don't allow h1 tags in tinyMCE, fixes #12023

edit a wiki page, make sure it doesn't give you the
option to set the format to "h1"

Change-Id: I981c630f5d2c15685abeaf166316f26f19a38070
Reviewed-on: https://gerrit.instructure.com/15751
Reviewed-by: Bryan Madsen <bryan@instructure.com>
Tested-by: Jenkins <jenkins@instructure.com>
enforce permissions for new course roles

Updates the role permission checking to use base role types
(Account type and enrollment types) when calculating
permissions

Test Plan:
 * Test all the permissions
 * Test again
 * Create custom roles for accounts and each enrollment type
 * Change permissions and verify they work correctly
 * Delete roles and verify they still enforce permissions
 * Create roles in parent accounts and make changes in sub accounts
 * Verify those permissions too

closes #11740

Change-Id: Icce22f961065073b27252bb9e2f238de1e59e33b
Reviewed-on: https://gerrit.instructure.com/15735
Reviewed-by: Jeremy Stanley <jeremy@instructure.com>
Tested-by: Jenkins <jenkins@instructure.com>
spec: outcome specs coverage

   test:
     1. added bulk groups and outcomes
     2. gui state outcomes

Change-Id: I9666319df7fa2f625208ae9a7cda593b8e8bbd53
Reviewed-on: https://gerrit.instructure.com/14996
Reviewed-by: Jake Sorce <jake@instructure.com>
Tested-by: Jenkins <jenkins@instructure.com>
spec: reload before comparing times from DB

some DBs truncate times to second precision (instead of microsecond). if
the original in-memory object has microseconds, but the object compared
against has the same value loaded from the DB, they might not match when
expected to. so make sure the in-memory object also has the value that
has been round-tripped through the DB.

Change-Id: I531d7160604291d2ae0364e1b125b1b1edaaceee
Reviewed-on: https://gerrit.instructure.com/15763
Reviewed-by: Brian Palmer <brianp@instructure.com>
Tested-by: Jenkins <jenkins@instructure.com>
fix migration when an 'AccountAdmin' account user is present

test plan:

* Add a user as 'AccountAdmin'
* Run migration and make sure it doesn't fail

Change-Id: I25332e85d0be7ec6efe7b7010e5082b666b44757
Reviewed-on: https://gerrit.instructure.com/15756
Tested-by: Jenkins <jenkins@instructure.com>
Reviewed-by: Jeremy Stanley <jeremy@instructure.com>
display an optional error message on the migration list page

refs #CNVS-1210

Change-Id: Ic6ab2f72593f08869b19a76d38eb894aaac7ab45
Reviewed-on: https://gerrit.instructure.com/15755
Reviewed-by: Bracken Mosbacker <bracken@instructure.com>
Tested-by: Jenkins <jenkins@instructure.com>
use the correct permission for developer keys tab fixes #CNVS-1332

test plan:
 * create a role in site admin without access to developer keys
 * add a user to that role
 * login as that user, and go to site admin
 * the Developer Keys tab should not be visible
 * going to /developer_keys should give you access denied

Change-Id: I7ce3cbab13939067fb6d7e11c38dab3d48918442
Reviewed-on: https://gerrit.instructure.com/15775
Tested-by: Jenkins <jenkins@instructure.com>
Reviewed-by: Brian Palmer <brianp@instructure.com>
use same delegated logic for indirect login as direct login

test plan:
 * configure CAS or SAML on an account
 * log out
 * go to /accounts/self/settings?canvas_login=1
 * it should render a login page with login form
 * configure LDAP, disable Canvas Authentication on the settings
   page
 * log out
 * go to /accounts/self/settings
 * it should render a login page with login form

Change-Id: I40008821707a8dfde777b77b5f5e2be22aebf713
Reviewed-on: https://gerrit.instructure.com/15765
Tested-by: Jenkins <jenkins@instructure.com>
Reviewed-by: Brian Palmer <brianp@instructure.com>
whitelist for xsd files for the cc module

refs #CNVS-1125

this prevents any funky user input to the
xml_schema action in the ContentExport controller
from pulling up anything other than the
items in the target xsd directory.

TEST PLAN:

tough to test from the outside
because the existing pathing prevents
very much monkeying with the file path,
so most attack attempts would be prevented
simply by naively interpreting the path
as nonexistent for our routing config.  If you
find any way to get any other file in
the system except the ones in that
directory via the "/xsd/#{something}.xsd"
url path then you win and I have more to fix.

Change-Id: Iddb22c9bbd5778d67c3737c5425126419297a5d3
Reviewed-on: https://gerrit.instructure.com/15774
Reviewed-by: Cody Cutrer <cody@instructure.com>
Tested-by: Jenkins <jenkins@instructure.com>
document as_user_id

Change-Id: Iaaa2a87c2577333b3435bb548ba6bf13930a1fa9
Reviewed-on: https://gerrit.instructure.com/15757
Tested-by: Jenkins <jenkins@instructure.com>
Reviewed-by: Brian Palmer <brianp@instructure.com>
enforce unique role names within an account

also fix a bug in the spec where we weren't testing what we
thought we were testing

test plan:
 1. try to create two roles with the same name
    in the same account.  this should fail.
 2a. create a role.
 2b. change a permission in the role.
 2c. delete the role.
 2d. create a role with the same name as the one
     deleted in the last step.  this should
     succeed.
 2e. the permission change made in 2b should not
     be present in the newly created role

