fix HTML escaping in flash notices

test plan:
 * create a discussion topic with html code in it,
   for example:
   this is 
broken

 * delete the discussion topic using the gear menu.
 * the name you see in the popup message informing you that the
   topic has been deleted should appear exactly as you typed it;
   in the example above, you should see "
broken
" literally,
   and not the word "broken" with a line through it.
 * the screenreader flash message should also be sanitized.

fixes CNVS-16635
fixes CNVS-16653
fixes CNVS-16674
fixes CNVS-16683

Change-Id: I90938ffe8e142027df855078e08ea16eb513255c
Reviewed-on: https://gerrit.instructure.com/43869
Tested-by: Jenkins <jenkins@instructure.com>
Reviewed-by: Clay Diffrient <cdiffrient@instructure.com>
QA-Review: Steven Shepherd <sshepherd@instructure.com>
QA-Review: Jahnavi Yetukuri <jyetukuri@instructure.com>
Product-Review: Matt Fairbourn <mfairbourn@instructure.com>
fix html escaping on content migrations page

fixes CNVS-16673

test plan:
 0. create a course whose name and course code contain
    html code; for example
    <img src=x onerror=prompt(0);>
 1. create another course, go to settings, and select
    "import content into this course"
 2. select "copy a canvas course", and choose the course that
    was created in step 0
 3. the name in the source course column should appear exactly
    as typed; HTML should not be rendered (and scripts
    should not be executed)
 4. if you hover over the course name, the tooltip should also
    show (and not render/execute) HTML code

Change-Id: I127cf2cd2b05967ddc4cf18973b9c86d98b16d77
Reviewed-on: https://gerrit.instructure.com/43889
Tested-by: Jenkins <jenkins@instructure.com>
Reviewed-by: Clay Diffrient <cdiffrient@instructure.com>
QA-Review: Jahnavi Yetukuri <jyetukuri@instructure.com>
Product-Review: Matt Fairbourn <mfairbourn@instructure.com>
fix xss in mastery gradebook

fixes CNVS-16670

test plan:
- go to a course outcomes page
- create an outcome with the name: <script>alert('hi');</script>
- go to the mastery gradebook (this requires the feature to be on and it will
  show up as a second tab on the gradebook page)
- you should NOT see a popup alert, and instead just see the name in the page
  like you typed it.

Change-Id: Idf017777fef145bfca75f5275f19ffb2bdeb0eb8
Reviewed-on: https://gerrit.instructure.com/43822
Tested-by: Jenkins <jenkins@instructure.com>
Reviewed-by: Cameron Sutter <csutter@instructure.com>
Reviewed-by: Benjamin Porter <bporter@instructure.com>
QA-Review: Sean Lewis <slewis@instructure.com>
Product-Review: Matt Fairbourn <mfairbourn@instructure.com>
change tinymce to allow empty anchor tags

test plan:
* use the tinymce editor to create html content
 (e.g. for a wiki page)
* switch to HTML editor
* insert an empty anchor tag (e.g. "<a></a>")
* switch to Rich Content Editor, and back
* should not have removed the tag
* save the content
* reload the editor
* switch to HTML editor again
* still should not have removed the tag

closes #CNVS-10779

Change-Id: Id5a6ae7e4e2d6761a7963c9e3546d3750a20ab04
Reviewed-on: https://gerrit.instructure.com/43996
Reviewed-by: Clay Diffrient <cdiffrient@instructure.com>
Tested-by: Jenkins <jenkins@instructure.com>
QA-Review: Jahnavi Yetukuri <jyetukuri@instructure.com>
Product-Review: Matt Fairbourn <mfairbourn@instructure.com>
Fixed truncation for course list table

This fixes the truncation that was supposed
to be happening on the /courses list table
(the course name, specifically).

fixes CNVS-15521

Test Plan:
* Create a course with a significantly long name
* Go to /courses
* That course's name should be truncated and the rest
  of the table should be accessible

