lock down 'merge into self' path

when POSTing to /users/:user_id/merge without a :new_user_id query
parameter, it uses the current user as the target user. still check
permissions before performing the merge in that case

test-plan:
 - create source user Bob
 - login as target user Sally that has no permission to manage Bob
 - POST to /users/:bobs_id/merge
 - should get redirected to the dashboard with error "User merge failed.
   Please make sure you have proper permission and try again."

Change-Id: I8518938847d48757d56257e3e628b54acb447133
Reviewed-on: https://gerrit.instructure.com/42572
Reviewed-by: Cody Cutrer <cody@instructure.com>
QA-Review: August Thornton <august@instructure.com>
Tested-by: Jenkins <jenkins@instructure.com>
Product-Review: Paul Hinze <paulh@instructure.com>
fix Module Progress link

test plan:
 1. go to the Modules / Student Progress page
    /courses/1/modules/progressions
 2. click a name on the right under "Student Progresses"
 3. "Module Progress for X" on the top of the page should contain
    a working link and not visible HTML code

fixes CNVS-16134

Change-Id: I4eb37c3b375f9c14fe851b14da058eb8d9a40bb2
Reviewed-on: https://gerrit.instructure.com/42560
Tested-by: Jenkins <jenkins@instructure.com>
Reviewed-by: James Williams  <jamesw@instructure.com>
Product-Review: Matt Fairbourn <mfairbourn@instructure.com>
QA-Review: Trevor deHaan <tdehaan@instructure.com>
fix creating delayed messages for retired communication channels

refs CNVS-16138

test plan:
- create a user, set up a communication channel, and set up a notification to
  be 'daily'
- retire the communication channel
- trigger the action that will create the daily notification
- manually trigger the delayed message summarizer job: `DelayedMessage.summarize([DelayedMessage.order(:created_at).last])`
- it should not create a summary message for the retired channel

Change-Id: Id29c6f7d437438894b2e7527ffe7fbe3c220cfda
Reviewed-on: https://gerrit.instructure.com/42380
Reviewed-by: Simon Williams <simon@instructure.com>
Reviewed-by: Matthew Wheeler <mwheeler@instructure.com>
Tested-by: Jenkins <jenkins@instructure.com>
QA-Review: Steven Shepherd <sshepherd@instructure.com>
Product-Review: Matthew Wheeler <mwheeler@instructure.com>
fix adding file module items for hidden files

test plan:
* create a course and upload a file
* lock the file but let students download it
 (i.e. set it hidden)
* add the file as a module item
* should not fail

fixes #CNVS-6198

Change-Id: I87e34efca506edaaaa13ee6943e9192850352740
Reviewed-on: https://gerrit.instructure.com/42464
Reviewed-by: Jeremy Stanley <jeremy@instructure.com>
Product-Review: Jeremy Stanley <jeremy@instructure.com>
Tested-by: Jenkins <jenkins@instructure.com>
QA-Review: Jahnavi Yetukuri <jyetukuri@instructure.com>
allow group leadership edits on group categories

fixes CNVS-14666

altered styles and markup to include form elements
in group category edit view.

abstracted some element handling for autoloader
controls into edit view to be shared by create view.

updated group category API to include auto_leader
in JSON serialization (so the edit form
can set the state correctly)

Changed edit view to set form state based on 
auto_leader value in GroupCategory model from API.

add tests for GroupCategoryEditView in coffee script

update GroupCategories::Params to favor form
submission value over raw api value for auto leader
if both are specified and the form version is
enabled.

add ability to nil out auto_leader status by
unchecking checkbox on form

TEST PLAN:
 - login as a teacher
 - create a group set
 - edit the group set
 - you should be able to change the
    group leadership settings
 - you should be able to nil out autoloader settings
    by unchecking the checkbox on the edit form
 - ensure that as students are added to the groups
    the leadership settings are effective (that is
    a leader still gets assigned at random
    or by first joining student depending on 
    leadership strategy selected)

Change-Id: Iecbb4829f5efccda1bd97bca1d99c3bd4c15bffe
Reviewed-on: https://gerrit.instructure.com/41965
Tested-by: Jenkins <jenkins@instructure.com>
QA-Review: Trevor deHaan <tdehaan@instructure.com>
Reviewed-by: Matthew Wheeler <mwheeler@instructure.com>
Product-Review: Ethan Vizitei <evizitei@instructure.com>
You can now drag and drop beyond the window height

Switched containement to document. This was said not to work, but
everything seemed to function normally.

Fixes CNVS-13835

Test Plan:
Prerequisites: a course with one or more one student enrollments.

