ignore zip entries containing '..' elements or symlinks

extract core unzip functionality into canvas_unzip gem, and put
security logic there. use this gem instead of shelling out to
`unzip` (which does not have the option to skip symlinks).

test plan:
 1. import 'evil_course_2.imscc' from CNVS-14338
    * there should be an import warning
    * you should get a blank syllabus body and
      definitely not see sensitive system data
 2. import 'evil_sis_import.zip' from CNVS-14346
    * a file called '/tmp/pwn3d' should not have been
      created on your app server
 3. sanity check the parts of canvas that unzip things:
    * course copy
    * course import
    * zip content imports via the API
    * zip file uploads from files page
    * assignment submission comments download/upload
    * sis imports

fixes CNVS-14338
fixes CNVS-14346

Change-Id: I38fa141653eb7bc483e99a28a135831b8cb3b2a6
Reviewed-on: https://gerrit.instructure.com/37959
Reviewed-by: Cody Cutrer <cody@instructure.com>
QA-Review: Clare Strong <clare@instructure.com>
Tested-by: Jenkins <jenkins@instructure.com>
Product-Review: Jeremy Stanley <jeremy@instructure.com>
clean up discussion edit page

fixes CNVS-12770

I just cleaned up some uneccessary code from simon's suggestions.
There are no functionality changes from g/34272

Change-Id: I5cec7c44b31663de5fb945afb8b9557aad2e282c
Reviewed-on: https://gerrit.instructure.com/37931
Tested-by: Jenkins <jenkins@instructure.com>
Reviewed-by: Liz Abinante <labinante@instructure.com>
QA-Review: Amber Taniuchi <amber@instructure.com>
Product-Review: Simon Williams <simon@instructure.com>
data fixup needs to support Cassandra 1.1

refs: CNVS-13987

Test Plan:

  Same as g/37605 but under Cassandra 1.1
  Lower the batch size and make sure it has the same results.

Change-Id: Id35b7a2690fd33e1769d27836deb374630f27fd3
Reviewed-on: https://gerrit.instructure.com/37956
Tested-by: Jenkins <jenkins@instructure.com>
Reviewed-by: Brian Palmer <brianp@instructure.com>
QA-Review: August Thornton <august@instructure.com>
Product-Review: Nick Cloward <ncloward@instructure.com>
sync error visuals w/ Post Grades assignment form

Shows red circles next to form elements that are missing or
incorrect (due_at, name).

Test Plan:
- press "Post Grades" button
- assignments with missing due dates or names should have
  a red circle next to them
- choosing a date or typing a name should remove the red
  circle after removing focus from the element

Fixes SIS-335

Change-Id: I9b01f4f322e20180211285bc02ed027d3aebf31d
Reviewed-on: https://gerrit.instructure.com/37211
Tested-by: Jenkins <jenkins@instructure.com>
Product-Review: Eric Adams <eadams@instructure.com>
Reviewed-by: Simon Williams <simon@instructure.com>
Reviewed-by: Tyler Pickett <tpickett+gerrit@instructure.com>
QA-Review: Jeremy Putnam <jeremyp@instructure.com>
spec: intermittent failure for dashboard spec fix

Change-Id: Idc0509cd60ead568f1f2c964a572c8b5aa8b6ba9
Reviewed-on: https://gerrit.instructure.com/38145
Reviewed-by: Kyle Rosenbaum <kyler@instructure.com>
Product-Review: Kyle Rosenbaum <kyler@instructure.com>
QA-Review: Kyle Rosenbaum <kyler@instructure.com>
Tested-by: Jenkins <jenkins@instructure.com>
only parse integration_data when string

When assignments that contain integration_data are saved, they
currently fail on save if integration_data is not part of the
save--i.e. since integration_data is already a parsed Hash, and
our code tries to parse it as JSON, the JSON parser raises an
exception.

This prevents JSON parsing when integration_data is not a string.

Fixes SIS-375

Change-Id: I305479c5a9999c0b7a452099d598467f70079e80
Reviewed-on: https://gerrit.instructure.com/38080
Tested-by: Jenkins <jenkins@instructure.com>
Reviewed-by: Liz Abinante <labinante@instructure.com>
Reviewed-by: Tyler Pickett <tpickett+gerrit@instructure.com>
Product-Review: Duane Johnson <duane@instructure.com>
QA-Review: Jeremy Putnam <jeremyp@instructure.com>
save assignments on Post Grades

Saves assignment names and due dates when modified in the SIS Post
Grades dialog.

Test Plan:
- for assignments that are missing names or duplicated, fix the
  name
- for assignments that are missing due dates, add a due date
- once all assignments are fixed, the assignments should auto-
  matically be saved to Canvas
- the user is sent to the next page in the dialog where they
  can click "Post" button

Fixes SIS-250

Change-Id: I0bbcf6f4eea1c4bf645cbd09a123bf0ac37fd1cd
Reviewed-on: https://gerrit.instructure.com/37248
Tested-by: Jenkins <jenkins@instructure.com>
Product-Review: Eric Adams <eadams@instructure.com>
Reviewed-by: Tyler Pickett <tpickett+gerrit@instructure.com>
Reviewed-by: Liz Abinante <labinante@instructure.com>
QA-Review: Jeremy Putnam <jeremyp@instructure.com>