update the redis gem to 3.0.1

This required building our own fork of the redis-store gem so that we
could update its dependency, and fix one small issue with redis connect
strings getting nil instead of the default value for the port number.

The redis 3.0.x gem now catches all Errno and Timeout errors and
re-raises them as subclasses of Redis::BaseConnectionError. It also now
handles EAGAIN internally, retrying when appropriate. So we've modified
our redis failure handling code to match.

test plan: verify the redis failure handling code still works (specs
pass). for instance, stop redis locally and see that canvas works in the
degraded state. make sure that redis still works for both caching and
non-caching code such as login attempts.

Change-Id: I9e8d3929afa06c522656d30f71efc0427e4ef7cc
Reviewed-on: https://gerrit.instructure.com/11521
Tested-by: Jenkins <jenkins@instructure.com>
Reviewed-by: Cody Cutrer <cody@instructure.com>
spec: add spec to syllabus file

tested:
  * validate jump to today link

Change-Id: I517748fc2f84d8ab39f9484b5d2d4f4de4322a8d
Reviewed-on: https://gerrit.instructure.com/12001
Tested-by: Jenkins <jenkins@instructure.com>
Reviewed-by: Bryan Madsen <bryan@instructure.com>
add api to get section info fixes #5885

Move CoursesController#sections to SectionsController#index, api-ify
SectionsController#show, refactor out sections_json, and bring docs
up to newer standards (@returns)

test plan:
 * ensure /api/v1/courses/:id/sections still lists sections, and
   includes of students works as well
 * /api/v1/courses/:id/sections/:id should return some basic
   section info
 * test that you can't find a section for the wrong course
 * test /api/v1/sections/:id works for raw ids and section ids

Change-Id: Ie6bf2257e0138ff7a76a5670a6cc041fcce0cd54
Reviewed-on: https://gerrit.instructure.com/12117
Reviewed-by: Simon Williams <simon@instructure.com>
Tested-by: Jenkins <jenkins@instructure.com>
spec: split up context modules

also refactored selenium/helper files to include
the selenium common file so any file using a common
file only has to include one file

Change-Id: I133f757da0e15a2f5e31999b45f137567f679ed7
Reviewed-on: https://gerrit.instructure.com/11986
Tested-by: Jenkins <jenkins@instructure.com>
Reviewed-by: Bryan Madsen <bryan@instructure.com>
use safefiles for object/embed tags in api responses, closes #8115

This modifies the API to return information on the required user_content
params for api responses. The javascript then processes the api response
fields and replaces the user content with iframe posts to safefiles,
same as we do server-side in erb currently for user_content in non-api
responses. This is done before the html is inserted on the page.

The current implementation requires the api to respond with these extra
data attributes all the time, not just for in-app requests. This isn't
ideal, but other api users will safely ignore those extra data
attributes.

test plan: in a discussion, post a reply that contains an object or
embed tag. reload the page and verify that the flash or java or whatever
still appears. inspect the html, and check that it is contained inside
an iframe pointing to the safefiles domain, rather than embedded
directly on the main canvas domain.

Change-Id: I5f1c5f4f267f654ec339ee422f0743f33ee2564f
Reviewed-on: https://gerrit.instructure.com/12111
Reviewed-by: Simon Williams <simon@instructure.com>
Tested-by: Jenkins <jenkins@instructure.com>
makes inline equations vertically aligned to the middle

fixes #8904

test plan:
* enter a formula into any rich content editor (like an assignment
  description or something)
* make sure it is vertically aligned to the center with normal text
  before and after saving

Change-Id: I056e6ca9fc24c3114777cd7bf654ca59c0270a57
Reviewed-on: https://gerrit.instructure.com/11875
Reviewed-by: Jon Jensen <jon@instructure.com>
Tested-by: Jenkins <jenkins@instructure.com>
spec: fix calendar intermittent failure

