* master-sec:
  CVE-2013-0156: Safe XML params parsing. Doesn't allow symbols or yaml.
  * Strip nils from collections on JSON and XML posts. [CVE-2013-0155] * dealing with empty hashes. Thanks Damien Mathieu

Conflicts:
	guides/source/getting_started.md

view_cache_dependency API

A declarative API for specifying dependencies that affect template
cache digest computation. In your controller, specify any of said
dependencies:

  view_cache_dependency { "phone" if using_phone? }

When the block is evaluated, the resulting value is included in the
cache digest calculation, allowing you to generate different digests
for effectively the same template. (Mostly useful if you're mucking
with template load paths.)

set 'alt' attribute for image_submit_tag

Revert "unpermitted params" exception -- it's just not going to work. See the discussion on https://github.com/rails/strong_parameters/pull/75.

It includes security bug fixes and changes the initialization of
Rack::File to accept a hash, otherwise generating warnings.

See 295806e1 for the warnings fix.

Eliminate Rack::File headers deprecation warning

See http://intertwingly.net/projects/AWDwR4/checkdepot/section-6.1.html
rake test produces:
   "Rack::File headers parameter replaces cache_control after Rack 1.5."

Despite what the message says, it appears that the hearders parameter change
will be effective as of Rack 1.5:

https://github.com/rack/rack/blob/rack-1.4/lib/rack/file.rb#L24
https://github.com/rack/rack/blob/master/lib/rack/file.rb#L24

Previously rendering a partial without giving :object or :collection
would generate a local variable with the partial name by default.

This was noticed due to warnings in Ruby 2.0 of not used variables,
which turned out to be the generation of not used variables inside
partials that do not contain objects related to them.

Some tests were raising the following error:

    Could not log "sql.active_record" event. NoMethodError: undefined method
    `type' for nil:NilClass`

Due to the way binds were being logged, the column info was considered
always present, but that is not true for some of the tests listed in the
issue.

Closes #8806.

refactor reset_primary_key and change !blank? to present? in get_primary...

Use absolute path [ci skip]

It is semantically correct than relative path.

Don't require 'turn' from rails/test_help

This avoids "SECURITY WARNING: No secret option provided to Rack::Session::Cookie."

* Strip nils from collections on JSON and XML posts. [CVE-2013-0155] * dealing with empty hashes. Thanks Damien Mathieu

Conflicts:
	actionpack/CHANGELOG.md
	actionpack/lib/action_dispatch/http/request.rb
	actionpack/lib/action_dispatch/middleware/params_parser.rb
	activerecord/CHANGELOG.md
	activerecord/lib/active_record/relation/predicate_builder.rb
	activerecord/test/cases/relation/where_test.rb

Update guides/source/getting_started.md [ci skip]

    actions.rb:34: warning: instance variable @in_group not initialized

Related to the change introduced in 6cf47c53.

The doc:rails application rake task needs this README.

Closes #8804 [ci skip]

Improve StrongParameters documentation [ci skip]

Place article name in the beginning of guides page title

These warnings were actually a bug in Ruby 2.0, the accessors should not
be raising such warnings, they are only meant for ivars.

-

Revert "fix warnings in Ruby 2.0"

This reverts commit 26702a6d.

-

Revert "Merge pull request #8282 from arunagw/warning_removed_for_ruby2"

This reverts commit f63d6544, reversing
changes made to 3a890681.

Reflect change in 009873ae that renamed the script/ folder to bin/

If 'turn' is in the Gemfile with `:require => nil`, Rails should
respect that.

This supports the case where 'turn' may or may not be required
depending on different developers' preference or environment. E.g., you
require turn for local testing, but not on your CI server by putting
this in `test/test_helper.rb`:

    require 'turn' if ENV['TURN']

Access ivars via instance reader methods for consistency