remove unused code

it's for the best, since role_select_options had a XSS vulnerability...
s.html_safe != html_escape(s)

test plan:
n/a, specs should pass

Change-Id: I46b180193b0669934007272033bb64b50eea3e7b
Reviewed-on: https://gerrit.instructure.com/29233
Tested-by: Jenkins <jenkins@instructure.com>
Reviewed-by: Brian Palmer <brianp@instructure.com>
Product-Review: Marc LeGendre <marc@instructure.com>
QA-Review: Marc LeGendre <marc@instructure.com>
extract js_block in question_banks#show to external js file

fixes CNVS-10727

- test plan
  - navigate to the page for an individual question bank
  - ie: /courses/1/question_banks/1
  - mess around to make sure that everything continues to work
  - make sure no js errors show in the console log

Change-Id: I6b0e945edfe1ec5332961b5bf4ebd239e352fd00
Reviewed-on: https://gerrit.instructure.com/29108
Tested-by: Jenkins <jenkins@instructure.com>
Reviewed-by: Stanley Stuart <stanley@instructure.com>
QA-Review: Myller de Araujo <myller@instructure.com>
Product-Review: Derek DeVries <ddevries@instructure.com>
Conversations: allow messages to groups in unpublished courses

fixes CNVS-10684

test plan:
  * create an unpublished course
  * invite a student
  * create a group in the course
  * add the student to the group
  * log in as the student
  * open old conversations
  * compose a new message
  * click on the address book icon
  * verify that the recipients list loads

Change-Id: Ic25500a31ef604331d7380e76af226b0c10fd4a1
Reviewed-on: https://gerrit.instructure.com/29244
Tested-by: Jenkins <jenkins@instructure.com>
QA-Review: Steven Shepherd <sshepherd@instructure.com>
Reviewed-by: Joel Hough <joel@instructure.com>
Product-Review: Bryan Madsen <bryan@instructure.com>
fix issue with regrades changing displayed points of questions within a group

fixes CNVS-10533

test plan:
- as a teacher
  - create a quiz with a question group that has Pick: 1, Points: 25
  - create a question within the group that has Points: 1

- as a student
  - take the quiz, get the answer correct

- as a teacher
  - change the answer for the question, choose first regrade option
  - save the quiz

- as a student
  - view your quiz results
  - point values should continue to show 25/25 points

- poke around with points within a quiz group when regrading
- poke around with regrading stuff in general to try and break point scoring

Change-Id: Id5cacf44012d967a812e2208df0404c3d532f2c5
Reviewed-on: https://gerrit.instructure.com/29002
Tested-by: Jenkins <jenkins@instructure.com>
Reviewed-by: Jason Madsen <jmadsen@instructure.com>
QA-Review: Caleb Guanzon <cguanzon@instructure.com>
Product-Review: Derek DeVries <ddevries@instructure.com>
allow users to update scores on submissions with role overrides

Test Plan:
  - Go to the "Permissions" tab in Site Admin.
  - Create a new Role based on "Teacher" that has the
    "Add/edit/delete assignments" role unchecked.
  - Enroll a teacher in that course with that role.
  - Have a student take a quiz in that course and submit it.
  - Have the teacher you previously enrolled update the score of
    the questions in the quiz using SpeedGrader. You should not
    get an unauthorized error.

fixes CNVS-10617

Change-Id: I94ff7608b2b801450cc55d0d5d6654bcbdd79c35
Reviewed-on: https://gerrit.instructure.com/29270
Reviewed-by: Jason Madsen <jmadsen@instructure.com>
QA-Review: Myller de Araujo <myller@instructure.com>
Tested-by: Jenkins <jenkins@instructure.com>
Product-Review: Stanley Stuart <stanley@instructure.com>
fix group category selector for string ids

fixes CNVS-10699

Test plan:
  try changing the group on an assignment, make sure the proper group
  is still selected when you go back to edit

  if possible this needs to be done before and after
  Ifa654f7d853fd167d5bfbaee6184657209d58272

Change-Id: Ic79447d6559558a4de2d296e2fe3f0fc0a8c7095
Reviewed-on: https://gerrit.instructure.com/29288
Reviewed-by: Simon Williams <simon@instructure.com>
QA-Review: Amber Taniuchi <amber@instructure.com>
Product-Review: Bryan Madsen <bryan@instructure.com>
Tested-by: Bryan Madsen <bryan@instructure.com>
spec: s/integration/request/

Change-Id: I9158248a217d67a3184caed07744a3b8c6de469e
Reviewed-on: https://gerrit.instructure.com/29285
Reviewed-by: Cody Cutrer <cody@instructure.com>
Product-Review: Cody Cutrer <cody@instructure.com>
QA-Review: Cody Cutrer <cody@instructure.com>
Tested-by: Cody Cutrer <cody@instructure.com>
add outcome gradebook sidebar toggle

fixes CNVS-10626

test plan:
  * navigate to outcome gradebook and notice that the
    sidebar now has an arrow icon at its head;
  * click the arrow icon and verify that:
    * the sidebar collapses;
    * the direction of the sidebar arrow reverses;
    * the mastery checkboxes are visible, but their labels
      are not;
    * the mastery checkboxes display a tooltip on hover.
  * verify that clicking the arrow again will un-collapse
    the sidebar.

