fix cross-shard role override lookups

fixes CNVS-3360

test plan:
 * add a user as a site admin, in a role other than AccountAdmin,
   with all permissions in that role
 * attempt to masquerade as an AccountAdmin in an account on a
   different shard
 * it should work

Change-Id: I7f5ab35eb4b79b49a9d373b73cadd5b5f515186e
fix user detail view errors

fixes #CNVS-3432

stack traces were coming up in production with
the error "must be a root account".
granting the manage_logins permission on the
user model involved checking all user accounts
for subset permissions by loading up and then
examining all account users in every one of
a user's accounts, something that raises
an error in the account.rb model unless the accout
being examined is a root account.  This
fix changes that permission check to only
examine root accounts, and also provides a
backup edge-case handler in
#has_subset_of_Account_permissions? which
just returns false if the account being examined
is not a root account.

TEST PLAN:

1) login as a local admin

2) go to the detail page for a user
within the context of an account, in particular
one where the user being examined is affiliated
with at least one non-root account:
example (https://wharton.instructure.com/accounts/81471/users/1189725)

3) you should not get any internal server errors,
and should be able to view the user's details.

Change-Id: I3a3995581bcc9bc7eb4074ea3f1ddeb66c598344
Reviewed-on: https://gerrit.instructure.com/17249
Reviewed-by: Cody Cutrer <cody@instructure.com>
Tested-by: Jenkins <jenkins@instructure.com>
QA-Review: Clare Hetherington <clare@instructure.com>
stop google docs endless authorization loop.

fixes CNVS-3413

when submitting an assignment with a google doc, user
was previously presented with an endless authorization
loop; google docs list was never displayed. this commit
restores proper behavior.

test plan:
  * create an assignment that allows online submissions;
  * as a student, attempt to submit the assignment as a
    google doc (if you have not already authorized google
    docs access, you will need to do that first);
  * verify that the student is presented with a list of
    their available google docs and not asked to
    re-authorize their google docs access.

Change-Id: Iba9ffda7e35a88aa67b856689680c894a44c4532
Reviewed-on: https://gerrit.instructure.com/17265
Reviewed-by: Brian Palmer <brianp@instructure.com>
Tested-by: Jenkins <jenkins@instructure.com>
QA-Review: Marc LeGendre <marc@instructure.com>
added null check for child events in processAppointmentData

fixes #CNVS-3387. The CommonEventFactory was returning null
for some child events because it couldn't find the proper
context for them. This might be a legitimate filter, although
the api probably shouldn't be returning them. Either way, it
makes sense to put a null check on the results of the factory
since we do this elsewhere as well.

Test Plan:
 - Check for scheduler regressions

Change-Id: Idca8942ac5e138107248cda9c4dd04452823239e
Reviewed-on: https://gerrit.instructure.com/17290
Tested-by: Jenkins <jenkins@instructure.com>
Reviewed-by: Zach Pendleton <zachp@instructure.com>
QA-Review: Marc LeGendre <marc@instructure.com>
shard Course#section_visibilities_for.

fixes CNVS-3375, CNVS-3426, CNVS-3436

previously, a user with enrollments in two shards could not
access some pages (e.g. conversations and profiles) because
they attempted to load enrollments across both shards. this
commit fixes the issue by changing to the appropriate shard
while querying enrollments.

test plan:
  * create a user with courses in multiple shards;
  * visit the conversations and profile pages and verify
    that they display as expected and no error message
    is displayed.

Change-Id: Iee98e2f19b1c454557d36c30d87eea9751f4557f
Reviewed-on: https://gerrit.instructure.com/17258
Tested-by: Jenkins <jenkins@instructure.com>
Reviewed-by: Jacob Fugal <jacob@instructure.com>
QA-Review: Marc LeGendre <marc@instructure.com>
fix quiz xss in multiple fill in the blank questions

fixes CNVS-3543

Test plan:
  * make a quiz with a "mutliple fill in the blanks" question
  * take the quiz and fill in one of the blanks with:
      blah'><script>alert('uh...')</script><a href='
  * submit the quiz and reload the page
  * make sure an alert box doesn't pop up

Change-Id: Ife0f4e4a78b73434adf37d654eb6dc8862ae2945
Reviewed-on: https://gerrit.instructure.com/17368
Tested-by: Jenkins <jenkins@instructure.com>
Reviewed-by: Jeremy Stanley <jeremy@instructure.com>
Reviewed-by: Simon Williams <simon@instructure.com>
QA-Review: Amber Taniuchi <amber@instructure.com>
Reviewed-by: Brian Palmer <brianp@instructure.com>
1.9: fix our multipart form building to work with StringIO objects again

In 1.8 StringIO#path returns nil, but in 1.9 the method doesn't exist,
so building multipart forms was failing.

lib/multipart.rb could use some larger refactoring but I'm limiting the
scope of this change since it's getting race tracked.

fixes CNVS-3562

test plan: With an environment running ruby 1.9, do a course copy with a
course that includes at least 1 video. The copy should succeed and the
video should work in the new course, as expected.

