use absolute url for avatar in notifications

fixes CNVS-14251

test plan
- cause a notification with an avatar to be sent (discussion,
 conversation, or submission comment)
- ensure that the avatar image src attribute is an absolute url

Change-Id: I6992de1f4b83ecfdf838725a42e09feb1ca5e1c9
Reviewed-on: https://gerrit.instructure.com/37729
Tested-by: Jenkins <jenkins@instructure.com>
Reviewed-by: Matthew Wheeler <mwheeler@instructure.com>
Product-Review: Matthew Wheeler <mwheeler@instructure.com>
Tested-by: Matthew Wheeler <mwheeler@instructure.com>
QA-Review: Steven Shepherd <sshepherd@instructure.com>
fix rails 3 shard deserialization into rails 2

Change-Id: I3c93d8ac833ca4c78f6da51f03202eadfa78dea8
Reviewed-on: https://gerrit.instructure.com/37856
Reviewed-by: Cody Cutrer <cody@instructure.com>
QA-Review: Cody Cutrer <cody@instructure.com>
Tested-by: Jenkins <jenkins@instructure.com>
Product-Review: James Williams  <jamesw@instructure.com>
audit log uuid data fixup

refs: CNVS-13987

Creates new records for audit log data that has been overritten.  Since
we cannot all of the actual event data they are created as a corrupted
record

Test Plan:
  - Clear Audit logs (Not manditory but easier to see data)
  - Generate Bad Audit data for each test case.
    * Supplied script should generate the bad data.
    * Refer to test case to ensure data is created correctly.
  - Pull Commit and run migrations.
  - Check Case 1
    * The original id record should still exist with a record in
      courses_by_course.
    * Before the fix only one course change record will exst.  After the
      after the fix a second tombstone record with a record type of
      corrupted should exist with related index records in
      courses_by_course.
    * Key column in each index should match the id/bucket format.
    * ordered_id in each should match timestamp/first eight of id.
 - Check Case 2
    * After the fix pick a tombstone record and ensure that it as an
      index record in each of the index tables: authentications_by_pseudonym,
      authentications_by_user, authentications_by_account.
    * Ensure cross bucket event indexes create a tombstone and match in
      other indexes as well.  Id should be unique in the index tables
      and stream table.

- Code to generate test cases:

target_course = Course.find(...)
target_user = User.find(...)
target_pseudonym = target_user.pseudonyms.first

event = Auditors::Course.record_created(target_course, target_user,
source: :manual)
record = Auditors::Course::Record.generate(target_course, target_user,
event.event_type, event.event_data, source: :manual)
record.attributes['id'] = event.id
record.attributes['created_at'] = Time.now + 1.day
Auditors::Course::Stream.insert(record)

event = Auditors::Authentication.record(target_pseudonym, 'login')
record = Auditors::Authentication::Record.generate(target_pseudonym,
event.event_type)
record.attributes['id'] = event.id
record.attributes['created_at'] = Time.now + 100.days
Auditors::Authentication::Stream.insert(record)

Change-Id: I888da1758282d0e3f2d19a4438c1a866a6f54125
Reviewed-on: https://gerrit.instructure.com/37605
Reviewed-by: Jacob Fugal <jacob@instructure.com>
Tested-by: Jenkins <jenkins@instructure.com>
QA-Review: Jeremy Putnam <jeremyp@instructure.com>
Product-Review: Nick Cloward <ncloward@instructure.com>
conversations: only poll unread count on inbox page

fixes CNVS-14355

test plan:
  * open conversations
  * mark a conversation read or unread
  * wait 30 seconds
  * verify that your unread message count is updated

  * open your browser's network monitor
  * switch to another tab
  * wait 30 seconds
  * verify that /api/v1/conversations/unread_count was not hit

  * open a different canvas page
  * wait 30 seconds
  * verify that /api/v1/conversations/unread_count was not hit

Change-Id: Ib33ac1fda7e16717508cfb34bf360d8b917468d1
Reviewed-on: https://gerrit.instructure.com/37954
Reviewed-by: Brian Palmer <brianp@instructure.com>
Reviewed-by: Matthew Wheeler <mwheeler@instructure.com>
Product-Review: Matthew Wheeler <mwheeler@instructure.com>
Tested-by: Jenkins <jenkins@instructure.com>
QA-Review: Steven Shepherd <sshepherd@instructure.com>
ignore zip entries containing '..' elements or symlinks

extract core unzip functionality into canvas_unzip gem, and put
security logic there. use this gem instead of shelling out to
`unzip` (which does not have the option to skip symlinks).

test plan:
 1. import 'evil_course_2.imscc' from CNVS-14338
    * there should be an import warning
    * you should get a blank syllabus body and
      definitely not see sensitive system data
 2. import 'evil_sis_import.zip' from CNVS-14346
    * a file called '/tmp/pwn3d' should not have been
      created on your app server
 3. sanity check the parts of canvas that unzip things:
    * course copy
    * course import
    * zip content imports via the API
    * zip file uploads from files page
    * assignment submission comments download/upload
    * sis imports

fixes CNVS-14338
fixes CNVS-14346

Change-Id: I38fa141653eb7bc483e99a28a135831b8cb3b2a6
Reviewed-on: https://gerrit.instructure.com/37959
Reviewed-by: Cody Cutrer <cody@instructure.com>
QA-Review: Clare Strong <clare@instructure.com>
Tested-by: Jenkins <jenkins@instructure.com>
Product-Review: Jeremy Stanley <jeremy@instructure.com>
data fixup needs to support Cassandra 1.1

refs: CNVS-13987

Test Plan:

  Same as g/37605 but under Cassandra 1.1
  Lower the batch size and make sure it has the same results.

Change-Id: Id35b7a2690fd33e1769d27836deb374630f27fd3
Reviewed-on: https://gerrit.instructure.com/37956
Tested-by: Jenkins <jenkins@instructure.com>
Reviewed-by: Brian Palmer <brianp@instructure.com>
QA-Review: August Thornton <august@instructure.com>
Product-Review: Nick Cloward <ncloward@instructure.com>
treesame commit of origin/stable/2014-07-12

Treesame-Commit-Id: 0932fccda52d379d90efb4831865f7f3219b0b12