Escape format, negative_format and units options of number helpers

Previously the values of these options were trusted leading to
potential XSS vulnerabilities.

Fixes: CVE-2014-0081
Use the reference for the mime type to get the format

Before we were calling to_sym in the mime type, even when it is unknown
what can cause denial of service since symbols are not removed by the
garbage collector.

Fixes: CVE-2014-0082
Preparing for 3.2.17 release
Merge branch '3-2-17' into 3-2-stable

Conflicts:
	actionpack/CHANGELOG.md
Only accept actions without File::SEPARATOR in the name.

This will avoid directory traversal in implicit render.

Fixes: CVE-2014-0130
Preparing for 3.2.18 release
Fix broken tests of the previous release
Merge branch '3-2-sec' into 3-2-stable

Conflicts:
	actionpack/CHANGELOG.md
use fnmatch to test for case insensitive file systems

this is due to:

  https://bugs.ruby-lang.org/issues/5994
feature detect for FNM_EXTGLOB for older Ruby. Fixes #15053
Feature detect based on Ruby version.

I didn't want to do this, FNM_EXTGLOB is defined on 2.1.x, but Dir.glob
returns the wrong value on Ruby less than 2.2.0.  Checking for a
case-insensitive FS seems too hard, so just check Ruby version  Checking
for a case-insensitive FS seems too hard, so just check Ruby version.
File.exists? is a deprecated name, use File.exist?

File.exists? is a deprecated name, use File.exist?
Merge pull request #15794 from vishalzambre/patch-1

File.exists? is a deprecated name, use File.exist?
Revert "Merge pull request #15794 from vishalzambre/patch-1"

This reverts commit 6d800a909e24465ca6f3fa5206222fa7d78967f6, reversing
changes made to 6a051299f98ee43864326c6c0a4f7d169d22b3f8.

We don't apply non-security fixes to 3-2-stable branch!!!
Make sure Active Support configurations are applied correctly

Before this patch configuration set using config.active_support
would not be set.

Closes #15364
Use a version of execjs compatible with Ruby 1.8
Check against bit string values using multiline regexp

Fix CVE-2014-3482.
Preparing for 3.2.19 release
Merge branch '3-2-sec' into 3-2-stable
Fix view inheritance for partial paths derived from objects.