

Now users have to explicit mark the unit as safe if they trust it.

Closes #13161

Conflicts:
	actionpack/lib/action_view/helpers/number_helper.rb
	actionpack/test/template/number_helper_i18n_test.rb