Merge branch '3-2-13' into 3-2-stable

* 3-2-13:
  bumping to 3.2.13
  fix protocol checking in sanitization [CVE-2013-1857]
  JDOM XXE Protection [CVE-2013-1856]
  fix incorrect ^$ usage leading to XSS in sanitize_css [CVE-2013-1855]
  stop calling to_sym when building arel nodes [CVE-2013-1854]
  Merge pull request #9616 from exviva/multiple_select_name_double_square_brackets
  bumping to rc2
  Revert "Merge pull request #8209 from senny/backport_8176"
  Freeze columns only once per Result
  Preparing for 3.2.13.rc1 release
  Update CHANGELOGs for 3.2.13 release.

Conflicts:
	actionmailer/CHANGELOG.md
	actionpack/CHANGELOG.md
	activemodel/CHANGELOG.md
	activeresource/CHANGELOG.md
	activesupport/CHANGELOG.md
	railties/CHANGELOG.md

7 files changed, 12 insertions, 28 deletions

diff --git a/activerecord/CHANGELOG.md b/activerecord/CHANGELOG.md
index 2ac5287268..43c1a4565f 100644
--- a/activerecord/CHANGELOG.md
+++ b/activerecord/CHANGELOG.md
@@ -1,4 +1,4 @@
-## unreleased ##
+## Rails 3.2.13 (Feb 17, 2013) ##
 
 *   Reload the association target if it's stale. `@stale_state` should be nil
     when a model isn't saved.
@@ -238,16 +238,6 @@
 
     *Victor Costan*
 
-*   `#pluck` can be used on a relation with `select` clause.
-    Fixes #7551.
-    Backport of #8176.
-
-    Example:
-
-        Topic.select([:approved, :id]).order(:id).pluck(:id)
-
-    *Yves Senn*
-
 *   Use `nil?` instead of `blank?` to check whether dynamic finder with a bang
     should raise RecordNotFound.
     Fixes #7238.
diff --git a/activerecord/lib/active_record/relation.rb b/activerecord/lib/active_record/relation.rb
index 4b3b30d6ed..ae1a57545e 100644
--- a/activerecord/lib/active_record/relation.rb
+++ b/activerecord/lib/active_record/relation.rb
@@ -464,7 +464,7 @@ module ActiveRecord
         node.left.relation.name == table_name
       }
 
-      Hash[equalities.map { |where| [where.left.name, where.right] }]
+      Hash[equalities.map { |where| [where.left.name, where.right] }].with_indifferent_access
     end
 
     def scope_for_create
diff --git a/activerecord/lib/active_record/relation/predicate_builder.rb b/activerecord/lib/active_record/relation/predicate_builder.rb
index b31fdfd981..413b81cc69 100644
--- a/activerecord/lib/active_record/relation/predicate_builder.rb
+++ b/activerecord/lib/active_record/relation/predicate_builder.rb
@@ -20,7 +20,7 @@ module ActiveRecord
             table = Arel::Table.new(table_name, engine)
           end
 
-          attribute = table[column.to_sym]
+          attribute = table[column]
 
           case value
           when ActiveRecord::Relation
diff --git a/activerecord/lib/active_record/version.rb b/activerecord/lib/active_record/version.rb
index a340cfaf7d..9069d9964f 100644
--- a/activerecord/lib/active_record/version.rb
+++ b/activerecord/lib/active_record/version.rb
@@ -2,7 +2,7 @@ module ActiveRecord
   module VERSION #:nodoc:
     MAJOR = 3
     MINOR = 2
-    TINY  = 12
+    TINY  = 13
     PRE   = nil
 
     STRING = [MAJOR, MINOR, TINY, PRE].compact.join('.')
diff --git a/activerecord/test/cases/calculations_test.rb b/activerecord/test/cases/calculations_test.rb
index a1dc1de38d..67137d168b 100644
--- a/activerecord/test/cases/calculations_test.rb
+++ b/activerecord/test/cases/calculations_test.rb
@@ -493,12 +493,6 @@ class CalculationsTest < ActiveRecord::TestCase
     assert_equal [1,2,3,4], Topic.order(:id).pluck("topics.id")
   end
 
