fix for root accounts without a custom turnitin pledge

fixes #CNVS-2608

test plan:
- create a course with turnitin on a root account
- make sure the account doesn't have a custom turnitin pledge
- as a student, submit a turnitin assignment
- it should work

Change-Id: Ic4f328ea4cc9e7d985fd15f3cb219f164a3048e1
Reviewed-on: https://gerrit.instructure.com/16629
Reviewed-by: Simon Williams <simon@instructure.com>
QA-Review: Simon Williams <simon@instructure.com>
Tested-by: Jenkins <jenkins@instructure.com>
Fix importing an outcome into a rubric

The points and description were not getting filled in properly, so were
lost when saving.

Fixes #CNVS-1272

test plan:
1. On account level create Outcome with custom description and values
2. Import Outcome into course
3. Create rubric in course
4. Add outcome as criterion in rubric
5. Verify the points and descriptions for the ratings are correct
6. Save the rubric, reload, verify they are still correct

Change-Id: Iba1313cae77be23a8ac588c9b40f54450ddeb291
Reviewed-on: https://gerrit.instructure.com/16644
Reviewed-by: Simon Williams <simon@instructure.com>
Tested-by: Jenkins <jenkins@instructure.com>
QA-Review: Brian Palmer <brianp@instructure.com>
use a shard-safe query for selecting question bank questions

refs #CNVS-2641

Change-Id: I85a60fdb7a862b1a095b40a892de2304446184e1
Reviewed-on: https://gerrit.instructure.com/16603
Tested-by: Jenkins <jenkins@instructure.com>
Reviewed-by: Brian Palmer <brianp@instructure.com>
QA-Review: Clare Hetherington <clare@instructure.com>
treesame commit of origin/stable/2013-01-05

Treesame-Commit-Id: 343c7b499f070cb2cfbe86f6ee974d8af65c3c93
fix HashAccessTokens migration

Avoid using the model, since the column may have already been added to
dropped_columns

Change-Id: I6d7eb623875572ebc3efe9c16e8f677d0fc61dc2
Reviewed-on: https://gerrit.instructure.com/16690
Reviewed-by: Cody Cutrer <cody@instructure.com>
QA-Review: Brian Palmer <brianp@instructure.com>
Tested-by: Brian Palmer <brianp@instructure.com>
Revert "validate authenticity token on quiz backup and submit"

This reverts commit 5ef87548a82b965ec51525bb81f24f4f955e842f.

people keep quizzes open in tabs for a long time, and since we don't handle
being logged out and back in in another tab well, we need to revert this for
now.

fixes #CNVS-2696

test plan:
- start a quiz in one tab
- in another tab, log out and back in
- submit the quiz in the original tab
- you should not get an authenticity token error

Change-Id: Id1be2425e95d679c78673e94324e411a109d26c7
Reviewed-on: https://gerrit.instructure.com/16677
Tested-by: Jenkins <jenkins@instructure.com>
Reviewed-by: Stanley Stuart <stanley+gerrit@instructure.com>
QA-Review: Myller de Araujo <myller@instructure.com>
fix facebook integration

facebook puts canvas in an iframe - we have to allow it to

test plan:
 * link your facebook account with canvas
 * go to canvas from facebook
 * it should not be blank

Change-Id: I1b5ecfbe121d2e519447daed9af5c86f52ffcc21
Reviewed-on: https://gerrit.instructure.com/16695
Reviewed-by: Cody Cutrer <cody@instructure.com>
QA-Review: Cody Cutrer <cody@instructure.com>
Tested-by: Jenkins <jenkins@instructure.com>
fix PopulateStreamItemAssociations data fixup

fixes gh-258

the dropped columns initializer was hiding the data from the migration,
so avoid using the model at all

Change-Id: I25fa901a36c17a30587725b482a74eff62da5094
Reviewed-on: https://gerrit.instructure.com/16658
Reviewed-by: Cody Cutrer <cody@instructure.com>
QA-Review: Cody Cutrer <cody@instructure.com>
Tested-by: Jenkins <jenkins@instructure.com>
stop writing to discussion topics in stream items.

fixes #CNVS-2591

while cleaning discussion topic data for stream items, the
original discussion topic was having its root entries
inadvertently deleted. this commit edits a cloned discussion
topic so that the original isn't written to.

test plan:
  * create a discussion topic with the "Users must post
    before seeing replies" option checked;
  * create at least one discussion entry for that topic;
  * create a stream item w/ the created discussion topic as
    its asset;
  * call `data` on the stream item with a viewing_user_id of
    a user in the course that has not posted on the
    discussion;
  * verify that the original discussion topic's root entries
    have not had their discussion_topic_ids set to nil.

Change-Id: I4cddaeaceb13aee5aaeae4209c1567148766c1e6
Reviewed-on: https://gerrit.instructure.com/16683
Tested-by: Jenkins <jenkins@instructure.com>
QA-Review: Marc LeGendre <marc@instructure.com>
Reviewed-by: Joel Hough <joel@instructure.com>
api: mark assignment override functionality as beta

test plan:
  - run bundle exec rake doc:api
  - visit the api documentation
  - Assignment Override API endpoints should be marked as beta.