Change-Id: I6e1c2c831d67a9635b8cb82d3691d7ed0d760669
Reviewed-on: https://gerrit.instructure.com/12128
Tested-by: Jenkins <jenkins@instructure.com>
Reviewed-by: Bryan Madsen <bryan@instructure.com>
fix permission checks for submission comments

fixes #9370

a typo (instance_eval instead of class_eval) was causing submission comments to
not check permissions, so peer reviewers were receiving extra comments in ajax
responses.

test plan:
- submit an assignment, and comment on it
- also comment as the teacher
- set up a peer review
- load the page as the peer reviewer, it should not show the other comments
- make a comment as the reviewer. the other comments should not appear

Change-Id: I067e323a813ff836cfcadb5400e313de47be0e37
Reviewed-on: https://gerrit.instructure.com/12101
Tested-by: Jenkins <jenkins@instructure.com>
Reviewed-by: Cody Cutrer <cody@instructure.com>
preload pseudonyms for enrollments api fixes #9385

avoids N+1 queries

test plan:
 * run specs for enrollments api

Change-Id: I8704677379521a42fbaf5c0f3c06ccb6b88f6806
Reviewed-on: https://gerrit.instructure.com/12118
Tested-by: Jenkins <jenkins@instructure.com>
Reviewed-by: Brian Palmer <brianp@instructure.com>
search for xlisted sections when enrolling via CSV fixes #9175

test plan:
 * create two courses via SIS CSV
 * enroll a user in course 1 via SIS CSV by course_id only
 * xlist course 1's default section to course 2
 * enroll another user in course 1 via SIS CSV by course_id only again
 * the user should end up in the xlisted section in course 2

Change-Id: I3a114d70a109594a56915b705de77b87a177e966
Reviewed-on: https://gerrit.instructure.com/12122
Tested-by: Jenkins <jenkins@instructure.com>
Reviewed-by: Brian Palmer <brianp@instructure.com>
avoid root attachment cycles when cloning attachments

fixes #9252

test plan: Set up a course A with at least one file. Clone course A to
make course B. Then copy course B back into course A. Also try copying a
course into itself. None of these actions should cause loading
/courses/A/files or /courses/B/files to break. You can also check the db
directly to verify that root_attachment_id doesn't equal id for any of
the rows.

Change-Id: Iee662358d8cc68f30ef7116cdb1bfa46eb99d996
Reviewed-on: https://gerrit.instructure.com/12061
Tested-by: Jenkins <jenkins@instructure.com>
Reviewed-by: Mark Ericksen <marke@instructure.com>
Reviewed-by: Bracken Mosbacker <bracken@instructure.com>
allow resetting student view; closes #9229

this creates a fixed bottom bar that shows up on every page when you are in
student view, serving as both a reminder and a place for the buttons to leave
student view or to reset the test student.  resetting the test student is a new
piece of functionality which removes all course artifacts created by the test
student, letting a teacher "start over" the test student.

test plan:
- enter student view
- there should be a permanant bar at the bottom of the page, with buttons
- there should no longer be a [Leave Student View] link in the top right corner
- the leave button should work
- as the test student, interact with the course (submit assignments, take
  quizzes, comment in discussions, etc)
- click the reset student link in the bottom bar
- all of the interactions above should be gone

Change-Id: If73be7a28f6af5378da26f92e82a69a72352d831
Reviewed-on: https://gerrit.instructure.com/12057
Tested-by: Jenkins <jenkins@instructure.com>
Reviewed-by: Simon Williams <simon@instructure.com>
try to identify referenced files in invalid qti

some qti vendors generate file references to files that
might not be where they are specified. This tries to find
them anyway.

Test Plan:
 * Import the test fixture for bb_vista qti specs
 * The images in the questions should appear

closes #8051 #8671

Change-Id: I0cbfd0e8dee8654fe54996a041c81038eb53dd34
Reviewed-on: https://gerrit.instructure.com/10947
Reviewed-by: Cody Cutrer <cody@instructure.com>
Tested-by: Jenkins <jenkins@instructure.com>
favorite courses api, closes #9178

overhaul the FavoritesController to implement an API,
and retarget the web UI on top of this API.

note: /favorites was capable of adding favorite _anythings_,
not just courses - however, in a publicly documented API,
we don't want to encourage users to start creating
favorite files or sections or discussions and then
expect these to have meaning.

