Redmine

Merged to 2.2-stable by r11111.

I saw comments on various blog posts / tweets saying that the article mentionned in the forum thread is not accurate and the problem could be exploited without knowing the secret token. Btw, none of the code related to authentication is affected (there's already a params[:blah].to_s performed on user inputs everywhere, which is a workaround mentionned on rails blog post). So I'm 99% sure your Redmine instance is totally unaffected if you force authentication.

Unfortunately there are other security vulnerabilities regarding params in rails core pipe. One disclosed tonight may affect Redmine in some way, I'll open a different issue for that one.