Change-Id: I68937760f3326de3a450917a5bf899d3dc6ac6be
Reviewed-on: https://gerrit.instructure.com/16700
Reviewed-by: Brian Palmer <brianp@instructure.com>
QA-Review: Brian Palmer <brianp@instructure.com>
Tested-by: Brian Palmer <brianp@instructure.com>
this migration is non-transactional

Change-Id: Ia54bd05cc58ee95160b52dd27c918df2bba005eb
Reviewed-on: https://gerrit.instructure.com/16719
Reviewed-by: Brian Palmer <brianp@instructure.com>
Tested-by: Jenkins <jenkins@instructure.com>
QA-Review: Cody Cutrer <cody@instructure.com>
treesame commit of stable/2013-01-05

Treesame-Commit-Id: ea84cee75363aa2aaa337c9afb3e7f25d495e716
show all users not assigned to group in unassigned

fixes #CNVS-2619

test plan:
1. create an account level group
2. put somebody in the group
3. remove them from the group
4. refresh the page
   - the user should be in the unassigned area

if a user had previously belonged to a group, they
were no longer included in unassigned since the
query didn't check the workflow state

Change-Id: Iaca501c4fc35847759f56a925707618571943bf6
Reviewed-on: https://gerrit.instructure.com/16638
Reviewed-by: Jon Jensen <jon@instructure.com>
Tested-by: Jenkins <jenkins@instructure.com>
QA-Review: Ryan Florence <ryanf@instructure.com>
strip invalid utf-8 when loading serialized AR columns

In ruby 1.8, it was possible to get invalid utf-8 into the database in
these columns, since the database doesn't check serialized columns
encoding, and ruby 1.8 won't check the encoding either. So in ruby 1.9,
you'll get an error when you try to actually use the data for most
things. This work-around recursively checks the serialized column for
any strings containing invalid utf-8, and just strips it out.

Fixes #CNVS-2587

test plan: using ruby 1.8, insert some bad utf-8 data into a serialized
column. one vector for doing this is to put it in a quiz question. then
switch to ruby 1.9, and verify you can load up the quiz question, and
the bad data has been scrubbed out.

Change-Id: I3272e46dbe5e9b424998c3c7459ea6f5b6b363d4
Reviewed-on: https://gerrit.instructure.com/16619
QA-Review: Clare Hetherington <clare@instructure.com>
Reviewed-by: Brian Palmer <brianp@instructure.com>
Tested-by: Jenkins <jenkins@instructure.com>
don't try to sanitize params on already graded quiz

in order to sanitize params on a can't go back quiz, we need to compare them
with the params in submission_data, which doesn't work if the quiz is already
graded and submission_data has become an array.

fixes #CNVS-2795

test plan: i'm not positive how to reproduce this issue, because it requires
submitting an already submitted quiz.  maybe if you have a quiz open in two
different tabs and submit first in one and then in the other, it should
redirect you to the results page (although not change your answers)

Change-Id: I7a3cee402077343ab9de85a51ec33d02217c6754
Reviewed-on: https://gerrit.instructure.com/16736
Reviewed-by: Stanley Stuart <stanley+gerrit@instructure.com>
QA-Review: Stanley Stuart <stanley+gerrit@instructure.com>
Tested-by: Jenkins <jenkins@instructure.com>
QA-Review: Myller de Araujo <myller@instructure.com>
add allow_student_discussion_topics course setting

test plan:

1. log in as a student and go to:
   /courses/:id/discussion_topics/
   - the “start a discussion” button should work
2. open script/console
3. Find a course and change the setting, i.e.:
   c = Course.find(1)
   c.allow_student_discussion_topics = false
   c.save!
4. Log in as a student and go to:
   /courses/:id/discussion_topics/
   - The “start a discussion” button should not
     display

UI coming in a different commit

closes #CNVS-2613

Change-Id: I162b0356f1e23bee2bdb89f7797976bc3bab192d
Reviewed-on: https://gerrit.instructure.com/16674
Reviewed-by: Jon Jensen <jon@instructure.com>
Tested-by: Jenkins <jenkins@instructure.com>
QA-Review: Ryan Florence <ryanf@instructure.com>
apply rails patch for CVE-2013-0155

Change-Id: I730574603071ec4e72c525817282a78fcc4b9d3f
Reviewed-on: https://gerrit.instructure.com/16804
Reviewed-by: Stanley Stuart <stanley+gerrit@instructure.com>
QA-Review: Clare Hetherington <clare@instructure.com>
Tested-by: Jenkins <jenkins@instructure.com>
treesame commit of origin/stable/2013-01-05

Treesame-Commit-Id: 784d9bce6dd627364cf2a8156d64128ceb0fad67