Conflicts:
	actionpack/lib/action_controller/vendor/html-scanner/html/sanitizer.rb
	actionpack/test/controller/html-scanner/sanitizer_test.rb

Conflicts:
	actionpack/lib/action_controller/vendor/html-scanner/html/sanitizer.rb

This is a manual revert of commit 79aa54d0, since the commit itself touches
in addition some version numbers.

API generation before Rails 3 uses the Jamis template, which requires an
old version of RDoc. To generate the API you need Rake 0.8.x or 0.9.x,
and the RDoc distributed with 1.8.7 (version 1.0.1).

* 2-3-sec:
  bumping to 2.3.17
  fix serialization vulnerability
  fixing attr_protected CVE-2013-0276

This reverts commit d6adcb4e, reversing
changes made to 2e4aa39e.

Reason: merged to unmaintained branch.

Add alias to maintain coherence with other methods, in end_of_day

Just maintaining the coherence with other methods, since everything has "at_" as prefix.

Docs: Fixed bad exists? documentation.

Base#exists? does not actually take options like finder methods. Trying
to use what the documentation suggests will return a PG error because it
will look for a column named 'conditions'.

I changed the documentation to reflect how the exists? method actually
works.

Closes #9144
Fixes #9145

use the decimal HTML escape code for single quotes instead of the hex one so webkit-based browsers properly translate the code in form fields

Bump version on 2.3 gemspecs too.

Fixes CVE-2013-0333.  The ActiveSupport::JSON::Backends::Yaml class is present but the functionality has been removed entirely.

commit 9ef905f1
Author: Rafael Mendonça França <rafaelmfranca@gmail.com>
Date:   Tue Aug 7 22:38:40 2012 -0300

    Fix tests about single quote escaping

commit 780a7187
Author: Santiago Pastorino <santiago@wyeworks.com>
Date:   Tue Jul 31 22:25:54 2012 -0300

    html_escape should escape single quotes

    https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet#RULE_.231_-_HTML_Escape_Before_Inserting_Untrusted_Data_into_HTML_Element_Content
    Closes #7215

    Conflicts:
    	actionpack/test/controller/new_base/render_template_test.rb
    	actionpack/test/template/asset_tag_helper_test.rb
    	actionpack/test/template/erb_util_test.rb
    	actionpack/test/template/javascript_helper_test.rb
    	actionpack/test/template/template_test.rb
    	activesupport/lib/active_support/core_ext/string/output_safety.rb
    	activesupport/test/core_ext/string_ext_test.rb
    	railties/test/application/assets_test.rb

Thanks to Marek Labos & Nethemba

Add .gemspec files to 2-3-stable to help Bundler

Rack 1.1.3 also changes the Set-Cookie header to expects a
newline-delimited string instead of an Array, which breaks Rails 2.3's
expectations in a variety of ways.

This reverts commit 27a508c9.

Conflicts:
	actionpack/Rakefile

Backported rails 2.3 fix for CVE-2012-2695

Doc fixes in 2.3: validates_length_of

bump up rack version to the one that includes the Hash DoS fix

Fix bug in `ActionController::Request#remote_ip`

If HTTP_X_FORWARDED_FOR only contains whitespace, don't try to extract a
list of IP addresses from it.