After reading through the source code changes between 2.3.6 and 2.3.7 (http://github.com/rails/rails/compare/v2.3.6...v2.3.7) it looks like someone forgot to prevent the closing form and fieldset tags in helpers from getting escaped. The developers also removed some deprecated code and related tests. Some of the comments on the change are not encouraging. It looks like this was pushed out into the wild a little too quickly.
Comments
After reading through the source code changes between 2.3.6 and 2.3.7 (http://github.com/rails/rails/compare/v2.3.6...v2.3.7) it looks like someone forgot to prevent the closing form and fieldset tags in helpers from getting escaped. The developers also removed some deprecated code and related tests. Some of the comments on the change are not encouraging. It looks like this was pushed out into the wild a little too quickly.
And the Rails Tutorial book (http://www.railstutorial.org/) has again been updated:
I hope this doesn't start happening every day. :-)tl;dr version: bugfix release for 2.3.6, needed if you use the rails_xss plugin.
Not sure why they didn't just call it 2.3.6.1.
Epic!