- Create a group set in the Groups page.
- Create several groups (5-10 will make this pretty easy to see).
- Resize your window so that one or more groups are out of the viewport and require scrolling to reach.
- Drag and drop a student from the 'Unassigned Students' list (or from another group) to any group that is visible without needing to scroll. This should work as expected.
- Perform the same operation, this time trying to drop the student on a group that is outside the initial viewport and requires scrolling to view.  This should now work as expected.

Change-Id: I5f94ffcc599571b52a66d51425c99bcf47779ab0
Reviewed-on: https://gerrit.instructure.com/42396
Tested-by: Jenkins <jenkins@instructure.com>
Reviewed-by: Matthew Wheeler <mwheeler@instructure.com>
Product-Review: Matthew Wheeler <mwheeler@instructure.com>
QA-Review: Steven Shepherd <sshepherd@instructure.com>
Product-Review: Brad Horrocks <bhorrocks@instructure.com>
DA - remove N+1 from assignment groups controller

fixes CNVS-16025

test plan:
  - load gradebook with DA on and off
    - both work properly
  - upload && download gradebook csv
    - both work properly
    - check for extra "N/A"s showing up
      where they aren't supposed to
  - assignment index page works with DA on/off
    (as student and teacher)
  - single student grades page as student and teacher works
    - with DA on and off

Change-Id: I826d42ae78cbe70f15672e065acc546e51f0b7f4
Reviewed-on: https://gerrit.instructure.com/42360
Reviewed-by: Simon Williams <simon@instructure.com>
Tested-by: Jenkins <jenkins@instructure.com>
QA-Review: Sean Lewis <slewis@instructure.com>
Reviewed-by: Cameron Sutter <csutter@instructure.com>
Product-Review: Simon Williams <simon@instructure.com>
Groups no longer duplicated if set is created with create_group_count

create_group_count was not being reset after a successful sync

Fixes CNVS-15204

Test Plan:

- I- n a course, open the new group set dialog
- Check allow self sign-up, enter a number for groups to create now
- Save the group set.
- Click the gear to edit the group set.
- Save the group set.
- Refresh the page.
- Note the duplicated groups in the set.

Change-Id: I493c1980dab4d15ce3a6a39b0c469e6c9bd39a28
Reviewed-on: https://gerrit.instructure.com/42582
Tested-by: Jenkins <jenkins@instructure.com>
Reviewed-by: Matthew Wheeler <mwheeler@instructure.com>
Product-Review: Matthew Wheeler <mwheeler@instructure.com>
QA-Review: Caleb Guanzon <cguanzon@instructure.com>
Updated tr translation

Change-Id: Iff4ac8d5941dee383467ce57d40f0e5f1a0e945a
spec: intermittent specs pending

Change-Id: Id25b628c7b0c3cd9daf50be02a0faf788bcaee83
Reviewed-on: https://gerrit.instructure.com/42654
Reviewed-by: Bryan Madsen <bryan@instructure.com>
Product-Review: Bryan Madsen <bryan@instructure.com>
QA-Review: Bryan Madsen <bryan@instructure.com>
Tested-by: Shawn Meredith <shawn@instructure.com>
Use `stub` not `double` in params_policy_spec

Fixes QA-550

Double gets removed when we include mocha in spec_helper.rb

This was passing when run alone because it doesn't inclue spec_helper
itself. But when run in a group with other specs that do, this is
failing.

Test plan:

Ensure both of these commands pass:

`bundle exec rspec spec/models/group_categories/params_policy_spec.rb:19
spec/models/course_spec.rb:1159`

`bundle exec rspec
spec/models/group_categories/params_policy_spec.rb:19`

Change-Id: Ibff95506a3afd72b4f817567f801434d7f29f68a
Reviewed-on: https://gerrit.instructure.com/42656
Reviewed-by: Simon Williams <simon@instructure.com>
Reviewed-by: Brian Palmer <brianp@instructure.com>
Product-Review: Matthew Wheeler <mwheeler@instructure.com>
QA-Review: Matthew Wheeler <mwheeler@instructure.com>
Tested-by: Shawn Meredith <shawn@instructure.com>
spec: course_spec pending fragile

Change-Id: I07da071bf3e8cdb475c35e6f54795bc2a5959c11
Reviewed-on: https://gerrit.instructure.com/42682
Reviewed-by: Bryan Madsen <bryan@instructure.com>
Product-Review: Bryan Madsen <bryan@instructure.com>
QA-Review: Bryan Madsen <bryan@instructure.com>
Tested-by: Bryan Madsen <bryan@instructure.com>
rspec 3-ify spec/migrations

refs CNVS-16239

Change-Id: I1abcd23d390b7a4a4b1215c4ac6cf46cd5886735
Reviewed-on: https://gerrit.instructure.com/42662
Tested-by: Jenkins <jenkins@instructure.com>
Reviewed-by: Braden Anderson <braden@instructure.com>
Product-Review: Braden Anderson <braden@instructure.com>
QA-Review: Braden Anderson <braden@instructure.com>
file preview endpoint

test plan:
 0. upload the following types of files into a course, and
    note their IDs:
     a) document of some type (such as Word, PDF)
     b) image (such as JPEG, PNG, GIF)
     c) media (such as MP3, MP4, MOV)
 1. enable canvadocs and google docs previews in account
    settings.
 2. test the document preview by hitting the following
    in a new browser tab:

