change parameter order
Merge pull request #3387 from php-engineer/master-security-test

Correct parameter order
Clear data and validationErrors *after* calling clearCache().

Having both properties cleaned after clearCache() means that you can use
the model data in specialized clearCache() implementations.

Fixes #3386
Prevent infinite loop caused when argv not set.

If shell is invoked with the wrong PHP executable (not CLI) and argv is not an array,  array_search on null causes infinite number of error messages.
Merge pull request #3381 from planardothum/shell-requires-cli

Add check to abort if $argv is undefined.
Fix auto linking urls with subdomain with underscore.

Closes #3392
Merge pull request #3395 from ADmad/2.4-autolinkurl

Fix auto linking urls with subdomain with underscore.

Fixes #3392
Use the form action URL in generated form hashes.

By including the URL in generated hash for secured forms we prevent
a class of abuse where a user uses one secured form to post into a
controller action the form was not originally intended for. These cross
action requests could potentially violate developer's mental model of
how SecurityComponent works and produce unexpected/undesirable outcomes.

Thanks to Kurita Takashi for pointing this issue out, and suggesting
a fix.
Merge branch 'master' into 2.5