fix for using coffee when compiling js

coffee works a directory at a time, and the regex wasn't working for
plugins for just a directory

test plan:
 * npm install -g coffee-script@1.1.2
 * have a plugin with coffeescript
 * rake canvas:compile_assets (in a clean repo)
 * it should not fail

Change-Id: I5ca8030b9cdc572875169a0342dc09601fd2569b
Reviewed-on: https://gerrit.instructure.com/10095
Reviewed-by: Jacob Fugal <jacob@instructure.com>
Tested-by: Hudson <hudson@instructure.com>
set headers with the user id on every request

X-Canvas-User-Id and X-Canvas-Real-User-Id will now be set when someone is
logged in and when someone is masquerading. These could be useful for further
logging down the stack. We set the global id for sharded situations.

test plan:
 * Log in to canvas
 * Verify that your http requests include X-Canvas-User-Id in the response

Change-Id: Id8818b5280618956541c513f5a3763e2bd60e89d
Reviewed-on: https://gerrit.instructure.com/10050
Reviewed-by: Cody Cutrer <cody@instructure.com>
Tested-by: Hudson <hudson@instructure.com>
enable forgery protection for all selenium specs

The Rails default of not enabling forgery protection in specs means that
a whole class of bugs isn't tested for. Unfortunately enabling this for
non-selenium specs will take a significant amount of work on the specs,
but since selenium specs, make requests using the browser, enabling it
will be easy.

This would've caught cc06aed9351

Change-Id: I0f095a05170f44993b0c15ca1df51271d4459318
Reviewed-on: https://gerrit.instructure.com/9880
Tested-by: Hudson <hudson@instructure.com>
Reviewed-by: Jon Jensen <jon@instructure.com>
spec: fix threaded discussions intermittent failure

Change-Id: I0b0dc5ecb88f802a8f2bc8ac747ba1bcc837ea87
Reviewed-on: https://gerrit.instructure.com/10098
Tested-by: Hudson <hudson@instructure.com>
Reviewed-by: Bryan Madsen <bryan@instructure.com>
spec: gradebook2 split and refactoring

Change-Id: Ifea9c7dbae2112f47823d93e2970887354fbd54b
Reviewed-on: https://gerrit.instructure.com/10099
Tested-by: Hudson <hudson@instructure.com>
Reviewed-by: Jake Sorce <jake@instructure.com>
don't show resume quiz button when quiz is locked fixes #6692

test plan(main quiz page):

  1. create and publish a quiz
  2. as a student begin taking the quiz
     don't finish the quiz, click a link
     to go somewhere else
  3. go back to the quizzes main page and you
     should see the resume quiz link
  4. login as the teacher and lock the quiz
  5. as the student go to the quiz main page
     notice the resume quiz link is gone

test plan(individual quiz page):

  1. create and publish a quiz
  2. as a student begin taking the quiz
     don't finish the quiz, click a link
     to go somewhere else
  3. go back to the quiz main page and click
     the quiz name to go into the quiz
  4. notice the resume quiz button on the right
  5. as a teacher lock the quiz
  6. as a student either refresh the page you are
     already on or go back to the quiz page and click
     the link to to back into the quiz. notice the resume
     quiz button is gone

Change-Id: I700f107c3c6cbfcd7e0811dddf7adfd910691f45
Reviewed-on: https://gerrit.instructure.com/10044
Tested-by: Hudson <hudson@instructure.com>
Reviewed-by: Jon Jensen <jon@instructure.com>
get rid of rdoctask deprecation warnings

Change-Id: I7373324ea0f5a56c9b104d37723537916a3a1716
Reviewed-on: https://gerrit.instructure.com/10107
Tested-by: Hudson <hudson@instructure.com>
Reviewed-by: Simon Williams <simon@instructure.com>
changed css on a couple divs fixes #7905

test plan:

  1. go to discussions
  2. create a new discussion
  3. click more options
  4. click delay posting this message
  5. notice the until element display
     is in-line with the checkbox and
     string
  6. click on a date and make sure the alignment sticks

Change-Id: Iadb79b783751f6937a9a343f300f3422e94268e8
Reviewed-on: https://gerrit.instructure.com/10131
Tested-by: Hudson <hudson@instructure.com>
Reviewed-by: Rob Orton <rob@instructure.com>
pending_review show as 'submitted' in event list; fixes #7840

submissions that are pending_review, which right now is just quiz submissions
with essay questions, were improperly being shown as 'not submitted' in the
coming-up events list on the dashboard and course home page. this correctly
marks them as submitted.

test-plan:
- create a quiz with an essay question and a due date in the next week
- as a student verify it shows in coming up as 'not submitted' on the dashboard
- take the quiz
- it should now show as 'submitted'
- make sure other events in the coming up list show correct states.

