redirect to referrer after unauthorized post/put

fixes CNVS-5248

test plan:
- start taking a one-question-at-a-time quiz
- log out in another tab
- hit the next or previous button
- re-login
- you should land back in the quiz

Change-Id: I578d6803bd6deb90ec3c82153d999b478e42a199
Reviewed-on: https://gerrit.instructure.com/19539
Tested-by: Jenkins <jenkins@instructure.com>
QA-Review: Myller de Araujo <myller@instructure.com>
Reviewed-by: Simon Williams <simon@instructure.com>
Product-Review: Simon Williams <simon@instructure.com>
include attribute to exclude permissions based on plugins

specifically links the visibility of the permission
:manage_frozen_assignments to whether or not
the plugin :assignment_freezer is enabled

test plan:
* enable the assignment_freezer plugin
* confirm that ""Manage (edit / delete) frozen assignments"
 is shown in the list of account permissions

* disable the plugin
* confirm that the permission no longer is shown

closes #CNVS-5207

Change-Id: I4cd308531a057356bd335e134348c63b92868775
Reviewed-on: https://gerrit.instructure.com/19788
Tested-by: Jenkins <jenkins@instructure.com>
Reviewed-by: Bracken Mosbacker <bracken@instructure.com>
Product-Review: Bracken Mosbacker <bracken@instructure.com>
QA-Review: Adam Phillipps <adam@instructure.com>
don't include "DESC" in the select when ordering by sortable name

fixes CNVS-5432

Change-Id: I461ddc459976726586797d6ec705a0d97d95fc17
Reviewed-on: https://gerrit.instructure.com/19856
Reviewed-by: Jacob Fugal <jacob@instructure.com>
Tested-by: Jenkins <jenkins@instructure.com>
Product-Review: Cody Cutrer <cody@instructure.com>
QA-Review: Cody Cutrer <cody@instructure.com>
make submission_versions index unique on postgres

Change-Id: I2b574793b2a4ecdc9d4d2859f8d8459c2598bd6e
Reviewed-on: https://gerrit.instructure.com/19881
Reviewed-by: Jacob Fugal <jacob@instructure.com>
Tested-by: Jenkins <jenkins@instructure.com>
Reviewed-by: Cody Cutrer <cody@instructure.com>
Product-Review: Duane Johnson <duane@instructure.com>
QA-Review: Duane Johnson <duane@instructure.com>
remove breadcrumbs from error page

Also refactors some parts of the rescue action

Test Plan:
- as a visitor who is not logged in, go to a page such as
  /users/2/files/thisoneisfake and it should not show user 2's
  name in the breadcrumb

Fixes CNVS-5393

Change-Id: I3e8e6ba13b53645b4a6e624a0cb691db9d840f69
Reviewed-on: https://gerrit.instructure.com/19835
Reviewed-by: Jacob Fugal <jacob@instructure.com>
QA-Review: Clare Strong <clare@instructure.com>
Tested-by: Jenkins <jenkins@instructure.com>
Product-Review: Duane Johnson <duane@instructure.com>
indices for learning outcome groups

Change-Id: I3e364e7b006c5daa42021a88876bc90c7278f076
Reviewed-on: https://gerrit.instructure.com/19884
Tested-by: Jenkins <jenkins@instructure.com>
Reviewed-by: Brian Palmer <brianp@instructure.com>
Product-Review: Cody Cutrer <cody@instructure.com>
QA-Review: Cody Cutrer <cody@instructure.com>
spec: add a rake task to execute migration_lint

this will allow it the script to be easily chained with other test
related rake tests

test-plan:
* modify a migration to have syntax that will migration_lint
* execute 'bundle exec rake db:migration_lint', should return an error
* revert migration change
* execute 'bundle exec rake db:migration_lint', should not return an
* error

Change-Id: I5b0dc9d27759662141e11bf1f42cdf376b67ad96
Reviewed-on: https://gerrit.instructure.com/19885
Tested-by: Jenkins <jenkins@instructure.com>
Reviewed-by: Jake Sorce <jake@instructure.com>
Product-Review: Jake Sorce <jake@instructure.com>
QA-Review: Jake Sorce <jake@instructure.com>
visual indicators for answered quiz questions

FIXES CNVS-4942

The problem statement for this ticket was that
answered questions could only be seen as
answered in the right column because of the
color change, which is insufficient for
accessibility.

