use SSL-only flag on CSRF cookie

fixes CNVS-16884

test-plan:
 - in HTTP-session environment (`secure: false` or unset in
   config/session_store.yml), CSRF cookie should be sent without secure
   flag

 - in HTTPS-session environment (`secure: true` in
   config/session_store.yml), CSRF cookie should be sent with secure
   flag.

 - on a non-files host, javascript should be able to read the CSRF
   cookie: value of "document.cookie" in javascript console should
   include "_csrf_token"

 - on a files host, javascript should not be able to read the CSRF
   cookie: value of "document.cookie" in javascript console should not
   include "_csrf_token"

Change-Id: Ifd57c973478a6d07497a404dcf1a9b9caa9014af
Reviewed-on: https://gerrit.instructure.com/44451
Reviewed-by: Cody Cutrer <cody@instructure.com>
Reviewed-by: Rob Orton <rob@instructure.com>
QA-Review: August Thornton <august@instructure.com>
Tested-by: Jenkins <jenkins@instructure.com>
Product-Review: Cody Cutrer <cody@instructure.com>
do some preloads in ExternalFeedAggregator

this vastly improves performance when a root account has been deleted

also fix problem where skipped courses would cause the loop to run
indefinitely

Change-Id: I9c8ae5b1901abe5f59f3011ec8f433f06d7671b9
Reviewed-on: https://gerrit.instructure.com/44654
Tested-by: Jenkins <jenkins@instructure.com>
Reviewed-by: Jacob Fugal <jacob@instructure.com>
Product-Review: Cody Cutrer <cody@instructure.com>
QA-Review: Cody Cutrer <cody@instructure.com>
Implement PostGrades dialog in ReactJS

Replaces the PostGradesModel and PostGradesDialog with functional
ReactJS code.

- more visual feedback for users during correction step:
  - green check mark when whole row/assignment is good
  - uses an "ignore" (minus) icon instead of an X
  - rows stay on page, even after corrected (allowing
    users to correct any mistakes during data entry)
  - when name is not unique a visual hint is shown:
    "The assignment name must be unique"
  - "Ignore All" button is now "Ignore These" since it
    pertains to uncorrected rows, rather than all rows
  - "Ignore All" button becomes "Continue" button after
    all corrections have been made
  - calendar datepicker no longer freezes / has issues
  - when the user has fixed all assignments with errors,
    the title becomes: "No Assignments with Errors, click
    Continue"
  - if the user ignores a single assignment (with the
    minus "-" button) he/she can restore the assignment
    by editing the assignment name or due date

- corrected assignments (names, due dates) are now saved
  all at once when the user presses "Continue" (or "Ignore
  These" if he/she wants to ignore remaining issues)

- the gradebook "Post Grades" button that opens the dialog:
  - appears when selecting a section with an SIS ID, and
    disappears when the section has no SIS ID
  - is now styled like other buttons

- when closing the dialog and re-opening, the dialog
  returns to the "correction" step

- ungraded submissions message on the summary page if
  one or more students have submitted work but the teacher
  has not yet graded it
  - clicking the ungraded submissions message/link takes
    the user to a screen showing ungraded submissions
    that are clickable (takes the user to speedgrader)

Fixes SIS-646
Fixes SIS-654

Change-Id: I464fc85a3b96e5051bdad078e4483d979cfaf3e0
Reviewed-on: https://gerrit.instructure.com/44491
Tested-by: Jenkins <jenkins@instructure.com>
Reviewed-by: Ken Romney <kromney@instructure.com>
QA-Review: Jeremy Putnam <jeremyp@instructure.com>
Product-Review: Cosme Salazar <cosme@instructure.com>
Cleanup the outcomes controller a bit to make it easier to read through

This cleans up the code, reorganizes it a bit, updates some stale
comments, adds some new comments, and follows the 'return unless
authorized' pattern which replaces the deeply nested if blocks.  So
something like this:

Instead of:

    def my_method
        if authorized_action(@context, @current_user, :read)
            code_line 1
            code_line 2
            if authorized_action(@context, @current_user, :write)
                code_line 3
            end
        end
    end

We get:

    def my_method
        return unless authorized_action(@context, @current_user, :read)
        code_line 1
        code_line 2
        return unless authorized_action(@context, @current_user, :write)
        code_line 3
    end

Fixes CNVS-16963

Test Plan:

    Make sure that all of this works:
        - Create an outcome group
        - Create an outcome in that group
        - Create more groups and outcomes and make sure they can be
          connected
            - An outcome can belong to more than one group
        - Edit an outcome
        - Delete an outcome

    Make sure that the above all fail when unauthorized


Change-Id: I31c8791cb1bbbe004462b0720f221eded0e95932
Reviewed-on: https://gerrit.instructure.com/44633
Reviewed-by: Mike Nomitch <mnomitch@instructure.com>
Tested-by: Jenkins <jenkins@instructure.com>
QA-Review: Sean Lewis <slewis@instructure.com>
Product-Review: Benjamin Porter <bporter@instructure.com>
Quiz Test Take Page

Fixes: CNVS-15527

Notes:
- updated colors to meet contrast requirements
- updated answer sprites
- added 2x sprite for flagged question

Test Plan
- log in as student
	- navigate to quizzes
	- start a quiz
		- flag a question
	- verify all contrast for both default and high contrast
		- reference attached screenshots in jira
		- use http://webaim.org/resources/contrastchecker/

Change-Id: Iaaf63e2c323fa90150cc45635c441294f05dda27
Reviewed-on: https://gerrit.instructure.com/42194
Reviewed-by: Chris Hart <chart@instructure.com>
Tested-by: Jenkins <jenkins@instructure.com>
QA-Review: Nathan Rogowski <nathan@instructure.com>
Product-Review: Colleen Palmer <colleen@instructure.com>
Update Diigo API URL

test plan
 - verify you can set up the diigo plugin with the information in gollum https://gollum.instructure.com/OtherServiceTestAccounts
 - on the user settings page, verify you can use your diigo username and password to register the service

Change-Id: I78fb9614f03a51a8e0d11ac806a49a7a85e8e2f7
Reviewed-on: https://gerrit.instructure.com/44379
Tested-by: Jenkins <jenkins@instructure.com>
Reviewed-by: Jeremy Stanley <jeremy@instructure.com>
QA-Review: Clare Strong <clare@instructure.com>
Product-Review: Mysti Sadler <mysti@instructure.com>
Updated en-AU translation

Change-Id: I26fd0c72b0e7a8baf9e6310ab651d9afaf3fded1
Updated ja translation

Change-Id: Ic44978a4a8e9021d9d7fd7e7b031d6c5f697d7c7
Updated pl translation

Change-Id: If18e4e6f22a6fcd82126bc8990f36873704e03f7
Updated zh translation

Change-Id: Id364fcb52643f3f68d10c805b63cef6afc401942
fix rack-mini-profiler initialization

The call to initialize! at the bottom of the file was wiping out all of
the configuration done above. This commit avoids calling initialize! at
all, since it does some silly stuff like creating a tmp dir even when in
redis mode.

test plan: you should be able to enable the profiler with ?pp=enable as
a site admin, and view the UI. it should use redis if you have it
configured, and shouldn't appear to non-siteadmins.

Change-Id: I4ef0d3cb125aabb344f7649b6ce47275c5bb6e67
Reviewed-on: https://gerrit.instructure.com/44653
Reviewed-by: Cody Cutrer <cody@instructure.com>
Tested-by: Jenkins <jenkins@instructure.com>
QA-Review: August Thornton <august@instructure.com>
Product-Review: Brian Palmer <brianp@instructure.com>
Correct sorting for numerically named groups

fixes CNVS-14327

Followed the tutorial at: https://gollum.instructure.com/sorting. Used
the database level solution

Groups sort first by group category name and then by group name both on
the server side and the client side.

Updated app/coffeescripts/util/natcompare.coffee because when the tests in
public/javascripts/compiled/ember/student_groups/tests/controllers/student_groups_controller.spec.js
one fails because window.I18n.locale is not defined or is null. Hence I
added a default of 'en-US'.

Added spec for server side sorting check.

Test Plan:
* Create a group set and add groups named 1-9, 10, 110, 28 and whatever
  other numbers you want
* Notice as a teacher that the groups are naturally ordered meaning that
  10 and 110 don't come directly after 1 for example

* Next, login as a student and verify that groups are naturally ordered

* Then on the account level, enable the new student groups option
* As a student go back to the groups page and verify that the ordering
  is natural on the new students group page

* Groups get pulled down from the server in groups of 50. I would
  suggest creating two group sets with the names 1 and 2. Add a couple
  groups to group set 1, then add 50+ groups to group set 2, and then
  add a couple more groups to group set 1 but that would come after the
  groups in group set 1. Then check to make sure that when the page
  loads all of group set 1's groups appear at the top of the page in the
  correct order.