Change-Id: I53716cbdecdaf35937db34c1494706186424dfd9
Reviewed-on: https://gerrit.instructure.com/43893
Tested-by: Jenkins <jenkins@instructure.com>
Product-Review: Hilary Scharton <hilary@instructure.com>
Reviewed-by: Clay Diffrient <cdiffrient@instructure.com>
QA-Review: Jahnavi Yetukuri <jyetukuri@instructure.com>
Take off new_style on Color palette variables

fixes CNVS-16711

We originally had our colors for new stuff and colors for current
stuff separated by a flag, but upon further inspection they're
really so close that it makes no sense to have this in there anymore.
HC palette remains the same.

Test plan

- There are very minor color differences in our primary and
secondary blue colors, otherwise no changes. None of those variables
are in use yet so nothing on Canvas side changes, just in
/styleguide will it be noticeable

Change-Id: Ib763c4c682f77032e3bb0085007457ffc1f98b9a
Reviewed-on: https://gerrit.instructure.com/43896
Tested-by: Jenkins <jenkins@instructure.com>
Reviewed-by: Vincent Gonzalez <vgonzalez@instructure.com>
Reviewed-by: Chris Hart <chart@instructure.com>
Product-Review: Colleen Palmer <colleen@instructure.com>
QA-Review: Colleen Palmer <colleen@instructure.com>
add i18n to titles on the student assignment index page

fixes CNVS-16743
fixes gh-546

test plan:
- go to the assignment index page as a student
- the following labels should look right:
  * "Overdue Assignments"
  * "Upcoming Assignments"
  * "Past Assignments"
- once translations are updated, verify that in other languages these labels
  are translated

Change-Id: Iefb146f2a90a336f5ea274332be2f0744cb9982c
Reviewed-on: https://gerrit.instructure.com/44006
Reviewed-by: Mike Nomitch <mnomitch@instructure.com>
Tested-by: Jenkins <jenkins@instructure.com>
QA-Review: Sean Lewis <slewis@instructure.com>
Product-Review: Simon Williams <simon@instructure.com>
adds checkbox to quiz/show_answers to show correct answers on last attempt

closes PFS-201, PFS-202, PFS-203

Test Plan Happy Path: 
	1) Setup Canvas and run migrations
	2) Create a quiz and set the number of attempts to 2
	3) Check "Let students see their responses"
	4) Check "Let Students see their correct answers"
	5) Check "Only after last attempt"
	6) As a student, take the quiz. On the first attempt verify that you do not see the correct answers.
	7) As a student, take the quiz for the final attempt and verify that you see the answers to the questions.

Change-Id: I6c108174c817959be23770b3dfa9065831907460
Reviewed-on: https://gerrit.instructure.com/43179
Tested-by: Jenkins <jenkins@instructure.com>
Reviewed-by: Derek DeVries <ddevries@instructure.com>
QA-Review: Trevor deHaan <tdehaan@instructure.com>
Reviewed-by: Cody Tanner <ctanner@instructure.com>
Product-Review: Cody Tanner <ctanner@instructure.com>
QA-Review: Cody Tanner <ctanner@instructure.com>
Tested-by: Cody Tanner <ctanner@instructure.com>
don't sign SAML auth requests

fixes: CNVS-16746

ruby-saml-mod gem v0.2.1 reverts the auth_request back to its state
before v0.2.0.  In v0.2.0 it started to sign the auth_requests but never
included the Destination attribute in the xml which is required if an
auth_request is signed.

Test Plan:

 - Setup a SAML environment with Canvas.
 - Log in while observing the requests in a browser console.
 - Make sure the auth request is not signed.

