apply Drupal core patch for SA-CORE-2014-005

Or even better, merge #5 instead.