Merge branch 'tags-public-send'

Fixes #14180
Fixes #17461

actionpack/lib/action_view/helpers/tags/base.rb

@@ -25,7 +25,7 @@ def render
         private
 
         def value(object)
-          object.send @method_name if object
+          object.public_send @method_name if object
         end
 
         def value_before_type_cast(object)

actionpack/test/template/form_helper_test.rb

@@ -1512,6 +1512,20 @@ def test_form_for_with_symbol_object_name
     assert_dom_equal expected, output_buffer
   end
 
+  def test_form_tags_do_not_call_private_properties_on_form_object
+    obj = Class.new do
+      private
+
+      def private_property
+        raise "This method should not be called."
+      end
+    end.new
+
+    form_for(obj, as: "other_name", url: '/', html: { id: "edit-other-name" }) do |f|
+      assert_raise(NoMethodError) { f.hidden_field(:private_property) }
+    end
+  end
+
   def test_form_for_with_method_as_part_of_html_options
     form_for(@post, url: '/', html: { id: 'create-post', method: :delete }) do |f|
       concat f.text_field(:title)