Change-Id: Id89aff70d5a77db94f7c2ae58f87727801386bc3
Reviewed-on: https://gerrit.instructure.com/44021
Reviewed-by: Paul Hinze <paulh@instructure.com>
Tested-by: Jenkins <jenkins@instructure.com>
QA-Review: August Thornton <august@instructure.com>
Product-Review: Matt Fairbourn <mfairbourn@instructure.com>
CQS - ANIMATED correct answer ratio donut

Closes CNVS-16594

TEST PLAN
---- ----

  - go to new stats
  - watch the correct-answer donut charts spin up as data loads
  - watch the text inside of them (the %) spin up as data loads
  - go to a question with answer sets like FIMB or Matching
    + switch between answer sets
      - verify the arc in the donut as well as the text spin

Change-Id: If34e519bb72361a1e52ace3f0f5ae173aad84d60
Reviewed-on: https://gerrit.instructure.com/43625
Reviewed-by: Ryan Taylor <rtaylor@instructure.com>
Tested-by: Jenkins <jenkins@instructure.com>
QA-Review: Trevor deHaan <tdehaan@instructure.com>
Product-Review: Derek DeVries <ddevries@instructure.com>
CQS - ANIMATED percentile chart & brushing

This patch enhances the big chart in the Summary section (percentile
distribution) in a few ways:

  1. better positioning / anti-clipping when browser is resized
  2. bars are animated on the Y axis
  3. support for selecting a range of percentiles to interactively see
     how many students have scored within that range. This is refered to
     as "brushing" in the test plan
  4. code is optimized and no longer fully re-renders on updates

Closes CNVS-16595

TEST PLAN
---- ----

  - create a quiz with a large number of submissions so we get some
    healthy data for the chart
  - go to new quiz stats

Testing the animation:

  - just keep an eye on the chart as the page loads
  - verify that you see the animation of every bar growing up on Y axis

Testing positioning / scaling:

  - try resizing the browser a bit by bit (make it narrower) and make
    sure that to a certain extent, the chart stays visible and shrinks
    in size (x-axis ticks may get clipped, not much we can do about
    that)

Testing the brush:

  - verify that when you hover over the chart, you see a tip telling you
    you could use ur cursor to make a selection
  - try making a selection:
    + you should be able to "brush" the chart, and as you do, you read a
      sentence below with some information about the number of students
      who scored within the range of percentiles you selected
    + grab the selection around, and verify that the sentence updates
      with the correct information
  - single-click on any percentile:
    + you should see a similar, but some-what reworded, version of the
      sentence highlighting students who scored *exactly* that
    + also, the brush should automatically "clip" to cover the entire
      bar (e.g, it gets shaded without you having to manually make the
      selection)
    + try clicking the 0 and 100 percentile bars, make sure they're OK

Change-Id: Id0b5cfdc60e42214845c191f90ca42edd7d4b859
Reviewed-on: https://gerrit.instructure.com/43993
Tested-by: Jenkins <jenkins@instructure.com>
Reviewed-by: Ryan Taylor <rtaylor@instructure.com>
QA-Review: Trevor deHaan <tdehaan@instructure.com>
Product-Review: Derek DeVries <ddevries@instructure.com>
Centralize the accessbility keyboard shortcuts code

Move the quiz team code that adds keyboard shortcuts to TinyMCE to
a more central location that accessible by all components

Refs CNVS-15962

Change-Id: Ief6758eaa1609596cb3e0c2efd4fa5a0c3497db7
Reviewed-on: https://gerrit.instructure.com/44023
Tested-by: Jenkins <jenkins@instructure.com>
Reviewed-by: Derek DeVries <ddevries@instructure.com>
QA-Review: Sean Lewis <slewis@instructure.com>
Product-Review: Benjamin Porter <bporter@instructure.com>
allow publishing topics with replies

fixes CNVS-16730

test plan
- as a teacher, make an unpublished discussion topic with a reply
- ensure that you can publish the discussion topic from the topic
 edit page as well as the discussion index page

