* 3-2-sec:
bumping version
remove ruby-prof
Fix issue with attr_protected where malformed input could circumvent protection
fixing call to columns hash. run the damn tests when you backport!
Bump rack dependency to 1.4.5
Merge pull request #9224 from dylanahsmith/bigdecimal-takes-string
Merge pull request #9208 from dylanahsmith/3-2-mysql-quote-numeric
Conflicts:
Gemfile
activerecord/CHANGELOG.md
* 3-2-sec:
bumping version
CVE-2013-0156: Safe XML params parsing. Doesn't allow symbols or yaml.
* Strip nils from collections on JSON and XML posts. [CVE-2013-0155] * dealing with empty hashes. Thanks Damien Mathieu
Avoid Rack security warning no secret provided
Conflicts:
actionpack/CHANGELOG.md
activerecord/CHANGELOG.md
activesupport/CHANGELOG.md
Specify type of singular assication during serialization
Conflicts:
activemodel/CHANGELOG.md
activemodel/test/cases/serializers/xml_serialization_test.rb
* 3-2-stable-rel:
updating changelogs
bumping version numbers
updating changelogs with security fixes
updating changelogs
Array parameters should not contain nil values.
Additional fix for CVE-2012-2661
At the end of initialize_dup was added the call to super if it exists,
so it also works with 1.8.7 where initialize_dup doesn't exist.
This issu was introduced with the pull request #6324
Requiring 'active_model/naming' will raise an uninitialized constant
ActiveSupport::Deprecation exception because the module core extension
doesn't require 'active_support/deprecation'. This require cannot be
added to the core extension because of circular dependency issues.
Since ActiveModel::Errors instance keeps all error messages as hash
we should duplicate this object as well.
Previously ActiveModel::Errors was a subclass of ActiveSupport::OrderedHash,
which results in different behavior on dup, this may result in regression for
people relying on it.
Because Rails 3.2 stills supports Ruby 1.8.7 in order to properly fix this
regression we need to backport #initialize_dup.
Without that patch when using ActiveModel::AttributeMethods
in a class that does not respond to `attributes` method,
stack level too deep error will be raised on non existing
method. While documentation is clear that you need to define
`attributes` method in order to use AttributeMethods module,
`stack level too deep` is rather obscure and hard to debug,
therefore we should try to not break `method_missing` if
someone forgets about defining `attributes`.
