set cache  headers for files

fixes #PS-73

test plan:

1. create a page that embeds a text file and a images

2. make sure that the page displays correctly

3. make sure you can  download the image from files

Change-Id: I2c4d7515d91b7c3aec1b01a41ceb6072bed33d6c
Reviewed-on: https://gerrit.instructure.com/16179
Tested-by: Jenkins <jenkins@instructure.com>
QA-Review: Adam Phillipps <adam@instructure.com>
Reviewed-by: Jeremy Stanley <jeremy@instructure.com>
don't ignore muted assignments in gradebook csv

closes #CNVS-2397

Test plan:
  - set up a course with assignments
  - mute some assignments
  - set grades for students
  - make sure the gradebook csv totals and the gradebooks match
  - the student's grade page (when masquerading) should *not* match
    (it should ignore muted assignments)

Change-Id: Iebe15c5d108dcfa899bd501cc6dd45ceb688fa25
Reviewed-on: https://gerrit.instructure.com/16197
Reviewed-by: Simon Williams <simon@instructure.com>
QA-Review: Simon Williams <simon@instructure.com>
Tested-by: Simon Williams <simon@instructure.com>
spec: fix accidental reuse of date constant

Change-Id: I957ef4114b63b7a95839fdc2d19a6771fda6fdac
Reviewed-on: https://gerrit.instructure.com/16349
Tested-by: Jenkins <jenkins@instructure.com>
Reviewed-by: Jacob Fugal <jacob@instructure.com>
QA-Review: Simon Williams <simon@instructure.com>
cache submission lateness

fixes #CNVS-1295

* Adds a new 'late' field to submissions
* Adds compute_lateness method to submissions which
  is called on every save when the 'late' field is nil
  or when the submission time changes
* Adds after_save callbacks to Assignment and
  AssignmentOverride to recompute lateness on submissions
  in a background process
* Includes data migration for initializing the value of the
  new cache field

Change-Id: I68d47fdbcbb167bef8428b6ecd48bf6f66ef8cb7
Reviewed-on: https://gerrit.instructure.com/16086
QA-Review: Amber Taniuchi <amber@instructure.com>
Tested-by: Jenkins <jenkins@instructure.com>
Reviewed-by: Simon Williams <simon@instructure.com>
add custom role support to course users tab

You can add enrollments with the custom roles and see who
has the roles.

Test Plan:
 * Create custom roles for each enrollment type
 * Test all the settings page's functionality like adding/deleting users with custom roles
 * Make custom observers observe students in various combinations of custom roliness
   - verify that the new observer role has the custom role
 * Make sure the section limited check box shows up for custom tas/teachers by selecting those options in the new user select box

closes #cnvs-1166

Change-Id: I5f133bf1b5b1438d7f8e34297b450ff561d401d0
Reviewed-on: https://gerrit.instructure.com/16272
Tested-by: Jenkins <jenkins@instructure.com>
Reviewed-by: Jeremy Stanley <jeremy@instructure.com>
QA-Review: Jeremy Stanley <jeremy@instructure.com>
remove openobject from UsersController

Removes OpenObject in favor of a struct to gain performance.

test plan:
  - specs should pass.

Change-Id: I0be2319533e2c2cd6ce1fa5dbf044ccb5368c299
Reviewed-on: https://gerrit.instructure.com/16049
Tested-by: Jenkins <jenkins@instructure.com>
Reviewed-by: Brian Palmer <brianp@instructure.com>
QA-Review: Simon Williams <simon@instructure.com>
remove openobject in content_zipper

OpenObject has been replaced by a struct in order to gain performance.

test plan:
  - create an eportfolio
  - download a zip of the eportfolio
  - make sure the extracted zip contents are correct

Change-Id: Ibe8cbbacd154ba4cbc3a09180beb73e214cb8549
Reviewed-on: https://gerrit.instructure.com/16050
Tested-by: Jenkins <jenkins@instructure.com>
Reviewed-by: Brian Palmer <brianp@instructure.com>
QA-Review: Simon Williams <simon@instructure.com>
change incoming message processor to prevent mail loops

It looks like we were responding to emails sent by automatic
responders, causing an infinite email loop and flooding
inboxes. Some easy changes to prevent this:

1) If we can't find the original message, then ignore the
incoming message because we don't know what it is and shouldn't
just blindly respond to every incoming message that happens to
match our regex.