Change-Id: I91db87dc1f507333da5b9ab16521c659d955cdbb
Reviewed-on: https://gerrit.instructure.com/44036
Tested-by: Jenkins <jenkins@instructure.com>
Reviewed-by: Matthew Wheeler <mwheeler@instructure.com>
QA-Review: Matt Fairbourn <mfairbourn@instructure.com>
Product-Review: Matt Fairbourn <mfairbourn@instructure.com>
remove shims of migration to DiscussionTopic#group_category

Change-Id: I15e3224275c6aab911cae6c2a9e3aac167b61f71
Reviewed-on: https://gerrit.instructure.com/43875
Tested-by: Jenkins <jenkins@instructure.com>
Reviewed-by: Braden Anderson <braden@instructure.com>
Product-Review: Braden Anderson <braden@instructure.com>
QA-Review: Cody Cutrer <cody@instructure.com>
bump syck for ruby 2.2 compatible version

Change-Id: I811d97cab5553e84edac52ee989008a4703e316b
Reviewed-on: https://gerrit.instructure.com/44040
Reviewed-by: Jacob Fugal <jacob@instructure.com>
Tested-by: Jenkins <jenkins@instructure.com>
Product-Review: Cody Cutrer <cody@instructure.com>
QA-Review: Cody Cutrer <cody@instructure.com>
have workflow add its methods through a module

this allows another module included later in the model to define
similarly named methods and have them take precedence over (and also be
able to use via super) the ones defined by workflow.

Change-Id: Ib4fb472c1a1fc90e571fb3f006f0eccb29e96fcc
Reviewed-on: https://gerrit.instructure.com/43976
Reviewed-by: Cody Cutrer <cody@instructure.com>
Tested-by: Jenkins <jenkins@instructure.com>
QA-Review: Jacob Fugal <jacob@instructure.com>
Product-Review: Jacob Fugal <jacob@instructure.com>
extract tardiness predicates into a module

refs CNVS-16621

so that they can be used in other Submission-like objects (needed for an
analytics optimization)

Change-Id: I28c55ba8dfdaf911e58206abf0ed9a994bd75c1e
Reviewed-on: https://gerrit.instructure.com/43962
Reviewed-by: Cody Cutrer <cody@instructure.com>
Tested-by: Jenkins <jenkins@instructure.com>
Product-Review: Jacob Fugal <jacob@instructure.com>
QA-Review: Jacob Fugal <jacob@instructure.com>
unknown user url redirect loop pt2

fixes: CNVS-16383

Checks for a blank unknown_user_url along with a nil before defaulting
to the login_url for CAS authentication.

Test Plan:

  - Setup CAS with a user that does not exist in Canvas.
      - Make sure the unknown_user_url is an empty string for the
        accounts authorization config.
  - Attempt to login to the user with and it should show a Canvas login
    page with an error that the user does not exist.
  - Change the unknown_user_url to nil and it should behave the same as
    if it was an empty string.
  - Change the unknown_user_url to a custom url and it should redirect
    to that page instead of showing the Canvas login page with an error.

Change-Id: Ib97fa022ddc0bc4c4882bf5375f73de89dd94596
Reviewed-on: https://gerrit.instructure.com/43975
Reviewed-by: Cody Cutrer <cody@instructure.com>
Tested-by: Jenkins <jenkins@instructure.com>
QA-Review: August Thornton <august@instructure.com>
Product-Review: Nick Cloward <ncloward@instructure.com>
sort speedgrader dropdown menu for group assignments

fixes CNVS-16714

Test plan:
  * make some groups with non-latin names (二, and 一, for example)
  * make a group assignment using that group category
  * open the assignment in speedgrader
  * the groups should be listed in proper order (一 before 二)

Change-Id: Ide53cc6a5607fb29907c158325f4698c6d59ff1b
Reviewed-on: https://gerrit.instructure.com/43954
Tested-by: Jenkins <jenkins@instructure.com>
QA-Review: Amber Taniuchi <amber@instructure.com>
Product-Review: Matt Fairbourn <mfairbourn@instructure.com>
Reviewed-by: Josh Simpson <jsimpson@instructure.com>