This patch uses icons to differentiate between
answered and unanswered questions.

TEST PLAN:

1) login as a student to a course where you
have a quiz to take

2) while taking the quiz, look at the right
column

3) the icon for questions you've already answered
should be a checkmark

Change-Id: I5ec289acda00aa9e14ef49e387c8756883424c0a
Reviewed-on: https://gerrit.instructure.com/19456
Tested-by: Jenkins <jenkins@instructure.com>
Reviewed-by: Brian Palmer <brianp@instructure.com>
QA-Review: Clare Strong <clare@instructure.com>
Product-Review: Dana Morley <dana@instructure.com>
remove import and external_feed_id from calendar_events.

removed unused code to import an ical feed into a calendar,
and dropped the external_feed_id from the calendar_events
table because it isn't being used.

Change-Id: I9c093f4f2f63cc503d74bfc1cde089bf24ea0d73
Reviewed-on: https://gerrit.instructure.com/19615
Tested-by: Jenkins <jenkins@instructure.com>
Reviewed-by: Eric Berry <ericb@instructure.com>
QA-Review: Zach Pendleton <zachp@instructure.com>
Product-Review: Marc LeGendre <marc@instructure.com>
QA-Review: Marc LeGendre <marc@instructure.com>
optionally disable grade distributions in courses with many submissions

Change-Id: I0c02f58ff66d6ef647fd0f1a708b50c5b4ed123f
Reviewed-on: https://gerrit.instructure.com/19921
Tested-by: Jenkins <jenkins@instructure.com>
Reviewed-by: Brian Palmer <brianp@instructure.com>
Product-Review: Brian Palmer <brianp@instructure.com>
QA-Review: Brian Palmer <brianp@instructure.com>
don't use password from database.yml when overriding db user

Change-Id: I145546607c56ccca69519b27340c3b164634d8b7
Reviewed-on: https://gerrit.instructure.com/19899
Reviewed-by: Jacob Fugal <jacob@instructure.com>
Tested-by: Jenkins <jenkins@instructure.com>
Product-Review: Cody Cutrer <cody@instructure.com>
QA-Review: Cody Cutrer <cody@instructure.com>
quiz item analysis generation, closes CNVS-3421

report generator to do quiz item analysis

usage:

quiz = Quiz.find(<id>)
summary = QuizStatistics::ItemAnalysis::Summary.new(quiz)
summary.each do |item|
  puts item.question_text
  puts "respondents: #{item.num_respondents}"
  puts "correct: #{item.num_respondents(:correct)}"
  puts "standard deviation: #{item.standard_deviation}"
  ...
  puts "----------------"
end

test plan:
N/A, see specs

Change-Id: Id36e4ef404af089f526cf9243a14d42eb52064a6
Reviewed-on: https://gerrit.instructure.com/18494
Tested-by: Jenkins <jenkins@instructure.com>
Reviewed-by: Joe Tanner <joe@instructure.com>
Product-Review: Jon Jensen <jon@instructure.com>
QA-Review: Jon Jensen <jon@instructure.com>
fix no_enrollments_can_create_courses flag

fixes CNVS-5462

test plan:
- enable 'no enrollments can create courses' at the root acount level
- create a new user with no enrollments
- they should have a 'create course' button on the dashboard

Change-Id: Ic1c272c7e949b25365141c04c65b3cff5b47a6ed
Reviewed-on: https://gerrit.instructure.com/19944
Reviewed-by: Cody Cutrer <cody@instructure.com>
Tested-by: Jenkins <jenkins@instructure.com>
Product-Review: Bryan Madsen <bryan@instructure.com>
QA-Review: Bryan Madsen <bryan@instructure.com>
increase the parsing timeout in ruby i18n generation

also give the source filename

Change-Id: I7e2dd093968093108f808a00be1004a3e158a475
Reviewed-on: https://gerrit.instructure.com/19948
Reviewed-by: Jon Jensen <jon@instructure.com>
Tested-by: Jenkins <jenkins@instructure.com>
Product-Review: Brian Palmer <brianp@instructure.com>
QA-Review: Brian Palmer <brianp@instructure.com>
disallow html in translations, fixes CNVS-5413

make i18n:check reject anything that looks html-y, since we should be
using wrappers (or markdown) instead

test plan:
1. generate the following emails and confirm that the html version is ok:
   * content_export_failed
   * content_export_finished
   * merge_email_communication_channel
   * migration_export_ready
   * migration_import_failed
   * new_context_group_membership
2. go to the quiz detail page as a student and confirm it loads/looks
   correct (specifically where it says the number of questions below the
   title)

