This is already there
backport dynamic finder fix (CVE-2012-5664)
CVE-2013-0156: Safe XML params parsing. Doesn't allow symbols or yaml.
Merge branch '2-3-paperlesspost' into remove_test_unit