fix speedgrader xss vulnerability

closes CNVS-13427

test plan:
- create a course with multiple sections, and name one of them with html in the
  name
- also create multiple teachers and name them with html in the name
- create an assignment with a rubric
- go to speedgrader
- in the student dropdown menu, where you can pick which section to filter, the
  section name should be escaped (should show the raw html)
- fill out the rubric with multiple teachers
- reload speedgrader, there should be a dropdown that lets you pick which
  rubric assessment to look at it, and in that dropdown, the teacher name with
  html should be escaped

Change-Id: I2521e2fb4130cc97d47fa233a0fdc105302e9874
Reviewed-on: https://gerrit.instructure.com/35983
Reviewed-by: Tyler Pickett <tpickett+gerrit@instructure.com>
Tested-by: Jenkins <jenkins@instructure.com>
QA-Review: Amber Taniuchi <amber@instructure.com>
Product-Review: Simon Williams <simon@instructure.com>
fix round CSS for count bubbles

fixes CNVS-13229

test plan:
  * open Canvas as a user with unread messages
  * verify that the unread count in your header is rounded
  * open your dashboard
  * verify that the new items count bubbles are rounded

Change-Id: I7a8b244101c4d49454692b91a6623a466eeb776a
Reviewed-on: https://gerrit.instructure.com/36067
Reviewed-by: Simon Williams <simon@instructure.com>
Tested-by: Jenkins <jenkins@instructure.com>
QA-Review: Steven Shepherd <sshepherd@instructure.com>
Product-Review: Braden Anderson <banderson@instructure.com>
Accessibility: Alert message added for message delete

Fixes: CNVS-12802

An alert message was needed to inform screen readers
that the message was deleted. I decided to go with
both audio and visual alert, but this can be easily
changed to just audio if it's decided that the
visual notification in unnecessary.

Test-Plan:
Using a screenreader
1.) Navigate to conversations
2.) Delete a message
3.) Verify that an audible and visual alert exists

Change-Id: I68a54074df7eff2b9d04f3d99d6617a77208488c
Reviewed-on: https://gerrit.instructure.com/35883
Reviewed-by: Aaron Cannon <acannon@instructure.com>
Tested-by: Jenkins <jenkins@instructure.com>
QA-Review: Steven Shepherd <sshepherd@instructure.com>
Product-Review: Jayce Higgins <jhiggins@instructure.com>
Reviewed-by: Drew Bowman <dbowman@instructure.com>
change API docs sis_import_id to Integer

Test Plan:
- JSON generated files from "rake doc:api" should not have an
  "Int64" type in the sis_import_id field of the User model.
  (It should have an Integer type and an Int64 format, however)

Fixes SIS-313

Change-Id: I21fa94dab8df3499c2911ee76865be04c83e9ccb
Reviewed-on: https://gerrit.instructure.com/35918
Tested-by: Jenkins <jenkins@instructure.com>
Reviewed-by: Eric Adams <eadams@instructure.com>
Product-Review: Eric Adams <eadams@instructure.com>
Reviewed-by: Ken Romney <kromney@instructure.com>
QA-Review: Jeremy Putnam <jeremyp@instructure.com>
Accessibility: Announcement actions are always visible to screen reader users

Fixes CNVS-12851

Test plan:
- Create multiple announcements.
- With a screen reader, load or reload the announcements page.
- Verify that the delete and lock buttons are visible to screen reader users
  before any boxes are checked.
- Verify that these buttons also remain visible, no matter how many or few
  announcements are or aren't checked.
- Verify that these buttons are reported as disabled when no announcements are
  checked

Change-Id: Id77e00acbb8fc2b4d713f542bc017695ed171f2a
Reviewed-on: https://gerrit.instructure.com/35543
Reviewed-by: Joel Hough <joel@instructure.com>
QA-Review: Steven Shepherd <sshepherd@instructure.com>
Product-Review: Aaron Cannon <acannon@instructure.com>
Tested-by: Jenkins <jenkins@instructure.com>
allow report titles to be translatable

refs CNVS-3134

test plan
 - go to /accounts/self/settings#tab-reports
 - titles should be translatable

Change-Id: I32d47572929a729e1d5f9dc0a2f20a229005fcca
Reviewed-on: https://gerrit.instructure.com/35827
Tested-by: Jenkins <jenkins@instructure.com>
Reviewed-by: Cody Cutrer <cody@instructure.com>
Product-Review: Rob Orton <rob@instructure.com>
QA-Review: Rob Orton <rob@instructure.com>
translate report titles

fixes CNVS-3134

test plan
 - go to /accounts/self/settings#tab-reports
 - titles should be translatable

