don't allow h1 tags in tinyMCE, fixes #12023

edit a wiki page, make sure it doesn't give you the
option to set the format to "h1"

Change-Id: I981c630f5d2c15685abeaf166316f26f19a38070
Reviewed-on: https://gerrit.instructure.com/15751
Reviewed-by: Bryan Madsen <bryan@instructure.com>
Tested-by: Jenkins <jenkins@instructure.com>
enforce permissions for new course roles

Updates the role permission checking to use base role types
(Account type and enrollment types) when calculating
permissions

Test Plan:
 * Test all the permissions
 * Test again
 * Create custom roles for accounts and each enrollment type
 * Change permissions and verify they work correctly
 * Delete roles and verify they still enforce permissions
 * Create roles in parent accounts and make changes in sub accounts
 * Verify those permissions too

closes #11740

Change-Id: Icce22f961065073b27252bb9e2f238de1e59e33b
Reviewed-on: https://gerrit.instructure.com/15735
Reviewed-by: Jeremy Stanley <jeremy@instructure.com>
Tested-by: Jenkins <jenkins@instructure.com>
spec: outcome specs coverage

   test:
     1. added bulk groups and outcomes
     2. gui state outcomes

Change-Id: I9666319df7fa2f625208ae9a7cda593b8e8bbd53
Reviewed-on: https://gerrit.instructure.com/14996
Reviewed-by: Jake Sorce <jake@instructure.com>
Tested-by: Jenkins <jenkins@instructure.com>
spec: reload before comparing times from DB

some DBs truncate times to second precision (instead of microsecond). if
the original in-memory object has microseconds, but the object compared
against has the same value loaded from the DB, they might not match when
expected to. so make sure the in-memory object also has the value that
has been round-tripped through the DB.

Change-Id: I531d7160604291d2ae0364e1b125b1b1edaaceee
Reviewed-on: https://gerrit.instructure.com/15763
Reviewed-by: Brian Palmer <brianp@instructure.com>
Tested-by: Jenkins <jenkins@instructure.com>
fix migration when an 'AccountAdmin' account user is present

test plan:

* Add a user as 'AccountAdmin'
* Run migration and make sure it doesn't fail

Change-Id: I25332e85d0be7ec6efe7b7010e5082b666b44757
Reviewed-on: https://gerrit.instructure.com/15756
Tested-by: Jenkins <jenkins@instructure.com>
Reviewed-by: Jeremy Stanley <jeremy@instructure.com>
display an optional error message on the migration list page

refs #CNVS-1210

Change-Id: Ic6ab2f72593f08869b19a76d38eb894aaac7ab45
Reviewed-on: https://gerrit.instructure.com/15755
Reviewed-by: Bracken Mosbacker <bracken@instructure.com>
Tested-by: Jenkins <jenkins@instructure.com>
use the correct permission for developer keys tab fixes #CNVS-1332

test plan:
 * create a role in site admin without access to developer keys
 * add a user to that role
 * login as that user, and go to site admin
 * the Developer Keys tab should not be visible
 * going to /developer_keys should give you access denied

Change-Id: I7ce3cbab13939067fb6d7e11c38dab3d48918442
Reviewed-on: https://gerrit.instructure.com/15775
Tested-by: Jenkins <jenkins@instructure.com>
Reviewed-by: Brian Palmer <brianp@instructure.com>
use same delegated logic for indirect login as direct login

test plan:
 * configure CAS or SAML on an account
 * log out
 * go to /accounts/self/settings?canvas_login=1
 * it should render a login page with login form
 * configure LDAP, disable Canvas Authentication on the settings
   page
 * log out
 * go to /accounts/self/settings
 * it should render a login page with login form

Change-Id: I40008821707a8dfde777b77b5f5e2be22aebf713
Reviewed-on: https://gerrit.instructure.com/15765
Tested-by: Jenkins <jenkins@instructure.com>
Reviewed-by: Brian Palmer <brianp@instructure.com>
whitelist for xsd files for the cc module

refs #CNVS-1125

this prevents any funky user input to the
xml_schema action in the ContentExport controller
from pulling up anything other than the
items in the target xsd directory.

TEST PLAN:

tough to test from the outside
because the existing pathing prevents
very much monkeying with the file path,
so most attack attempts would be prevented
simply by naively interpreting the path
as nonexistent for our routing config.  If you
find any way to get any other file in
the system except the ones in that
directory via the "/xsd/#{something}.xsd"
url path then you win and I have more to fix.

