:sicssors:
Merge remote-tracking branch 'origin/master'
Only use valid mime type symbols as cache keys

CVE-2013-6414
Escape the unit value provided to number_to_currency

Previously the unit values were trusted leading to potential XSS vulnerabilities.

Fixes: CVE-2013-6415
Ensure simple_format escapes its html attributes

The previous behavior equated the sanitize option for simple_format with the
escape option of content_tag, however these are two distinct concepts.

This fixes CVE-2013-6416

Conflicts:
	actionview/lib/action_view/helpers/text_helper.rb
Stop using i18n's built in HTML error handling.

i18n doesn't depend on active support which means it can't use our html_safe
code to do its escaping when generating the spans.  Rather than try to sanitize
the output from i18n, just revert to our old behaviour of rescuing the error
and constructing the tag ourselves.

Fixes: CVE-2013-4491
Deep Munge the parameters for GET and POST

The previous implementation of this functionality could be accidentally
subverted by instantiating a raw Rack::Request before the first Rails::Request
was constructed.

Fixes CVE-2013-6417
Avoid generating more strings while iterating to create methods

Use the already existing strings instead of creating a new one each time
just to test if it responds to the methods.
Added back the `encode_big_decimal_as_string` option with warning

Also added the missing CHANGELOG entry for #12183 @ 80e7552073 and
4d02296cfb.
Merge pull request #13060 from chancancode/change_log_for_json_refactor

CHANGELOG for JSON refactor + added back the `encode_big_decimal_as_string` option with warning
Modify the Hash#assert_valid_keys error message so that it shows the valid keys. Also, show the wrong value as it was entered.

{ :failore => "stuff", :funny => "business" }.assert_valid_keys([ :failure, :funny ])
=> ArgumentError: Unknown key: failore
{ 'failore' => "stuff", :funny => "business" }.assert_valid_keys([ :failure, :funny ])
=> ArgumentError: Unknown key: failore

{ 'failore' => "stuff", :funny => "business" }.assert_valid_keys([ :failure, :funny ])
=> ArgumentError: Unknown key: "failore". Valid keys are: :failure, :funny

{ :failore => "stuff", :funny => "business" }.assert_valid_keys([ :failure, :funny ])
=> ArgumentError: Unknown key: :failore. Valid keys are: :failure, :funny

Conflicts:
	activerecord/CHANGELOG.md

Closes #11624.
Tidy up previous commit, fix message assertion and improve tests
Fix header Content-Type: #<Mime::NullType:...> in localized template

This PR fixes #13064 regression bug introduced by the #8085

Now in _process_format when the format is a Mime::NullType nothing is written in self.content_type.
In this way the method Response#assign_default_content_type_and_charset can
write the the default mime_type.
Merge branch 'format_localized_template' of https://github.com/acapilleri/rails

Conflicts:
	actionpack/CHANGELOG.md
Cleanups in comment about conditional
Convert Mime::NullType in a singleton
Introduce a context for rendering fixtures ERB.

Fixture files are passed through an ERB renderer before being read as
YAML. The rendering is currently done in the context of the main object,
so method definitons leak into other fixtures, and there is no clean
place to define fixture helpers.

After this commit, the ERB renderer will use a new subclass of
ActiveRecord::FixtureSet.context_class each time a fixture is rendered.
Merge pull request #13022 from pwnall/fixture_context

Introduce a context for rendering fixtures ERB.
Currently, we clear query_cache in cache block finish, even if we may already have cache true.

This commit takes into account the last cache_enabled value, before clearing query_cache.
Merge pull request #11643 from vipulnsward/query_cache_clear

Fix QueryCache to work with nested blocks