2) If the original message wasn't sent because of a
notification, then it's probably a bounce message (or otherwise
unimportant) and we shouldn't respond to the incoming message.

3) Check the incoming message for headers that are commonly
applied to computer generated messages. If we find something to
indicate that the email is an auto-response, don't respond to
it.

fixes #CNVS-2289

test plan:

make sure we don't respond to our own bounce emails:
 - Set a student's calendar notifications to ASAP
 - As a teacher, create a new calendar event for the course
 - View the student's /messages and reply to the calendar
 notification
 - Refresh the page and you should see a bounce message
 - Reply to the bounce message and refresh the page
 - You should not see a new bounce message

make sure legitimate replies are still working:
 - Set a student's discussion topic notifications to ASAP
 - As a teacher, create a new discussion topic in the course
 - Go to the student's /messages and reply to the discussion
 notification
 - The reply should be posted to the discussion

Change-Id: I55d23380f2a20df745e66c06994478ab3694d1bb
Reviewed-on: https://gerrit.instructure.com/16283
Tested-by: Jenkins <jenkins@instructure.com>
Reviewed-by: Joel Hough <joel@instructure.com>
QA-Review: Marc LeGendre <marc@instructure.com>
Reviewed-by: Zach Pendleton <zachp@instructure.com>
spec: use variables instead of constants where possible

Change-Id: I80ce98793bb86d214489f4a944644ffe847a4cf4
Reviewed-on: https://gerrit.instructure.com/16353
Tested-by: Jenkins <jenkins@instructure.com>
QA-Review: Shawn Meredith <shawn@instructure.com>
Reviewed-by: Shawn Meredith <shawn@instructure.com>
use due dates from assignment overrides on student grades page

test plan:

* override the due_at column using assignment overrides
 either for sections, groups, or a specific student
* view the student's grade page and confirm that
 the new due date is used

closes #CNVS-444

Change-Id: Id4f4c1a05ab7129a29909b4142ffc25b056a2be4
Reviewed-on: https://gerrit.instructure.com/16167
Tested-by: Jenkins <jenkins@instructure.com>
Reviewed-by: Jeremy Stanley <jeremy@instructure.com>
QA-Review: Jeremy Stanley <jeremy@instructure.com>
collapse / expand discussion entries

also:

- counts in side-comment "show all [n] replies"
  are now accurate
- moved lock/unlock into the cog menu
- moved the cog menu into the toolbar

test plan:
1. go to a discussion
2. click "collapse" in the toolbar
   - the root entries should collapse
   - the page should scroll to the entries
3. expand a single reply
   - the reply's replies should NOT be collapsed
4. click a page number
   - the newly rendered entries should be
     collapsed
5. click expand
   - all the root entries should expand
6. click a page link
   - all the entries should be expanded
7. lock and unlock should still work
8. Go to a side comment discussion
   - "show all [n] replies" should have an
     accurate count

Change-Id: Ia06fad173344c549d31b7cd51d4ecc57d2e40d5f
Reviewed-on: https://gerrit.instructure.com/15834
Tested-by: Jenkins <jenkins@instructure.com>
Reviewed-by: Jon Jensen <jon@instructure.com>
QA-Review: Cam Theriault <cam@instructure.com>
fix broken controller test when js_env is already set

Change-Id: Ib75e0bed0a0bf857c6d76b4733c57bbd9739836d
Reviewed-on: https://gerrit.instructure.com/16382
Reviewed-by: Bracken Mosbacker <bracken@instructure.com>
QA-Review: Bracken Mosbacker <bracken@instructure.com>
Tested-by: Jenkins <jenkins@instructure.com>
redirect to discovery page for unauthenticated deep links

refs #CNVS-2174

found the bit in the authorization sequence where
saml login was being initiated without checking
for a discovery url.  Fixed that, and also wrote
some unit tests around it.