Change-Id: Ie066abd3cef237fd8c8c0f73231cea0177756e21
Reviewed-on: https://gerrit.instructure.com/43565
Tested-by: Jenkins <jenkins@instructure.com>
Reviewed-by: Braden Anderson <braden@instructure.com>
QA-Review: Steven Shepherd <sshepherd@instructure.com>
Product-Review: Janelle Seegmiller <jseegmiller@instructure.com>
Fixes restricted access labels

Changes "Available from ..." to
"Available after ..." to more correctly
convey what is actually happening.

fixes CNVS-16933, CNVS-16937

Test Plan:
* Enable "Better File Browing" feature flag
* Go to any course's Files page as a teacher
* Click on an item in the File Pane and click
  "Restrict Access" on the toolbar that appears
* Select radio button "Restricted Access", then
  select radio button "Schedule student availability"
* Two text boxes should appear with labels "Lock After"
  and "Lock Until"
* Select a "Lock After" date and click "Update"
* Hover over the item's Calendar icon in the File Pane
* It should read "Available after ..." with whatever
  date you selected.
* Repeat the last three steps with "Lock Until" (and "Lock After"
  left blank), noticing it should now say "Available until ..."
* Repeat previous step with both a "Lock After" and "Lock Until"
  date selected, expecting "Available after (Lock After Date) until (Lock Until Date)"

Change-Id: I400001dd98eaf8c108cc542aa9fd2bb5c31966c9
Reviewed-on: https://gerrit.instructure.com/44605
Tested-by: Jenkins <jenkins@instructure.com>
Reviewed-by: Clay Diffrient <cdiffrient@instructure.com>
Product-Review: Cosme Salazar <cosme@instructure.com>
QA-Review: Jahnavi Yetukuri <jyetukuri@instructure.com>
DA - update gb cells on the fly

fixes CNVS-16565

test plan:
 * setup DA
 * setup an assignment that is only visible to two sections
 * grade all of a student's submissions so that he has a 100% in the class.
 - remove that student's section from the list of overrides on the assignment
 - navigate to gb
 - remove the student's grade for that assignment
 > the cell should be grayed out
 > the student's grade should still be a 100%
 - repeat the above with 'treat ungraded as 0' turned on

 * using all the api endpoints that return assignment submissions
   - including by not limited to:
     submit an assignment, index, show, grade a submission
 * include 'include[]=visibility' in the request
 > each submission object returned should have an 'assignment_visible' attribute
   which should match whether the submitter has visibility

Change-Id: I6eb5324ea5b96738cc40fb2446fc4bc96db094c5
Reviewed-on: https://gerrit.instructure.com/43618
Tested-by: Jenkins <jenkins@instructure.com>
Reviewed-by: Mike Nomitch <mnomitch@instructure.com>
QA-Review: Sean Lewis <slewis@instructure.com>
Product-Review: Hilary Scharton <hilary@instructure.com>
fixed speedgrader bug that showed student names when "hide student names" was on

fixes CNVS-1432

test plan:
- create a graded discussion, graded group discussion, url submission, and quiz
- update discussion with entries from students, as well as entries from teacher
- submit quiz and url submission as student
- go to speedgrader
- with hide student names disabled, names should appear as normal on discussions
quiz, and url submission
- enable option to hide student names, references to student should change to
'this student' on the discussion, quiz, and url submission
- other students/teachers on the discussion should be labelled as "discussion participant"
- the grading teacher that participated in the discussion should still have their
name appear on their discussion entries
- avatars should be hidden
- above should be true for both discussion links that appear on speedgrader

Change-Id: I23e42b3c4aaccd0a3454bfbf1dca04d9e79caf38
Reviewed-on: https://gerrit.instructure.com/41860
Tested-by: Jenkins <jenkins@instructure.com>
QA-Review: Adam Stone <astone@instructure.com>
Reviewed-by: Cameron Matheson <cameron@instructure.com>
Product-Review: Hilary Scharton <hilary@instructure.com>
don't leak course objects during enrollment import

refs SIS-514

test-plan:
 - regression on SIS enrollment imports
   - particularly, that courses imported into get "touched"
 - start large enrollment import (~100k enrollments)
   - monitor job process memory (e.g. with top)
   - shouldn't climb while importing enrollments