Change-Id: I86277359cfd2b998d557e856cb109bcf8c3d37e5
Reviewed-on: https://gerrit.instructure.com/29067
Tested-by: Jenkins <jenkins@instructure.com>
Reviewed-by: Zach Pendleton <zachp@instructure.com>
Product-Review: Zach Pendleton <zachp@instructure.com>
QA-Review: Zach Pendleton <zachp@instructure.com>
change User model to use dates_hash_visible_to

it was the only external user of all_dates_visible_to, so making this change
allows all_dates_visible_to to be module private.  additionally,
dates_hash_visible_to will ignore the default due date if all sections are
overridden, which is a more standard behavior.

closes CNVS-10538

test plan:
- basic regression test of the 'upcoming assignments' list on the user and
  course dashboards for assignments with multiple due dates (check different
  combinations of overriding all/some sections, and having dates in
  and outside of the 'upcoming' window)

Change-Id: I13ca8a61d8813204edb88f1812ec51783d6a24ce
Reviewed-on: https://gerrit.instructure.com/28658
Reviewed-by: Mike Nomitch <mnomitch@instructure.com>
Tested-by: Jenkins <jenkins@instructure.com>
Reviewed-by: Cameron Sutter <csutter@instructure.com>
QA-Review: Amber Taniuchi <amber@instructure.com>
Product-Review: Simon Williams <simon@instructure.com>
spec: fix learning_outcome_result_spec for association

Change-Id: I959093196ea60571189427d04eece78385252052
Reviewed-on: https://gerrit.instructure.com/29277
Tested-by: Jenkins <jenkins@instructure.com>
Product-Review: Bryan Madsen <bryan@instructure.com>
QA-Review: Bryan Madsen <bryan@instructure.com>
Reviewed-by: Cody Cutrer <cody@instructure.com>
fix hidden/unpublished wiki page visibility

test plan:
 * disable the 'Manage wiki' permission for teachers
 - with draft state disabled
   * navigate to the wiki
     - hidden pages should be listed in the sidebar
   * navigate to a hidden page
     - the page should be shown without error
 - with draft state enabled
   * navigate to the pages index (/courses/.../pages)
     - unpublished pages should be listed in the index
   * navigate to an unpublished page
     - the page should be shown without error
     - the top bar should indicate the page is unpublished

fixes CNVS-10706

Change-Id: I4c6ec29645620a1f6f9386c56e4236d50832ebee
Reviewed-on: https://gerrit.instructure.com/29235
Tested-by: Jenkins <jenkins@instructure.com>
Reviewed-by: Jeremy Stanley <jeremy@instructure.com>
Product-Review: Bracken Mosbacker <bracken@instructure.com>
QA-Review: Matt Fairbourn <mfairbourn@instructure.com>
bump ruby-saml-mod to latest version

Change-Id: I89bb7ec9d688ac5ff4d72746c423f5c1231867d9
Reviewed-on: https://gerrit.instructure.com/29314
Tested-by: Jenkins <jenkins@instructure.com>
Reviewed-by: Jeremy Stanley <jeremy@instructure.com>
Reviewed-by: Brian Palmer <brianp@instructure.com>
Product-Review: Paul Hinze <paulh@instructure.com>
QA-Review: Paul Hinze <paulh@instructure.com>
instrument SAML login with stats

using these stats we should be able to follow SAML logins through their
lifecycle.

 - `canvas.saml.{an_account_host}.login_attempt` is the start of the
   process, where canvas redirects to the configured identity provider
 - `.login_response_received` will track all return requests from
   identity providers, regardless of outcome.
 - from there, every login response should resolve into either a
   `normal` or an `errors` subkey, with further details on the category
   of outcome in the next level of nesting.

the logout path is less important (and has less outcomes). we simply
instrument attempts and responses received for this path.