ended up having to alter specs a bit to deal
with the extensions added by the
canvas_zendesk_plugin

TEST PLAN:
1) select an account that is authenticated with SAML
2) without logging in, attempt to hit a 'deep
  link' on that domain with the browser (any url
  that isn't the login page would be fine, as long
  as it's something you must be logged in to access)
3) you should be redirected to the SAML discovery page

Change-Id: Id9c21650d8c053178d4d40ff064051af79c5eb2f
Reviewed-on: https://gerrit.instructure.com/16355
Tested-by: Jenkins <jenkins@instructure.com>
Reviewed-by: Ethan Vizitei <ethan@12spokes.com>
Reviewed-by: Brian Palmer <brianp@instructure.com>
QA-Review: Clare Hetherington <clare@instructure.com>
Added Arabic, Mandarin, French, Spanish, Russian translations.

5 languages completed and downloaded from Transifex Dec. 26, 2012

Fixed a spec that used Russian counts for testing.

Test Plan:
  1. Log in as a user with each of these locales
  2. See if translations show up for the new locales
     ("ar" = Arabic, "zh" = Mandarin Chines)
  3. Check that existing locales have more translation coverage
     ("es" = Spanish, "fr" = French, "ru" = Russian)

Closes #CNVS-1187

Change-Id: I09245c9413e065c0c937838bb632327f749c13a6
Reviewed-on: https://gerrit.instructure.com/16371
Tested-by: Jenkins <jenkins@instructure.com>
Reviewed-by: Brian Palmer <brianp@instructure.com>
QA-Review: Brian Palmer <brianp@instructure.com>
look at role name when reusing enrollments; fixes #CNVS-2431

test plan:
 * enroll a user as a plain Student
 * enroll the same user in a custom student role
 * the plain Student enrollment should not disappear

Change-Id: I7f7a1ce96a1a5f971a7226756d25b063d6f88a87
Reviewed-on: https://gerrit.instructure.com/16363
Reviewed-by: Bracken Mosbacker <bracken@instructure.com>
Tested-by: Jenkins <jenkins@instructure.com>
QA-Review: Adam Phillipps <adam@instructure.com>
setting to handle hair trigger in parallel

Change-Id: I1249f6811ea7c936ac91ea8d99d8b9e0c861992f
Reviewed-on: https://gerrit.instructure.com/16403
Reviewed-by: Jon Jensen <jon@instructure.com>
Tested-by: Jenkins <jenkins@instructure.com>
QA-Review: Jake Sorce <jake@instructure.com>
Permit new HTML5 elements figure and figcaption

Allows the new HTML5 elements figure and figcaption to bypass scrubbing by the user input sanitizer.

The HTML5lib sanitizer allows these elements
http://code.google.com/p/html5lib/source/browse/python3/html5lib/sanitizer.py

Specification for figure
http://dev.w3.org/html5/markup/figure.html

Specification for figcaption
http://dev.w3.org/html5/markup/figcaption.html
Merge remote-tracking branch 'devlin/html5-sanitize'
fixed Mandarin Chinese translation file

Many of the 'count' keys were missing in the translation file, e.g.

  other: |-
    1 个活动注册
    %{count} 个活动注册

Needs to be:
  one: "1 个活动注册"
  other: "%{count} 个活动注册"

Refs #CNVS-1187

Change-Id: Ied5c4e0219cb4082e5dbb7e0a34edaa4cdefd7da
Reviewed-on: https://gerrit.instructure.com/16408
Reviewed-by: Brian Palmer <brianp@instructure.com>
Tested-by: Jenkins <jenkins@instructure.com>
QA-Review: Duane Johnson <duane@instructure.com>
Add Mandarin Chinese and Arabic to locales.yml file.

Depends on https://gerrit.instructure.com/#/c/16371/

Refs #CNVS-1187

Change-Id: Ia7e45bc0ecad2bb1a3d1492fdfa90f4a92202127
Reviewed-on: https://gerrit.instructure.com/16399
Reviewed-by: Brian Palmer <brianp@instructure.com>
Tested-by: Jenkins <jenkins@instructure.com>
QA-Review: Duane Johnson <duane@instructure.com>