Change-Id: I62646bf92fc444bd3166d258566fbd0dc5b2f9c6
Reviewed-on: https://gerrit.instructure.com/34562
Reviewed-by: Nick Cloward <ncloward@instructure.com>
QA-Review: August Thornton <august@instructure.com>
Tested-by: Jenkins <jenkins@instructure.com>
Product-Review: Rob Orton <rob@instructure.com>
insert show rubric link into ember quiz show menu

closes CNVS-12574

test plan:
  - enable ember quizzes
    - as instructor navigate to quiz show
    - click dropdown cog in top right
      - click Show Rubric in dropdown menu
    - rubric modal should display and work as before
      - add a rubric
      - edit a rubric
      - delete a rubric
      - find a rubric
      - 'use this rubric' from find a rubric
  - disable ember quizzes
    - verify that previous quizzes rubric modal continues to function
    - verify that assignment rubrics continue to function correctly
    - verify that rubrics index / edit / delete / create continue to
      work
Change-Id: Iaf1543dd4f5ee6f0ee4ef5ad44165a6fccfa7867
Reviewed-on: https://gerrit.instructure.com/35303
Reviewed-by: Derek DeVries <ddevries@instructure.com>
Tested-by: Jenkins <jenkins@instructure.com>
QA-Review: Trevor deHaan <tdehaan@instructure.com>
Product-Review: Jason Madsen <jmadsen@instructure.com>
change 'assignment' to 'graded_quiz' in quizzes overview

fixes CNVS-13472
This commit changes the wording of an 'assignment' type from 'Assignment' to 'Graded Quiz'

Test plan
- Create a quiz with a 'graded quiz' type
- Go to the Ember quizzes overview page for that quiz
- The quiz type should display as 'Graded Quiz'

Change-Id: I54db923a5e3df667a9719e54c196aaa2492f64ef
Reviewed-on: https://gerrit.instructure.com/36011
Tested-by: Jenkins <jenkins@instructure.com>
Reviewed-by: Derek DeVries <ddevries@instructure.com>
QA-Review: Trevor deHaan <tdehaan@instructure.com>
Product-Review: Josh Simpson <jsimpson@instructure.com>
add course_home_sub_navigation extension to external tools

this puts lti app links on the right side bar of the course
home page.

fixes RAN-53, RAN-55

test plan:
 - modify an lti app's xml to include the
   course_home_sub_navigation extension
 - configure an lti app via modified xml
 - navigate to a course home page, where you should see a button
   for the configured tool on the right sidebar.
 - clicking on the button should launch the tool.
 - configure another tool the same way, but include a
   "visibility" property in new extension with a value of
   "admins"
 - view the course home page as a teacher. you should be able
   to tee the newly configured tool, in addition to the
   previously configured tool.
 - view the course home page as a student. you should only see
   the first tool you configured, and not see the tool with the
   limited visibility property.

Change-Id: Ibe50c649f6d5f6806a87f0c8e8402f1209b9ed40
Reviewed-on: https://gerrit.instructure.com/35161
Reviewed-by: Brad Humphrey <brad@instructure.com>
Tested-by: Jenkins <jenkins@instructure.com>
QA-Review: Nathan Rogowski <nathan@instructure.com>
Product-Review: Jon Willesen <jonw@instructure.com>
set content container height to 100 percent

CNVS-13397

this fixes a selenium spec regression

Change-Id: I03eb42d68779c881dcc1a8e57df7122adaf07289
Reviewed-on: https://gerrit.instructure.com/35751
Tested-by: Jenkins <jenkins@instructure.com>
Reviewed-by: Ryan Florence <ryanf@instructure.com>
Product-Review: Drew Bowman <dbowman@instructure.com>
QA-Review: Drew Bowman <dbowman@instructure.com>
live assessments api

fixes CNVS-12916

test plan
- as a teacher in a course, use the api to create a live
 assessment aligned with an outcome (see the api docs for how the
 endpoint works)
- create results for some students
- ensure that the results and the assessment can be read back using
 the index endpoints
- ensure that the assessment shows up in the web ui at
 /course/:course_id/outcomes/users/:student_id (click 'Show All
 Artifacts')

- try to create an assessment using the same key as an existing
 assessment
- ensure that the existing assessment is returned (check the id)

- fetch results specifying a user id to filter by
- ensure that only results for that user are returned

Change-Id: I2d09691f772658aea3ccdd36cff2df5835b1f2cd
Reviewed-on: https://gerrit.instructure.com/35092
Reviewed-by: Ethan Vizitei <evizitei@instructure.com>
Tested-by: Jenkins <jenkins@instructure.com>
QA-Review: Steven Shepherd <sshepherd@instructure.com>
Product-Review: Derrick Hathaway <derrick@instructure.com>
dup Assignment#create API docs to #update

The Assignment#update API method needs to have arguments so that
the auto-generated Pandarus gem can know what to send to Canvas.