Change-Id: Ib8a9f1559c639831977f0118874735891b98d02f
Reviewed-on: https://gerrit.instructure.com/17407
Reviewed-by: Bracken Mosbacker <bracken@instructure.com>
Tested-by: Jenkins <jenkins@instructure.com>
QA-Review: Clare Hetherington <clare@instructure.com>
fix merge_candidates to search the correct shard

refs CNVS-3559

test plan:
 * create a user on the default shard (and confirm the e-mail address)
 * on another shard, invite that same e-mail address to a course
 * it should *not* show the user from the default shard

Change-Id: I897c55f8eaac832cbf655e0348189db4dc7a0a5e
Reviewed-on: https://gerrit.instructure.com/17414
Tested-by: Jenkins <jenkins@instructure.com>
QA-Review: Clare Hetherington <clare@instructure.com>
Reviewed-by: Brian Palmer <brianp@instructure.com>
don't check :view_statistics permission in js_env

Calling user_url ends up checking this permission, and
checking this particular permission is very expensive -- it involves
loading every course the user has ever been in, looking at Role
Overrides, etc. So doing it on every page is ouchy.

refs CNVS-3669 , which discusses the larger issue with this set_policy
block.

test plan: No visible change in behavior. When loading a course page,
there shouldn't be a series of queries loading and then processing every
one of your course enrollments.

Change-Id: Ic0afec59ab6ce37b82870025ecc520e68b0421fa
Reviewed-on: https://gerrit.instructure.com/17492
QA-Review: Brian Palmer <brianp@instructure.com>
Tested-by: Jenkins <jenkins@instructure.com>
Reviewed-by: Jacob Fugal <jacob@instructure.com>
handle wimba conference date parsing in ruby18/ruby19.

fixes CNVS-3556

wimba passes dates as MM/DD/YYYY, but ruby 1.9 expects date
strings given to `parse` to be in DD/MM/YYYY format. this
commit specifies a date format to avoid this issue and
remain compatible with both 1.8 and 1.9 servers.

test plan:
  * create a wimba conference;
  * visit its archive;
  * verify that canvas redirects to wimba and does not
    throw a 500 error.

Change-Id: Ic822a01f950b2465a5328a0b80b8b11c3e63c99d
Reviewed-on: https://gerrit.instructure.com/17507
Tested-by: Jenkins <jenkins@instructure.com>
Reviewed-by: Mark Ericksen <marke@instructure.com>
QA-Review: Marc LeGendre <marc@instructure.com>
upgrade rails to 2.3.16

The html_escape changes were backported from rails 3 in 2.3.16, so I've
removed our modified version.

Change-Id: I0067b9d84e49459dd7d46ba53a1d597d2e0efb67
Reviewed-on: https://gerrit.instructure.com/17379
Tested-by: Jenkins <jenkins@instructure.com>
Reviewed-by: Cody Cutrer <cody@instructure.com>
Reviewed-by: Cameron Matheson <cameron@instructure.com>
QA-Review: Clare Hetherington <clare@instructure.com>
bump rails gem and json gem

to address: CVE-2013-0276 CVE-2013-0277 CVE-2013-0269

fixes CNVS-3779

Change-Id: I758b21251101170869c24d2f535318f6756c2d3c
Reviewed-on: https://gerrit.instructure.com/17611
Reviewed-by: Jacob Fugal <jacob@instructure.com>
Reviewed-by: Paul Hinze <paulh@instructure.com>
Reviewed-by: Zach Wily <zach@instructure.com>
Tested-by: Brian Palmer <brianp@instructure.com>
QA-Review: Brian Palmer <brianp@instructure.com>
don't escape the quotes around 'display:none;'

fixes #CNVS-3711

test plan:
 - go to a course settings page
 - you should not see the contents of the Reset Course Content
   dialog underneath the Reset Course Content button
   (see screenshot attached to ticket)

Change-Id: I98c3f0d833f3e2dc7d0be1c86ddb62ea44b291db
Reviewed-on: https://gerrit.instructure.com/17542
Reviewed-by: Brian Palmer <brianp@instructure.com>
Tested-by: Jenkins <jenkins@instructure.com>
QA-Review: Adam Phillipps <adam@instructure.com>
treesame commit of origin/stable/2013-01-26

Treesame-Commit-Id: 851adb150b6550ad439b35d0b1d9afd16dc28c3e