Revert "switch from rails_xss plugin to gem"

this reverts commit c8a4c453ff79d29fb164cf9c03ebea0995c0113c.

while the gem *appears* recent, it hasn't merged upstream changes from
http://github.com/rails/rails_xss since before we vendored it, so we
can't make the switch after all.

instead, I've just silenced the rails3 warning and left a TODO marker.

Change-Id: I8957e676c38ef7cdeac0e6266f2cac3288b1ec7d
Reviewed-on: https://gerrit.instructure.com/26374
Reviewed-by: Brian Palmer <brianp@instructure.com>
Tested-by: Bryan Madsen <bryan@instructure.com>
Product-Review: Jacob Fugal <jacob@instructure.com>
QA-Review: Jacob Fugal <jacob@instructure.com>
spec: removal links and logout specs

Change-Id: I8d601d786b86dd7465c226ab7136f8374aea2648
Reviewed-on: https://gerrit.instructure.com/26258
Reviewed-by: Bryan Madsen <bryan@instructure.com>
Product-Review: Bryan Madsen <bryan@instructure.com>
QA-Review: Bryan Madsen <bryan@instructure.com>
Tested-by: Bryan Madsen <bryan@instructure.com>
only define FakeRails3Generators for rails2

refs CNVS-4704

Change-Id: If7966f4ca929420223fcbd64be31820792df9af5
Reviewed-on: https://gerrit.instructure.com/26330
Reviewed-by: Cody Cutrer <cody@instructure.com>
Tested-by: Jenkins <jenkins@instructure.com>
Product-Review: Jacob Fugal <jacob@instructure.com>
QA-Review: Jacob Fugal <jacob@instructure.com>
get rid of some rails3 boot warnings

refs CNVS-9166

* zip and pdf mimetypes are registered by default in rails3
* TZInfo patches for ruby version compat are only needed for rails2

Change-Id: I313fc79685c726e0126eaac7efce689854df4525
Reviewed-on: https://gerrit.instructure.com/26231
Reviewed-by: Cody Cutrer <cody@instructure.com>
Tested-by: Jenkins <jenkins@instructure.com>
Product-Review: Jacob Fugal <jacob@instructure.com>
QA-Review: Jacob Fugal <jacob@instructure.com>
fix fragile content_migration_specs

closes #CNVS-9558

Change-Id: I924965c3e170001a437f805099f5de7a6e153377
Reviewed-on: https://gerrit.instructure.com/26400
Tested-by: Jenkins <jenkins@instructure.com>
Reviewed-by: Jon Jensen <jon@instructure.com>
Product-Review: Bryan Madsen <bryan@instructure.com>
QA-Review: Bryan Madsen <bryan@instructure.com>
fix fragile permissions specs

also implement some pending specs

Change-Id: Ibb794c71b5c64ecb5c70df03be07aa162d4b89ae
Reviewed-on: https://gerrit.instructure.com/26443
Tested-by: Jenkins <jenkins@instructure.com>
Reviewed-by: Bracken Mosbacker <bracken@instructure.com>
Product-Review: Bracken Mosbacker <bracken@instructure.com>
QA-Review: Bracken Mosbacker <bracken@instructure.com>
bring in webct question answer files

test plan:
* import the course referenced in the ticket
* quiz question answers should not have broken
image links

fixes #CNVS-1556

Change-Id: I8c99cc0c7c6940738e75a2b0d661880281411c91
Reviewed-on: https://gerrit.instructure.com/26417
Reviewed-by: Bracken Mosbacker <bracken@instructure.com>
Product-Review: Bracken Mosbacker <bracken@instructure.com>
Tested-by: Jenkins <jenkins@instructure.com>
QA-Review: Nathan Rogowski <nathan@instructure.com>
fixup middleware for rails3

refs CNVS-4704

test-plan:
 - 2.3 rails still boots and works

Change-Id: I107637f3abf107ad652aec959567dd5d738229c0
Reviewed-on: https://gerrit.instructure.com/26335
Tested-by: Jenkins <jenkins@instructure.com>
Reviewed-by: Jacob Fugal <jacob@instructure.com>
Product-Review: Jacob Fugal <jacob@instructure.com>
QA-Review: Jacob Fugal <jacob@instructure.com>
enable subscript and superscript buttons for tinyMCE editor

fixes CNVS-9548
Test Plan
1) Navigate to page with a tinyMCE editor
   (e.g. http://localhost:3000/courses/1/wiki/front-page )
2) Ensure superscript and subscript buttons appear and are functional
3) Ensure buttons and functionality are in place after resizing browser
   to a different width and refreshing