Change-Id: Iddb22c9bbd5778d67c3737c5425126419297a5d3
Reviewed-on: https://gerrit.instructure.com/15774
Reviewed-by: Cody Cutrer <cody@instructure.com>
Tested-by: Jenkins <jenkins@instructure.com>
document as_user_id

Change-Id: Iaaa2a87c2577333b3435bb548ba6bf13930a1fa9
Reviewed-on: https://gerrit.instructure.com/15757
Tested-by: Jenkins <jenkins@instructure.com>
Reviewed-by: Brian Palmer <brianp@instructure.com>
enforce unique role names within an account

also fix a bug in the spec where we weren't testing what we
thought we were testing

test plan:
 1. try to create two roles with the same name
    in the same account.  this should fail.
 2a. create a role.
 2b. change a permission in the role.
 2c. delete the role.
 2d. create a role with the same name as the one
     deleted in the last step.  this should
     succeed.
 2e. the permission change made in 2b should not
     be present in the newly created role

Change-Id: I3d7eb3a3f14c75eb42d1a1da22603b41c7e25b94
Reviewed-on: https://gerrit.instructure.com/15743
Tested-by: Jenkins <jenkins@instructure.com>
Reviewed-by: Bracken Mosbacker <bracken@instructure.com>
use label as d2l quiz question migration id instead of ident

because in some quizzes, every question has the same ident,
and d2l assesments refer to questions by label anyway.

fixes #CNVS-1346

test plan:
 - import the course attached to the ticket
 - the 'Correlation Quiz' should have unique questions, not
   45 copies of the same question

Change-Id: Ife122f691c083600428b893ba2e52042f5fc0ae6
Reviewed-on: https://gerrit.instructure.com/15827
Tested-by: Jenkins <jenkins@instructure.com>
Reviewed-by: Bracken Mosbacker <bracken@instructure.com>
update icon font file to newest version

Added icon font character for printer and bookmark
Added icon fonts for existing comment and graded icons

Change-Id: Iaf087956cb81c7ce1275fff5620140105ff751d6
Reviewed-on: https://gerrit.instructure.com/15813
Tested-by: Jenkins <jenkins@instructure.com>
Tested-by: Chris Hart <chris@12spokes.com>
Reviewed-by: Ryan Shaw <ryan@instructure.com>
make standalone-icons gray, not default link blue

Change-Id: I5b86d51972d3be499c242ab0ebb775080b99a5ef
refs: #CNVS-913
Reviewed-on: https://gerrit.instructure.com/15812
Tested-by: Jenkins <jenkins@instructure.com>
Reviewed-by: Chris Hart <chris@12spokes.com>
use right icon for calendar on course settings page

should look more like this: http://screencast.com/t/FoUzq55OAr
than this: http://screencast.com/t/24QslWCGuBd

Change-Id: Id20e19c70908b508b13d4a0766347e45aab8a21f
Reviewed-on: https://gerrit.instructure.com/15811
Tested-by: Jenkins <jenkins@instructure.com>
Reviewed-by: Chris Hart <chris@12spokes.com>
touch cross-shard users correctly fixes #CNVS-1334

also touch a user when destroying account users

test plan:
 * create a site admin role with only permission to manage admins
 * create a user, add them to the new role, and log in as them
 * go to the default account settings
 * settings should be the only visible tab
 * add yourself as an Account Admin
 * refresh
 * all tabs should show up now
 * remove yourself as an admin
 * refresh
 * should be back to just the Settings tab
 * go to an account on a different shard, and repeat adding and
   removing yourself as admin; results should be the same

Change-Id: I220465c27a67d3d43db534c0b191e54332e2b29a
Reviewed-on: https://gerrit.instructure.com/15782
Tested-by: Jenkins <jenkins@instructure.com>
Reviewed-by: Brian Palmer <brianp@instructure.com>
make invitation previews a setting closes #11985

test plan:
 * follow a link to an invitation in the default account
 * you should be able to look around the course before accepting
 * follow a link to an invitation in a non-default account
 * it should immediately accept the invitation or send you through
   the registration process if you are not logged in
 * enable invitation previews in the settings for the non-default
   account
 * follow a link to an invitation in that account again
 * it should now allow you to preview the course before accepting

Change-Id: I92bde85e0cae9dc4167f5ebd2e32cbbc06aa4242
Reviewed-on: https://gerrit.instructure.com/15636
Tested-by: Jenkins <jenkins@instructure.com>
Reviewed-by: Brian Palmer <brianp@instructure.com>