show all users not assigned to group in unassigned

fixes #CNVS-2619

test plan:
1. create an account level group
2. put somebody in the group
3. remove them from the group
4. refresh the page
   - the user should be in the unassigned area

if a user had previously belonged to a group, they
were no longer included in unassigned since the
query didn't check the workflow state

Change-Id: Iaca501c4fc35847759f56a925707618571943bf6
Reviewed-on: https://gerrit.instructure.com/16638
Reviewed-by: Jon Jensen <jon@instructure.com>
Tested-by: Jenkins <jenkins@instructure.com>
QA-Review: Ryan Florence <ryanf@instructure.com>
strip invalid utf-8 when loading serialized AR columns

In ruby 1.8, it was possible to get invalid utf-8 into the database in
these columns, since the database doesn't check serialized columns
encoding, and ruby 1.8 won't check the encoding either. So in ruby 1.9,
you'll get an error when you try to actually use the data for most
things. This work-around recursively checks the serialized column for
any strings containing invalid utf-8, and just strips it out.

Fixes #CNVS-2587

test plan: using ruby 1.8, insert some bad utf-8 data into a serialized
column. one vector for doing this is to put it in a quiz question. then
switch to ruby 1.9, and verify you can load up the quiz question, and
the bad data has been scrubbed out.

Change-Id: I3272e46dbe5e9b424998c3c7459ea6f5b6b363d4
Reviewed-on: https://gerrit.instructure.com/16619
QA-Review: Clare Hetherington <clare@instructure.com>
Reviewed-by: Brian Palmer <brianp@instructure.com>
Tested-by: Jenkins <jenkins@instructure.com>
don't try to sanitize params on already graded quiz

in order to sanitize params on a can't go back quiz, we need to compare them
with the params in submission_data, which doesn't work if the quiz is already
graded and submission_data has become an array.

fixes #CNVS-2795

test plan: i'm not positive how to reproduce this issue, because it requires
submitting an already submitted quiz.  maybe if you have a quiz open in two
different tabs and submit first in one and then in the other, it should
redirect you to the results page (although not change your answers)

Change-Id: I7a3cee402077343ab9de85a51ec33d02217c6754
Reviewed-on: https://gerrit.instructure.com/16736
Reviewed-by: Stanley Stuart <stanley+gerrit@instructure.com>
QA-Review: Stanley Stuart <stanley+gerrit@instructure.com>
Tested-by: Jenkins <jenkins@instructure.com>
QA-Review: Myller de Araujo <myller@instructure.com>
add allow_student_discussion_topics course setting

test plan:

1. log in as a student and go to:
   /courses/:id/discussion_topics/
   - the “start a discussion” button should work
2. open script/console
3. Find a course and change the setting, i.e.:
   c = Course.find(1)
   c.allow_student_discussion_topics = false
   c.save!
4. Log in as a student and go to:
   /courses/:id/discussion_topics/
   - The “start a discussion” button should not
     display

UI coming in a different commit

closes #CNVS-2613

Change-Id: I162b0356f1e23bee2bdb89f7797976bc3bab192d
Reviewed-on: https://gerrit.instructure.com/16674
Reviewed-by: Jon Jensen <jon@instructure.com>
Tested-by: Jenkins <jenkins@instructure.com>
QA-Review: Ryan Florence <ryanf@instructure.com>
apply rails patch for CVE-2013-0155

Change-Id: I730574603071ec4e72c525817282a78fcc4b9d3f
Reviewed-on: https://gerrit.instructure.com/16804
Reviewed-by: Stanley Stuart <stanley+gerrit@instructure.com>
QA-Review: Clare Hetherington <clare@instructure.com>
Tested-by: Jenkins <jenkins@instructure.com>
treesame commit of origin/stable/2013-01-05

Treesame-Commit-Id: 784d9bce6dd627364cf2a8156d64128ceb0fad67