    /courses/X/files/Y/file_preview

    (where X is the course ID and Y is the file ID
     of the document file)
    - You should see a Canvadocs preview of the document.
    - There should be no Canvas chrome in the window, just
      the document preview.
 3. disable canvadocs but leave google doc previews
    enabled.
 4. hit the URL from step 2.
    - you should see a Google preview of the document
 5. disable Google docs previews.
 6. hit the URL from step 2.
    - you should see a message indicating that no preview is
      available, with a link to download the file.
 7. hit the URL from step 2, but substitute the file ID
    with the ID of an image instead of a document.
    - you should see the image (and nothing else).
 8. hit the URL from step 2, but substitute the file ID
    with the ID of a media file.
    - You should see a functioning media player (or a message
      indicating the media has not been converted yet)
 9. add a document to a module, and set a "must view"
    completion requirement
10. use this endpoint to preview the document, and confirm
    that the module completion requirement is fulfilled

fixes CNVS-15827

Change-Id: Id0ecaa7f003248cb3d8f163e48c3b16631ee59cf
Reviewed-on: https://gerrit.instructure.com/42438
Reviewed-by: Ryan Shaw <ryan@instructure.com>
Tested-by: Jenkins <jenkins@instructure.com>
QA-Review: Jahnavi Yetukuri <jyetukuri@instructure.com>
Product-Review: Cosme Salazar <cosme@instructure.com>
Adds support for previewing all previewable files

closes CNVS-15879

Test Plan:
  - Add a bunch of files of different types
  - Go to file preview and look at the preview of these files
  - More than just images should be displayed.

Change-Id: I31412c950214b87ddfe3b92f4f94e501315996d0
Reviewed-on: https://gerrit.instructure.com/42603
Tested-by: Jenkins <jenkins@instructure.com>
Reviewed-by: Dan Minkevitch <dan@instructure.com>
QA-Review: Jahnavi Yetukuri <jyetukuri@instructure.com>
Product-Review: Cosme Salazar <cosme@instructure.com>
rspec 3-ify spec/messages

refs CNVS-16239

Change-Id: I72027396dde16a7b8653547aa54258adfed7cd26
Reviewed-on: https://gerrit.instructure.com/42666
Tested-by: Jenkins <jenkins@instructure.com>
Reviewed-by: Braden Anderson <braden@instructure.com>
Product-Review: Braden Anderson <braden@instructure.com>
QA-Review: Braden Anderson <braden@instructure.com>
rspec 3-ify spec/initializers

refs CNVS-16239

Change-Id: Ida6f59824f8171e67f0bf3a02ce88ec6c0b0e9ac
Reviewed-on: https://gerrit.instructure.com/42663
Tested-by: Jenkins <jenkins@instructure.com>
Reviewed-by: Braden Anderson <braden@instructure.com>
Product-Review: Braden Anderson <braden@instructure.com>
QA-Review: Braden Anderson <braden@instructure.com>
rspec 3-ify spec/helpers

refs CNVS-16239

Change-Id: I00fa05dd66222d592d629612e8a1cdf8572191d7
Reviewed-on: https://gerrit.instructure.com/42665
Tested-by: Jenkins <jenkins@instructure.com>
Reviewed-by: Paul Hinze <paulh@instructure.com>
Product-Review: Braden Anderson <braden@instructure.com>
QA-Review: Braden Anderson <braden@instructure.com>
rspec 3-ify spec/gem_integration

refs CNVS-16239

Change-Id: I38f598583c7208973f6ab855352d4e7be4461e71
Reviewed-on: https://gerrit.instructure.com/42664
Tested-by: Jenkins <jenkins@instructure.com>
Reviewed-by: Paul Hinze <paulh@instructure.com>
Product-Review: Braden Anderson <braden@instructure.com>
QA-Review: Braden Anderson <braden@instructure.com>
rspec 3-ify spec/presenters

refs CNVS-16239

Change-Id: If379a98243e708d25ad99bfa8b1773730ead1c51
Reviewed-on: https://gerrit.instructure.com/42670
Tested-by: Jenkins <jenkins@instructure.com>
Reviewed-by: Paul Hinze <paulh@instructure.com>
Product-Review: Braden Anderson <braden@instructure.com>
QA-Review: Braden Anderson <braden@instructure.com>