Change-Id: I3d7eb3a3f14c75eb42d1a1da22603b41c7e25b94
Reviewed-on: https://gerrit.instructure.com/15743
Tested-by: Jenkins <jenkins@instructure.com>
Reviewed-by: Bracken Mosbacker <bracken@instructure.com>
use label as d2l quiz question migration id instead of ident

because in some quizzes, every question has the same ident,
and d2l assesments refer to questions by label anyway.

fixes #CNVS-1346

test plan:
 - import the course attached to the ticket
 - the 'Correlation Quiz' should have unique questions, not
   45 copies of the same question

Change-Id: Ife122f691c083600428b893ba2e52042f5fc0ae6
Reviewed-on: https://gerrit.instructure.com/15827
Tested-by: Jenkins <jenkins@instructure.com>
Reviewed-by: Bracken Mosbacker <bracken@instructure.com>
update icon font file to newest version

Added icon font character for printer and bookmark
Added icon fonts for existing comment and graded icons

Change-Id: Iaf087956cb81c7ce1275fff5620140105ff751d6
Reviewed-on: https://gerrit.instructure.com/15813
Tested-by: Jenkins <jenkins@instructure.com>
Tested-by: Chris Hart <chris@12spokes.com>
Reviewed-by: Ryan Shaw <ryan@instructure.com>
make standalone-icons gray, not default link blue

Change-Id: I5b86d51972d3be499c242ab0ebb775080b99a5ef
refs: #CNVS-913
Reviewed-on: https://gerrit.instructure.com/15812
Tested-by: Jenkins <jenkins@instructure.com>
Reviewed-by: Chris Hart <chris@12spokes.com>
use right icon for calendar on course settings page

should look more like this: http://screencast.com/t/FoUzq55OAr
than this: http://screencast.com/t/24QslWCGuBd

Change-Id: Id20e19c70908b508b13d4a0766347e45aab8a21f
Reviewed-on: https://gerrit.instructure.com/15811
Tested-by: Jenkins <jenkins@instructure.com>
Reviewed-by: Chris Hart <chris@12spokes.com>
touch cross-shard users correctly fixes #CNVS-1334

also touch a user when destroying account users

test plan:
 * create a site admin role with only permission to manage admins
 * create a user, add them to the new role, and log in as them
 * go to the default account settings
 * settings should be the only visible tab
 * add yourself as an Account Admin
 * refresh
 * all tabs should show up now
 * remove yourself as an admin
 * refresh
 * should be back to just the Settings tab
 * go to an account on a different shard, and repeat adding and
   removing yourself as admin; results should be the same

Change-Id: I220465c27a67d3d43db534c0b191e54332e2b29a
Reviewed-on: https://gerrit.instructure.com/15782
Tested-by: Jenkins <jenkins@instructure.com>
Reviewed-by: Brian Palmer <brianp@instructure.com>
make invitation previews a setting closes #11985

test plan:
 * follow a link to an invitation in the default account
 * you should be able to look around the course before accepting
 * follow a link to an invitation in a non-default account
 * it should immediately accept the invitation or send you through
   the registration process if you are not logged in
 * enable invitation previews in the settings for the non-default
   account
 * follow a link to an invitation in that account again
 * it should now allow you to preview the course before accepting

Change-Id: I92bde85e0cae9dc4167f5ebd2e32cbbc06aa4242
Reviewed-on: https://gerrit.instructure.com/15636
Tested-by: Jenkins <jenkins@instructure.com>
Reviewed-by: Brian Palmer <brianp@instructure.com>
don't limit css bundle stylesheets to "screen"

include_stylesheets is a jammit method that
ends up calling stylesheet_link_tag which by default
says media="screen" this tells it to say media="all"

if you want part of your stylesheet to target a specific
media (i.e., print) put that in a block like:

@media print { /* do stuff */ }

Change-Id: I9513d1e01d437a3ba1bf61b9cd79781166a97d22
Reviewed-on: https://gerrit.instructure.com/15705
Reviewed-by: Chris Hart <chris@12spokes.com>
Tested-by: Jenkins <jenkins@instructure.com>
fix and improve the page view cassandra transition infra

Store the page view method on the individual object at creation, so we
get the right method still when saving.

fixes #CNVS-868

test plan: with the global Setting set to cache page views, but a
specific shard set to cassandra page views, make sure that page views
created on both that shard and another shard go to the right place.

Change-Id: Ib236c8cd4401a919978423f777c5e95ce4f1ee85
Reviewed-on: https://gerrit.instructure.com/15825
Reviewed-by: Cody Cutrer <cody@instructure.com>
Reviewed-by: Jacob Fugal <jacob@instructure.com>
Tested-by: Jenkins <jenkins@instructure.com>
Tested-by: Clare Hetherington <clare@instructure.com>
Misc remaining icon replacement

This commit contains the following tidy-up work:

- Replaced down-arrow background image in main dropdowns (Courses and Assignments dropdowns)

- Icon replacement for some pages views I missed

- Icon replacement for user profile contact methods (email, SMS)

- Replaced mail icon in student activity report view

- Replaced small calendar icon in courses right-hand menu

- Updated Rails helper to replace button images in Course > People right column

Change-Id: I90feb1160c61d60a72bb9c0fa8747bf9e134bc3a
Reviewed-on: https://gerrit.instructure.com/15730
Reviewed-by: Ryan Shaw <ryan@instructure.com>
Tested-by: Jenkins <jenkins@instructure.com>
QA-Review: Clare Hetherington <clare@instructure.com>