it would not be much effort to generalize the API a bit
(parameterizing the object type, but limiting the
allowed types to ["Course"] for the time being) -
if we think this won't make the documentation too
awkward.  (we can, of course, make this change once
we actually _need_ it, without breaking backward
compatibility.)

test plan:
 - make sure the web UI for course favorites works;
   it has been retargeted on the API
 - view the API documentation for Favorites;
   verify that it was generated properly
 - exercise the new APIs:
   * GET /api/v1/users/self/favorites/courses
   * POST /api/v1/users/self/favorites/courses/:id
   * DELETE /api/v1/users/self/favorites/courses/:id
   * DELETE /api/v1/users/self/favorites/courses

Change-Id: Ib4b6590af0202896846a5eb75f59a8fabb95fe6c
Reviewed-on: https://gerrit.instructure.com/12032
Reviewed-by: Simon Williams <simon@instructure.com>
Tested-by: Jenkins <jenkins@instructure.com>
better handle nil users on wikis and discussions

Users can validly be nil for wikis/discussions from content
imports. This makes the UI a little nicer for those cases

Test Plan:
 * Import content from a .zip that has wiki pages in it
 * The wiki page history should say Content Importer instead of having no name
 *  The individual revision page should say it was imported at a time

closes #8053

Change-Id: I5e382c3186d439b2e820c4b4c9103566792f4da3
Reviewed-on: https://gerrit.instructure.com/11897
Reviewed-by: Simon Williams <simon@instructure.com>
Tested-by: Jenkins <jenkins@instructure.com>
disable profiles based on account setting

fixes #9386

Test plan:
  * Click on the 'Profile' link in the header, you should go to the
    profile settings page
    - There should not be a 'Profile' tab in the left nav
  * Enable the 'enable_profiles' account setting for your user's
    account.  Clicking on 'Profile' should now take you to the new-style
    profile page

Change-Id: Ie2bcd41ae98ec93d6a423e00936d79fac291be0c
Reviewed-on: https://gerrit.instructure.com/12132
Tested-by: Jenkins <jenkins@instructure.com>
Reviewed-by: Ryan Florence <ryanf@instructure.com>
allow .user_content to have elementTogglers

test plan:

make a wiki page.
go to the html view.
type:

<button class="element_toggler" aria-controls="thing">Show Dialog</button>
<form id="thing" data-turn-into-dialog style="display:none">
  if you see this it worked
</form>

save the page.
click the 'Show Dialog' button.
if it shows the dialog it works.

Change-Id: I818546b7e7cf396b9e8993e5d0067d79240c21fa
Reviewed-on: https://gerrit.instructure.com/11645
Tested-by: Jenkins <jenkins@instructure.com>
Reviewed-by: Ryan Florence <ryanf@instructure.com>
don't die if a deleted section is present in student.sections
refs: #9249

Change-Id: I92adaac0a6a114e5841fd199c56def769d38f3d9
Reviewed-on: https://gerrit.instructure.com/11959
Tested-by: Jenkins <jenkins@instructure.com>
Reviewed-by: Mark Ericksen <marke@instructure.com>
adds error for invalid original password

fixes issue #137 from the github tickets.

test plan
  go to change password as user
  should show error if original password is wrong

Change-Id: Ib7fe4472d16f9e95272f9a33190c10c5fd9fa212
Reviewed-on: https://gerrit.instructure.com/11821
Reviewed-by: Jake Sorce <jake@instructure.com>
Tested-by: Jenkins <jenkins@instructure.com>
files/folders api

A complete api for folder and file management
Also updates the alphabetical sorting features to escape
a backslash caused errors when casting a string to a
bytea in postgres

Test Plan:
 * CRUD yourself some files
 * CRUD yourself some folder

closes #9163

Change-Id: I0b937f9273077b66ab9d6c37171bec1fcc5380dd
Reviewed-on: https://gerrit.instructure.com/12085
Tested-by: Jenkins <jenkins@instructure.com>
Reviewed-by: Bracken Mosbacker <bracken@instructure.com>