Test Plan:
- Docs for "Edit an assignment" should have same args as "Create
  an assignment"

Fixes SIS-314

Change-Id: If50e40ee345a6a41b8a45368ed77b65f1b364e80
Reviewed-on: https://gerrit.instructure.com/35942
Reviewed-by: Simon Williams <simon@instructure.com>
Tested-by: Jenkins <jenkins@instructure.com>
Product-Review: Eric Adams <eadams@instructure.com>
QA-Review: Jeremy Putnam <jeremyp@instructure.com>
conversations: never send replies by email to multiple recipients

fixes CNVS-13377

test plan:
  * set up reply-by-email
  * open a group conversation from old conversations
  * send a message as one of the participants to all others
  * reply by email to the message
  * verify that the reply is sent only to the author

Change-Id: I0aac2e2137153cbc18b08ef234235f677564323f
Reviewed-on: https://gerrit.instructure.com/35729
Tested-by: Jenkins <jenkins@instructure.com>
Reviewed-by: Drew Bowman <dbowman@instructure.com>
Product-Review: Marc LeGendre <marc@instructure.com>
QA-Review: Marc LeGendre <marc@instructure.com>
cleanup unused report stuff

refs CNVS-3134

test plan
 - specs should pass

Change-Id: I7eea877609c50e4014c1b80a085c3fba33b32ced
Reviewed-on: https://gerrit.instructure.com/36069
Product-Review: Rob Orton <rob@instructure.com>
QA-Review: Rob Orton <rob@instructure.com>
Tested-by: Jenkins <jenkins@instructure.com>
Reviewed-by: Cody Cutrer <cody@instructure.com>
learning mastery student view: alignment dialog

fixes CNVS-10900; fixes CNVS-13243

test plan:
  * open learning mastery student view
  * verify that alignments links are present on each outcome
  * click on an alignments link
  * verify that the alignment results for that student and outcome are displayed

Change-Id: Iba3f7166264725de2b664623a6f38a994947318d
Reviewed-on: https://gerrit.instructure.com/35982
Tested-by: Jenkins <jenkins@instructure.com>
Reviewed-by: Drew Bowman <dbowman@instructure.com>
QA-Review: Steven Shepherd <sshepherd@instructure.com>
Product-Review: Braden Anderson <banderson@instructure.com>
pass all overrides to current_override_version

when the assignment (or quiz) is a past version, it may have been
overridden by an override that was active then, but deleted now. don't
filter it out (based on deleted now) before letting
current_override_version look at it.

Change-Id: I072d24773a43f0ebfac6c463b5a820b553f056a3
Reviewed-on: https://gerrit.instructure.com/35116
Reviewed-by: Liz Abinante <labinante@instructure.com>
Tested-by: Jenkins <jenkins@instructure.com>
QA-Review: Amber Taniuchi <amber@instructure.com>
Product-Review: Simon Williams <simon@instructure.com>
protect against previously-run switchman migration

Change-Id: I8ef069aa61132d1d5772b3814f478d041dfd08a8
Reviewed-on: https://gerrit.instructure.com/36002
Tested-by: Jenkins <jenkins@instructure.com>
Reviewed-by: Jeff Belser <jbelser@instructure.com>
Product-Review: Brian Palmer <brianp@instructure.com>
QA-Review: Brian Palmer <brianp@instructure.com>
ensure common context_stream_item_key between rails 2 and 3

fixes a problem where context stream items were not being
invalidated correctly for rails 3

test plan:
* set up an environment with a server running with rails 3
and delayed_jobs running with rails 2, and a redis cache store
* create a published course with an active student
* create an publish a new assignment
* confirm that the "recent activity" dashboard on the course
 shows the new assignment message for the student

fixes #CNVS-13205

Change-Id: I763d0d09c0c4b092b740f8b7a1e374cd954a5f16
Reviewed-on: https://gerrit.instructure.com/36034
Reviewed-by: Cody Cutrer <cody@instructure.com>
Tested-by: Jenkins <jenkins@instructure.com>
QA-Review: Clare Strong <clare@instructure.com>
Product-Review: Clare Strong <clare@instructure.com>
spec: fix UserObserver test not to require plugin

test plan: spec/models/user_observer_spec.rb should pass
without proprietary Instructure plugins installed

fixes CNVS-13517

Change-Id: Ibf017dbe067b0dbc70212773c053d0934f60a3ce
Reviewed-on: https://gerrit.instructure.com/36086
Reviewed-by: Bracken Mosbacker <bracken@instructure.com>
QA-Review: Bracken Mosbacker <bracken@instructure.com>
Tested-by: Jenkins <jenkins@instructure.com>
Product-Review: Jeremy Stanley <jeremy@instructure.com>