Change-Id: Ifd79038837d626f8cf16aeebc784f04d481b8bc1
Reviewed-on: https://gerrit.instructure.com/26406
Tested-by: Jenkins <jenkins@instructure.com>
Product-Review: Marc LeGendre <marc@instructure.com>
QA-Review: Marc LeGendre <marc@instructure.com>
Reviewed-by: Jon Jensen <jon@instructure.com>
fix validation for assignment group edit dialog

don't include never_drop rules in dialog validation

fixes CNVS-9491

test-plan
=========
- enable draft state and navigate to the assignment index page
- add a number of assignments to an assignment group
- open the edit assignment group dialog
- add assignments as never drops
- verify that you can save the dialog

Change-Id: I355b28f1f8efe08e18cff618fb0b63f9a83b4a76
Reviewed-on: https://gerrit.instructure.com/26381
Reviewed-by: Simon Williams <simon@instructure.com>
Tested-by: Jenkins <jenkins@instructure.com>
QA-Review: Amber Taniuchi <amber@instructure.com>
Product-Review: Matthew Irish <mirish@instructure.com>
fix for empty create group dialog

fixes CNVS-9490

trigger render event on the collection so that we don't accidentally
re-render the entire IndexView

test plan
=========
with draft state enabled:
- navigate to the assignments index page and edit an assignment group
  from the gear menu
- click the button to add a new assignment group
- verify that the modal has a form in it and that a new assignment group
  can be added

Change-Id: I877dc6daddfcb4a2b6f67dfd862dc2cb5328bcc3
Reviewed-on: https://gerrit.instructure.com/26420
Reviewed-by: Simon Williams <simon@instructure.com>
Tested-by: Jenkins <jenkins@instructure.com>
QA-Review: Caleb Guanzon <cguanzon@instructure.com>
Product-Review: Matthew Irish <mirish@instructure.com>
spec: speed up some submission-related specs

refs CNVS-9183

submit_homework is expensive, so just create the bare objects in specs
that do it a lot ... egregious example is 34sec -> 5.5sec, for all these
specs it's 546sec -> 449sec

Change-Id: I08e68dcfead83361601dd2b9cb00fcdf0400005e
Reviewed-on: https://gerrit.instructure.com/26389
Tested-by: Jenkins <jenkins@instructure.com>
Reviewed-by: Landon Wilkins <lwilkins@instructure.com>
Product-Review: Jon Jensen <jon@instructure.com>
QA-Review: Jon Jensen <jon@instructure.com>
only use homebrew NilStore with rails2

refs CNVS-4704

we can use the built in :null_store with rails3

Change-Id: I0dc6c441da4f300fe8ee870b8c676c8e449d1830
Reviewed-on: https://gerrit.instructure.com/26332
Tested-by: Jenkins <jenkins@instructure.com>
Reviewed-by: Cody Cutrer <cody@instructure.com>
Product-Review: Jacob Fugal <jacob@instructure.com>
QA-Review: Jacob Fugal <jacob@instructure.com>
limit fake_arel caveats to rails2

refs CNVS-4704

fake_arel gets us most of the way to rails3's arel, but with some
caveats. the workarounds (mostly) work in both, but it'll be nice to not
have them crufting around when we're on rails3. so only use the
workarounds in CANVAS_RAILS2 branches.

Change-Id: Ia1f5cfa6b10f83cdb8d9a6e397b12401d180118d
Reviewed-on: https://gerrit.instructure.com/26331
Tested-by: Jenkins <jenkins@instructure.com>
Reviewed-by: Cody Cutrer <cody@instructure.com>
Product-Review: Jacob Fugal <jacob@instructure.com>
QA-Review: Jacob Fugal <jacob@instructure.com>
rails3 encrypted_cookie_store version

refs CNVS-8878

Change-Id: I93ba45fa04ad318201252f814a1184a4cdfd1d32
Reviewed-on: https://gerrit.instructure.com/26328
Tested-by: Jenkins <jenkins@instructure.com>
Reviewed-by: Cody Cutrer <cody@instructure.com>
Product-Review: Jacob Fugal <jacob@instructure.com>
QA-Review: Jacob Fugal <jacob@instructure.com>
only need backports from rails3 in rails2

