activerecord sql-injection vulnerability issue
===

I am working on a app with rails version 3.0.3 and I am trying patch files to address activerecord sql-injection vulnerability issue. Based on this discussion: http://seclists.org/oss-sec/2012/q2/504 

Attached with the discussion are patches for various versions of rails. I downloaded the appropriate patch and was trying to patch the file up. But I am having issues in it. This is my first experience with patching a file. Below is the output displaying the error. Any help with this is greatly appreciated.

    developer@developer-desktop:~/.rvm/gems/ruby-1.8.7-p330@rails3/gems$ patch -p2 < 3-0-sql-injection.patch 
    patching file lib/active_record/relation/predicate_builder.rb
    Hunk #1 FAILED at 5.
    1 out of 1 hunk FAILED -- saving rejects to file lib/active_record/relation/predicate_builder.rb.rej
    patching file test/cases/relation/where_test.rb
    Hunk #1 FAILED at 11.
    1 out of 1 hunk FAILED -- saving rejects to file test/cases/relation/where_test.rb.rej
    developer@developer-desktop:~/.rvm/gems/ruby-1.8.7-p330@rails3/gems$

The output of predicate_builder.rb.rej is:

    --- lib/active_record/relation/predicate_builder.rb
    +++ lib/active_record/relation/predicate_builder.rb
        @@ -5,17 +5,17 @@
           @engine = engine
         end
 
    -    def build_from_hash(attributes, default_table, check_column = true)
    +    def build_from_hash(attributes, default_table, allow_table_name = true)
           predicates = attributes.map do |column, value|
             table = default_table
 
    -        if value.is_a?(Hash)
    +        if allow_table_name && value.is_a?(Hash)
               table = Arel::Table.new(column, :engine => @engine)
               build_from_hash(value, table, false)
             else
               column = column.to_s
 
    -          if check_column && column.include?('.')
    +          if allow_table_name && column.include?('.')
                 table_name, column = column.split('.', 2)
                 table = Arel::Table.new(table_name, :engine => @engine)
               end