Change-Id: I12ce16a0c86056f3588671140cb9a9fde5db85ce
Reviewed-on: https://gerrit.instructure.com/44703
Reviewed-by: Rob Orton <rob@instructure.com>
QA-Review: Jeremy Putnam <jeremyp@instructure.com>
Tested-by: Jenkins <jenkins@instructure.com>
Product-Review: Jacob Fugal <jacob@instructure.com>
add external integration keys

refs: CNVS-16627

First part is to add the framework for tracking external keys.  This
commit handles the ability to add multiple types easily to the
external_integration_keys with custom rights per type of key.

Test Plan:
 - Make sure the section for External Integration Keys does not display
   when no types are set.
 - Add a few custom types to the external integration keys with all
   combinations of write and read rights.
 - Make sure you can edit the appropriate keys inside the account
   settings page and that they are persistent.
 - Remove a value from a key and it should delete the appropriate
   record.
 - If the user does not have access to any keys the section should not
   display.

Change-Id: I37d56c3ee1bf44876c220e9d5a1ae80a22ac1289
Reviewed-on: https://gerrit.instructure.com/44161
Reviewed-by: Cody Cutrer <cody@instructure.com>
Tested-by: Jenkins <jenkins@instructure.com>
QA-Review: August Thornton <august@instructure.com>
Product-Review: Colleen Palmer <colleen@instructure.com>
QLA - QuestionAnswered

Support for extracting and recording "question_answered" events from
submission_data. Unlike the other event patches, this takes place
completely on the back-end.

Closes CNVS-16802

Other things:

  - refactored stuff to use QuizSubmission#graded?
  - QuizQuestion::AnswerSerializers now output string IDs

TEST PLAN
---- ----

You need a database browser for this, like pgadmin3 [1].

Preparation:

  - create a quiz with ALL question types
  - using pgadmin3, view the data in the quiz_submission_events_2014_XX
    table (XX would be the current month), keep this window open
    + this window should be empty so far, unless you're repeating this
      plan

  - go to take quiz page
  - do anything useful to trigger the initial backup call:
    + verify that there's a new record with "event_type" is
      "question_answered"
    + grab the "event_data" in that column and paste it in some JSON
      editor like http://jsoneditoronline.org/ [2]
    + verify that this data-set includes the initial answers for ALL
      questions

Ok, now we need to test whether each answer we update gets recorded:

  - in any question, change your answer
  - open the pgadmin3 table window
    + refresh, press F5
    + verify there's a new event record
    + copy/paste the "event_data" in the JSON editor and:
      - verify that not ALL the answers were recorded again, ONLY the
        one that you have just added/changed/updated

Rinse and repeat with the rest of the questions. Make sure that answers
to *all* question types are being recorded (this includes File Upload,
in which case the value would be the attachment ID.)

[1] pgadmin3 works on all platforms, download it for OS X from
    http://www.pgadmin.org/download/macosx.php
[2] when copying from pgadmin3, it may wrap the JSON with '' and that
    will cause an error in the editor, just remove those quotes

Change-Id: I3330bd987396aa84937af295390ec169b06c58e9
Reviewed-on: https://gerrit.instructure.com/44335
Reviewed-by: Derek DeVries <ddevries@instructure.com>
Tested-by: Jenkins <jenkins@instructure.com>
QA-Review: Trevor deHaan <tdehaan@instructure.com>
Product-Review: Ahmad Amireh <ahmad@instructure.com>
raise exception if a quiz submission doesn't save successfully during generation

fixes CNVS-16463

test plan:
  - as a teacher
    - create a quiz
  - as a student
    - you should be able to successfully take the quiz

Change-Id: I233d093b9c45217de488a933ebe65b75b44e9d16
Reviewed-on: https://gerrit.instructure.com/44482
Tested-by: Jenkins <jenkins@instructure.com>
Reviewed-by: Ryan Taylor <rtaylor@instructure.com>
QA-Review: Trevor deHaan <tdehaan@instructure.com>
Product-Review: Derek DeVries <ddevries@instructure.com>
Updated fr translation

Change-Id: I3539e7d087473f551fe3b56ee64a6c25faedd434