refs CNVS-4704

when we're running rails3 they're already there

Change-Id: Id52601e358719c896008cd529e4ba1833739b287
Reviewed-on: https://gerrit.instructure.com/26333
Tested-by: Jenkins <jenkins@instructure.com>
Reviewed-by: Cody Cutrer <cody@instructure.com>
Product-Review: Jacob Fugal <jacob@instructure.com>
QA-Review: Jacob Fugal <jacob@instructure.com>
use Rails.configuration.session_store in rails3

refs CNVS-4704

instead of rails2's ActionController::Base.session_store

Change-Id: I59e3921efab4b63714ec891d4ffdfe25ae6ebd7c
Reviewed-on: https://gerrit.instructure.com/26334
Tested-by: Jenkins <jenkins@instructure.com>
Reviewed-by: Jacob Fugal <jacob@instructure.com>
Product-Review: Jacob Fugal <jacob@instructure.com>
QA-Review: Jacob Fugal <jacob@instructure.com>
spec add new helper for running account reports

this helper takes an options hash and can return a
report object instead of the parsed file
this will also read from the zip file instead of
reading from the hash generated by the report

test plan
- specs should pass

Change-Id: I200aa9d29ba95d6468dca8b192e9d7c415584517
Reviewed-on: https://gerrit.instructure.com/26192
Tested-by: Jenkins <jenkins@instructure.com>
Reviewed-by: Rob Orton <rob@instructure.com>
Product-Review: Rob Orton <rob@instructure.com>
QA-Review: Rob Orton <rob@instructure.com>
analytics showing submissions were submitted if teacher give a 0

fixes: CNVS-1601

Since submissions were not created for students who did not submit an
assignment the analytics were showing them as missing even if they were not due
yet. Regardless what the score was.  The fix changed the DueDateCacher to create
submissions for students with overridden due dates.  This will cache the due date
so analyitics can correctly calculate the graph data.  The analytics will search
for a submission,  if it finds one it will use the cached due date for
calculations,  if not it uses the assignments date due assuming there are not any
dates that are overridden.

Also reference g/23800.

Test Case:
  Setup: Create a Course with an assignment and an enrollment.

  - Without the student submitting the assignment. Grade the assignment for the
    student.
  - Open analytics for the course and the Assignments graph should not show any
    submissions for that assignment.
  - Create a due date override.
  - A submission should be created to cache the due date and the graph should
    not show any submissions for that assignment.

Change-Id: Icdae246d9c9913c8a163505d14b86f1300c809de
Reviewed-on: https://gerrit.instructure.com/25352
Tested-by: Jenkins <jenkins@instructure.com>
Reviewed-by: Nick Cloward <ncloward@instructure.com>
Reviewed-by: Jacob Fugal <jacob@instructure.com>
QA-Review: Jeremy Putnam <jeremyp@instructure.com>
Product-Review: Nick Cloward <ncloward@instructure.com>
feature flags ui

fixes CNVS-9006

test plan:

  as a site admin:
  * navigate to site admin settings page
    and click "feature options" tab;
  * verify that test account, course, and user features
    display;
  * navigate to another account's settings page and
    click "feature options" tab;
  * verify that account and course features display, and
    that hidden features are visible.

  as an account admin:
  * navigate to your account settings page and verify that,
    by default, no features are visible;
  * after enabling a feature as a site admin, verify that
    it becomes visible in the account features list and that
    you can successfully toggle it between on/allowed/off;
  * navigate to a sub-account and verify that features
    marked as on/off are not settable but instead read,
    "ENABLED" and "DISABLED."

  as a teacher:
  * navigate to your course settings page and verify that,
    by default, no features are visible;
  * after enabling a feature as an admin, verify that it
    appears in the course settings feature list and that
    you can toggle it on/off;
  * verify that if a feature is set to on or off at the
    account (instead of allow), you cannot set it at the
    course level but instead it reads "ENABLED" or
    "DISABLED."

  as any user:
  * navigate to your user settings page, scroll to the
    bottom of the page, and verify that no features are
    enabled;
  * after enabling a user-level feature as a site admin,
    verify that the user feature list now includes that
    feature and that you can toggle it on/off.

Change-Id: I1c226aa27247a06cbd8ebd23a045e09e6121f3c9
Reviewed-on: https://gerrit.instructure.com/26235
Tested-by: Jenkins <jenkins@instructure.com>
Reviewed-by: Zach Pendleton <zachp@instructure.com>
Product-Review: Zach Pendleton <zachp@instructure.com>
QA-Review: Matt Fairbourn <mfairbourn@instructure.com>