Change-Id: I0b8bfb0628a081859915c33764bfc3ce49690e8d
Reviewed-on: https://gerrit.instructure.com/19823
Reviewed-by: Jon Jensen <jon@instructure.com>
Tested-by: Jenkins <jenkins@instructure.com>
QA-Review: Cam Theriault <cam@instructure.com>
Product-Review: Jon Jensen <jon@instructure.com>
use RailsXss::Erubis for html email templates, fixes CNVS-5414

prevent malicious or accidental html content from getting through (e.g.
via translations or interpolated user content).

slight refactor in message.rb to make it more easily testable

test plan:
1. spot check html emails, make sure they look ok
2. ensure you can't get arbitrary html into an email, e.g.
   1. change your name in canvas to "<b>ZOMG</b>"
   2. send someone a message in canvasations
   3. check the html email that got sent to them. your name should appear
      as "<b>ZOMG</b>", and not "ZOMG" in bold text

Change-Id: Ie638a0d3d28427f25c0fa1ce89c10533802b0c6b
Reviewed-on: https://gerrit.instructure.com/19827
Reviewed-by: Jon Jensen <jon@instructure.com>
Product-Review: Jon Jensen <jon@instructure.com>
QA-Review: Jon Jensen <jon@instructure.com>
Tested-by: Jenkins <jenkins@instructure.com>
fix dissociated discussion topics.

fixes CNVS-5339

a previous datafix dissociated some discussion topics from
their related assignments; this fix restores the
assignment_id for those discussions.

test plan:
  * run specs

Change-Id: I5deaea1b4969588b2bcc12e62de063c6e47a48f8
Reviewed-on: https://gerrit.instructure.com/19671
Reviewed-by: Bracken Mosbacker <bracken@instructure.com>
Tested-by: Jenkins <jenkins@instructure.com>
Product-Review: Zach Pendleton <zachp@instructure.com>
QA-Review: Zach Pendleton <zachp@instructure.com>
fix i18n extraction scoping bug, fixes CNVS-5451

ensure that we infer absolute keys for I18n.t calls, regardless of the
current file's scope

test plan:
1. run rake i18n:generate
2. open config/locales/generated/en.yml
3. search for "was added to the conversation"
4. its scope should be en.conversation_message.users_added.one, rather
   than en.conversation_message.conversation_message.users_added.one

Change-Id: Ie35828738dbf09fb928f49d4635701d8f1c10ade
Reviewed-on: https://gerrit.instructure.com/19893
Reviewed-by: Joe Tanner <joe@instructure.com>
Tested-by: Jenkins <jenkins@instructure.com>
QA-Review: Cam Theriault <cam@instructure.com>
Product-Review: Jon Jensen <jon@instructure.com>
fix encoding issue breaking rake css:generate on linux

fixes CNVS-5442

Testing Notes:
===============
* On Ubuntu 12.04, running "rake css:generate" should
  complete without errors.

Change-Id: I99b0c977e92637adac6924759dfa01a3904e7271
Reviewed-on: https://gerrit.instructure.com/19879
Tested-by: Jenkins <jenkins@instructure.com>
QA-Review: Marc LeGendre <marc@instructure.com>
Product-Review: Marc LeGendre <marc@instructure.com>
Reviewed-by: Ryan Florence <ryanf@instructure.com>
keep play overlay on media comment thumbnails

test plan:
* create a media comment, either uploading a file
or recording a video
* the video thumbnail should show the "play" symbol
overlayed on top right away, and not just when
hovering over it

fixes #CNVS-5246

Change-Id: Iab5e4fd7cc048596d6d443341e9164ab0e588097
Reviewed-on: https://gerrit.instructure.com/19947
Reviewed-by: Bracken Mosbacker <bracken@instructure.com>
Tested-by: Jenkins <jenkins@instructure.com>
QA-Review: Adam Phillipps <adam@instructure.com>
Product-Review: Matt Goodwin <mattg@instructure.com>