Change-Id: I3ad8d208f6b1d3a9366e68e869652c22ab2702d6
Reviewed-on: https://gerrit.instructure.com/9948
Tested-by: Hudson <hudson@instructure.com>
Reviewed-by: Jacob Fugal <jacob@instructure.com>
pass host not account domain to context_host refs #6859

test plan:
 * ensure specs pass

Change-Id: I0ce287218b09dc7d03242e09354749020b7044a6
Reviewed-on: https://gerrit.instructure.com/9819
Reviewed-by: Bracken Mosbacker <bracken@instructure.com>
Tested-by: Cody Cutrer <cody@instructure.com>
update compass to 0.12.1 (via compass-rails 1.0.1)

gets rid of "on_updating_stylesheet" deprecation warning

Change-Id: Ibec7853e251508ad663dee78de6d190af0bee0fd
Reviewed-on: https://gerrit.instructure.com/10123
Tested-by: Hudson <hudson@instructure.com>
Reviewed-by: Simon Williams <simon@instructure.com>
support listing multiple domains in saml metadata fixes #6859

test plan:
 * ensure saml metadata is unchanged

Change-Id: I5d7e82a7fdf936492bbc2d044999d3bdad01620f
Reviewed-on: https://gerrit.instructure.com/9863
Reviewed-by: Bracken Mosbacker <bracken@instructure.com>
Tested-by: Cody Cutrer <cody@instructure.com>
don't use eval in error handler

fixes #8219

typically $.parseJSON will be available here, and if it's not, we just
won't be able to parse a JSON formatted error response. We'll still have
the text of the error response available though.

test plan: in normal usage this will have no visible effect. if you
crafted a malicious XHR response with executable javascript, you could
verify that it's no longer executed in the error handler.

Change-Id: Ibc42a7d7ce1edc930a884d2a79013a1c9e052080
Reviewed-on: https://gerrit.instructure.com/10122
Tested-by: Hudson <hudson@instructure.com>
Reviewed-by: Zach Pendleton <zachp@instructure.com>
find_ids_in_ranges helper

like find_ids_in_batches, but returns a closed range of the ids,
instead of the actual ids so that whatever's iterating over the
table doesn't have to use a huge IN clause

test plan:
 * run the specs

Change-Id: Id22c197a6e4d80db49cc6ec99bb3e79e6fb69523
Reviewed-on: https://gerrit.instructure.com/10066
Tested-by: Hudson <hudson@instructure.com>
Reviewed-by: Brian Palmer <brianp@instructure.com>
notifications: allow including extra data for messages

refs #7771

This adds a 'data' block to broadcast_policy definitions.  The data
block should return a hash which will be turned into a struct named
'data' that is accessible in the message templates

Change-Id: I3c6d76577a1a1ba0f832669a4196fc8fae609058
Reviewed-on: https://gerrit.instructure.com/9720
Tested-by: Hudson <hudson@instructure.com>
Reviewed-by: Jon Jensen <jon@instructure.com>
add locale to user create/update apis. fixes #8191

test plan:
  * using the api, create a user with a locale and verify
    that the locale is saved.
  * using the api, update an existing user's locale and verify
    that the locale is saved.

Change-Id: Ie631f85613c6ad7094d320af77bc3f050373dd37
Reviewed-on: https://gerrit.instructure.com/10088
Reviewed-by: Jacob Fugal <jacob@instructure.com>
Tested-by: Hudson <hudson@instructure.com>
add referenced question banks to course copy

If a question bank outside of the course was referenced by
a quiz group the export for its quiz would fail. This fixes
that and tries to connect the group to the same bank on the
import step.

Test Plan:
 * Create a question bank on an account and one on a course
 * On a different course create a quiz that has two groups that point to each of those banks
 * Copy the course to a new one
 * The quiz groups should still point to their original banks

closes #8159

Change-Id: Idffb4e7c1ac3d00945d3544a9f0ace4ee241e45a
Reviewed-on: https://gerrit.instructure.com/10119
Reviewed-by: Simon Williams <simon@instructure.com>
Tested-by: Hudson <hudson@instructure.com>
spec: put these specs in the Canvas.redis_enabled? block

so specs don't fail without redis... yet

Change-Id: I59b295c66d78da470c66aa264c3a21e476f220d3
Reviewed-on: https://gerrit.instructure.com/10144
Reviewed-by: Bracken Mosbacker <bracken@instructure.com>
Tested-by: Hudson <hudson@instructure.com>
add pseudonym delete api. fixes #7156

affects: pseudonym/login api
test plan:
  * create a user with two pseudonyms;
  * as an unauthorized user, make api call and verify that
    401 is returned;
  * as an authorized user, make api call and verify that api is
    deleted;
  * as an authorized user, make api call to delete the last
    pseudonym and verify that error is returned.

Change-Id: Ic80b0b77db365298150422a87494aedf3cb57359
Reviewed-on: https://gerrit.instructure.com/9765
Tested-by: Hudson <hudson@instructure.com>
Reviewed-by: Brian Palmer <brianp@instructure.com>
touch the user when hard concluding fixes #7516

test plan:
 * add a ta a course
 * ensure they can do stuff
 * manually conclude the ta
 * the ta should not be able to assess rubrics, the course shouldn't
   be in their course menu, etc.

Change-Id: I7b9ec3d33b74cb1691e29e0069e1f7dc701c9b35
Reviewed-on: https://gerrit.instructure.com/10154
Tested-by: Hudson <hudson@instructure.com>
Reviewed-by: Jeremy Stanley <jeremy@instructure.com>
Reviewed-by: Bracken Mosbacker <bracken@instructure.com>