Merge pull request #1179 from marutosi/finn-dev-stable-pr

merge release/3.0 branch to dev branch

Gemfile

@@ -125,6 +125,18 @@ gem 'prototype_legacy_helper', '0.0.0', :git => 'https://github.com/rails/protot
 # using the commit before this comment
 gem "i18n-js", :git => "https://github.com/fnando/i18n-js.git", :ref => '8801f8d17ef96c48a7a0269e251fcf1648c8f441'
 
+
+# Security fixes
+# Gems we don't depend directly on, but specify here to make sure we don't use a vulnerable
+# version. Please add a link to a security advisory when adding a Gem here.
+
+gem 'i18n', '>=0.6.8'
+# see https://groups.google.com/forum/#!topic/ruby-security-ann/pLrh6DUw998
+
+gem 'nokogiri', '>=1.5.11'
+# see https://groups.google.com/forum/#!topic/ruby-security-ann/DeJpjTAg1FA
+
+
 group :test do
   gem 'shoulda'
   gem 'object-daddy', '~> 1.1.0'

Gemfile.lock

@@ -145,7 +145,7 @@ GEM
     hashie (2.0.5)
     hike (1.2.3)
     htmldiff (0.0.1)
-    i18n (0.6.5)
+    i18n (0.6.8)
     interception (0.3)
     journey (1.0.4)
     json (1.8.1)
@@ -169,7 +169,7 @@ GEM
     multi_test (0.0.2)
     mysql2 (0.3.11)
     net-ldap (0.2.2)
-    nokogiri (1.5.9)
+    nokogiri (1.5.11)
     object-daddy (1.1.1)
     oj (2.1.6)
     omniauth (1.2.1)
@@ -347,6 +347,7 @@ DEPENDENCIES
   globalize
   gon (~> 4.0)
   htmldiff
+  i18n (>= 0.6.8)
   i18n-js!
   jruby-openssl
   json_spec
@@ -355,6 +356,7 @@ DEPENDENCIES
   multi_json
   mysql2 (~> 0.3.11)
   net-ldap (~> 0.2.2)
+  nokogiri (>= 1.5.11)
   object-daddy (~> 1.1.0)
   oj
   omniauth

app/controllers/application_controller.rb

@@ -560,7 +560,7 @@ def parse_qvalues(value)
 
   # Returns a string that can be used as filename value in Content-Disposition header
   def filename_for_content_disposition(name)
-    request.env['HTTP_USER_AGENT'] =~ /MSIE/ ? ERB::Util.url_encode(name) : name
+    request.env['HTTP_USER_AGENT'] =~ %r{(MSIE|Trident)} ? ERB::Util.url_encode(name) : name
   end
 
   def api_request?