-  def test_pluck_replaces_select_clause
-    taks_relation = Topic.select([:approved, :id]).order(:id)
-    assert_equal [1,2,3,4], taks_relation.pluck(:id)
-    assert_equal [false, true, true, true], taks_relation.pluck(:approved)
-  end
-
   def test_pluck_auto_table_name_prefix
     c = Company.create!(:name => "test", :contracts => [Contract.new])
     assert_equal [c.id], Company.joins(:contracts).pluck(:id)
diff --git a/activerecord/test/cases/method_scoping_test.rb b/activerecord/test/cases/method_scoping_test.rb
index 0ab4f30363..ac84306eae 100644
--- a/activerecord/test/cases/method_scoping_test.rb
+++ b/activerecord/test/cases/method_scoping_test.rb
@@ -212,14 +212,14 @@ class MethodScopingTest < ActiveRecord::TestCase
     table = VerySpecialComment.arel_table
     relation = VerySpecialComment.scoped
     relation.where_values << table[:id].not_eq(1)
-    assert_equal({:type => "VerySpecialComment"}, relation.send(:scope_for_create))
+    assert_equal({'type' => "VerySpecialComment"}, relation.send(:scope_for_create))
   end
 
   def test_scoped_create
     new_comment = nil
 
     VerySpecialComment.send(:with_scope, :create => { :post_id => 1 }) do
-      assert_equal({:post_id => 1, :type => 'VerySpecialComment' }, VerySpecialComment.scoped.send(:scope_for_create))
+      assert_equal({'post_id' => 1, 'type' => 'VerySpecialComment' }, VerySpecialComment.scoped.send(:scope_for_create))
       new_comment = VerySpecialComment.create :body => "Wonderful world"
     end
 
@@ -228,7 +228,7 @@ class MethodScopingTest < ActiveRecord::TestCase
 
   def test_scoped_create_with_join_and_merge
     Comment.where(:body => "but Who's Buying?").joins(:post).merge(Post.where(:body => 'Peace Sells...')).with_scope do
-      assert_equal({:body => "but Who's Buying?"}, Comment.scoped.scope_for_create)
+      assert_equal({'body' => "but Who's Buying?"}, Comment.scoped.scope_for_create)
     end
   end
 
@@ -441,7 +441,7 @@ class NestedScopingTest < ActiveRecord::TestCase
     comment = nil
     Comment.send(:with_scope, :create => { :post_id => 1}) do
       Comment.send(:with_scope, :create => { :post_id => 2}) do
-        assert_equal({:post_id => 2}, Comment.scoped.send(:scope_for_create))
+        assert_equal({'post_id' => 2}, Comment.scoped.send(:scope_for_create))
         comment = Comment.create :body => "Hey guys, nested scopes are broken. Please fix!"
       end
     end
@@ -453,7 +453,7 @@ class NestedScopingTest < ActiveRecord::TestCase
 
     Comment.send(:with_scope, :create => { :body => "Hey guys, nested scopes are broken. Please fix!" }) do
       Comment.send(:with_exclusive_scope, :create => { :post_id => 1 }) do
-        assert_equal({:post_id => 1}, Comment.scoped.send(:scope_for_create))
+        assert_equal({'post_id' => 1}, Comment.scoped.send(:scope_for_create))
         assert_blank Comment.new.body
         comment = Comment.create :body => "Hey guys"
       end
diff --git a/activerecord/test/cases/relation_test.rb b/activerecord/test/cases/relation_test.rb
index 7a75a8436b..6efdeac3d9 100644
--- a/activerecord/test/cases/relation_test.rb
+++ b/activerecord/test/cases/relation_test.rb
@@ -71,7 +71,7 @@ module ActiveRecord
     def test_has_values
       relation = Relation.new Post, Post.arel_table
       relation.where_values << relation.table[:id].eq(10)
-      assert_equal({:id => 10}, relation.where_values_hash)
+      assert_equal({'id' => 10}, relation.where_values_hash)
     end
 
     def test_values_wrong_table
@@ -101,7 +101,7 @@ module ActiveRecord
 
     def test_create_with_value
       relation = Relation.new Post, Post.arel_table
-      hash = { :hello => 'world' }
+      hash = { 'hello' => 'world' }
       relation.create_with_value = hash
       assert_equal hash, relation.scope_for_create
     end
@@ -110,7 +110,7 @@ module ActiveRecord
       relation = Relation.new Post, Post.arel_table
       relation.where_values << relation.table[:id].eq(10)
       relation.create_with_value = {:hello => 'world'}
-      assert_equal({:hello => 'world', :id => 10}, relation.scope_for_create)
+      assert_equal({'hello' => 'world', 'id' => 10}, relation.scope_for_create)
     end
 
     # FIXME: is this really wanted or expected behavior?