Change-Id: I7eb90776adb06303ee349394266e716ca7e639a2
Reviewed-on: https://gerrit.instructure.com/29315
Reviewed-by: Paul Hinze <paulh@instructure.com>
Product-Review: Paul Hinze <paulh@instructure.com>
QA-Review: Paul Hinze <paulh@instructure.com>
Tested-by: Paul Hinze <paulh@instructure.com>
remove extra nesting from canvas saml stats

Change-Id: I398c129ef5f65d94dffc38608c04b21b13fccd2b
Reviewed-on: https://gerrit.instructure.com/29316
Reviewed-by: Brian Palmer <brianp@instructure.com>
Product-Review: Paul Hinze <paulh@instructure.com>
QA-Review: Paul Hinze <paulh@instructure.com>
Tested-by: Paul Hinze <paulh@instructure.com>
fix find_ids_in_batches for rails 3

Change-Id: I23a37b67f37f6545227375432aaf6ca4f61612e9
Reviewed-on: https://gerrit.instructure.com/29276
Tested-by: Jenkins <jenkins@instructure.com>
Reviewed-by: Brian Palmer <brianp@instructure.com>
Product-Review: Cody Cutrer <cody@instructure.com>
QA-Review: Cody Cutrer <cody@instructure.com>
clean up code around cache forcing

refs CNVS-9546

pull the common code into

 * Rails.force_cache!,
 * Rails.unforce_cache!,
 * Rails.force_cache{},
 * Rails.disable_cache!, and
 * Rails.disable_cache{}

methods. leave the implementation of those methods close to the code
they're replacing for now, but in the near future we'll reimplement
those methods to be cleaner (i.e. not mucking around with version
specific internal constants and such).

test-plan: specs

Change-Id: Ie5f47a64f57dea0034933d8dad84e17633869a49
Reviewed-on: https://gerrit.instructure.com/28086
Tested-by: Jenkins <jenkins@instructure.com>
Reviewed-by: Cody Cutrer <cody@instructure.com>
Product-Review: Jacob Fugal <jacob@instructure.com>
QA-Review: Jacob Fugal <jacob@instructure.com>
fix detection of DISTINCT for find_in_batches_with_usefullness in Rails 3

Change-Id: Ia5db4e12c67517b29809d4651c56965822761a59
Reviewed-on: https://gerrit.instructure.com/29281
Tested-by: Jenkins <jenkins@instructure.com>
Reviewed-by: James Williams  <jamesw@instructure.com>
Product-Review: Cody Cutrer <cody@instructure.com>
QA-Review: Cody Cutrer <cody@instructure.com>
spec: fix several AR::Base specs for rails 3

 * don't define message on Object. that's scary
 * change some deprecated rspec syntax
 * pend fake_arel specs in rails 3

Change-Id: Ib53f4bfd8edc24be48e1e8b29162fa1210175bc5
Reviewed-on: https://gerrit.instructure.com/29280
Tested-by: Jenkins <jenkins@instructure.com>
Reviewed-by: James Williams  <jamesw@instructure.com>
Product-Review: Cody Cutrer <cody@instructure.com>
QA-Review: Cody Cutrer <cody@instructure.com>
clean up cache forcing implementation

refs CNVS-9546

to avoid mucking around with RAILS_CACHE and
ActionController::Base.cache_store=

Change-Id: Ic94416634fdd1c4c0754529a8a2c927c6541c8ab
test-plan: specs
Reviewed-on: https://gerrit.instructure.com/29228
Reviewed-by: Jacob Fugal <jacob@instructure.com>
Product-Review: Jacob Fugal <jacob@instructure.com>
QA-Review: Jacob Fugal <jacob@instructure.com>
Tested-by: Jenkins <jenkins@instructure.com>
fix module item XSS vulnerability, closes CNVS-10767

test plan:
1. before checking out this commit:
   1. create a module and a module item (assignment)
   2. add a completion prerequisite to the module
      1. select the assignment
      2. pick "score at least"
      3. put <script>alert('hi')</script> as the value
   3. update the module
   4. refresh the page
   5. you should get a javascript alert
   6. enable (or disable) draft state and refresh the page
   7. you should still get an alert
2. after checking out this commit:
   1. run migrations
   2. go to the module page
   3. you should not get an alert
   4. the min score should now be 0.0
   5. if you try to put in <script> tags as the value,
      it should get converted to 0.0

Change-Id: I2d71ae2fbd6c227e45264ca21f201868f5b9651e
Reviewed-on: https://gerrit.instructure.com/29240
Reviewed-by: Jon Jensen <jon@instructure.com>
Product-Review: Jon Jensen <jon@instructure.com>
QA-Review: Jon Jensen <jon@instructure.com>
Tested-by: Jenkins <jenkins@instructure.com>