canvas-lms/Gemfile

192 lines
6.1 KiB
Ruby
Raw Normal View History

source 'https://rubygems.org/'
2011-02-01 09:57:29 +08:00
if RUBY_VERSION < "1.9.3" || RUBY_VERSION >= "2.0"
raise "Canvas requires Ruby 1.9.3"
end
require File.expand_path("../config/canvas_rails3", __FILE__)
if CANVAS_RAILS3
# 3.0.20 is transitional, we will be on 3.2.x before support is complete
# that's also why some gems below have to be downgraded, 3.0.20 relies on old versions of some gems
# just to be clear, Canvas is NOT READY to run under Rails 3 in production
gem 'rails', '3.0.20'
gem 'authlogic', '3.2.0'
else
# If you have a license to rails lts, you can create a vendor/plugins/*/RAILS_LTS yaml file
# with the Gemfile `gem` command to use (pointing to the private repo with your username/password).
# Otherwise, the free community version of rails lts will be used.
lts_file = Dir.glob(File.expand_path("../vendor/plugins/*/RAILS_LTS", __FILE__)).first
if lts_file
eval(File.read(lts_file))
else
gem 'rails', :git => 'https://github.com/makandra/rails.git', :branch => '2-3-lts', :ref => 'e86daf8ff727d5efc0040c876ba00c9444a5d915'
end
gem 'authlogic', '2.1.3'
end
gem "aws-sdk", '1.8.3.1'
multi-factor authentication closes #9532 test plan: * enable optional MFA, and check the following: * normal log in should not be affected * you can enroll in MFA from your profile page * you can re-enroll in MFA from your profile page * you can disable MFA from your profile page * MFA can be reset by an admin on your user page * when enrolled, you are asked for verification code after username/password when logging in * you can't access any other part of the site directly until until entering your verification code * enable required MFA, and check the following * when not enrolled in MFA, and you log in, you are forced to enroll * you cannot disable MFA from your profile page * you can re-enroll in MFA from your profile page * an admin (other than himself) can reset MFA from the user page * for enrolling in MFA * use Google Authenticator and scan the QR code; you should have 30-seconds or so of extra leeway to enter your code * having no SMS communication channels on your profile, the enrollment page should just have a form to add a new phone * having one or more SMS communication channels on your profile, the enrollment page should list them, or allow you to create a new one (and switch back) * having more than one SMS communication channel on your profile, the enrollment page should remember which one you have selected after you click "send" * an unconfirmed SMS channel should go to confirmed when it's used to enroll in MFA * you should not be able to go directly to /login/otp to enroll if you used "Remember me" token to log in * MFA login flow * if configured with SMS, it should send you an SMS after you put in your username/password; you should have about 5 minutes of leeway to put it in * if you don't check "remember computer" checkbox, you should have to enter a verification code each time you log in * if you do check it, you shouldn't have to enter your code anymore (for three days). it also shouldn't SMS you a verification code each time you log in * setting MFA to required for admins should make it required for admins, optional for other users * with MFA enabled, directly go to /login/otp after entering username/password but before entering a verification code; it should send you back to the main login page * if you enrolled via SMS, you should not be able to remove that SMS from your profile * there should not be a reset MFA link on a user page if they haven't enrolled * test a login or required enrollment sequence with CAS and/or SAML Change-Id: I692de7405bf7ca023183e717930ee940ccf0d5e6 Reviewed-on: https://gerrit.instructure.com/12700 Tested-by: Jenkins <jenkins@instructure.com> Reviewed-by: Brian Palmer <brianp@instructure.com>
2012-08-03 05:17:50 +08:00
gem 'barby', '0.5.0'
make "stay logged in" use a one-time token closes #6382 Previously, the "stay logged in" cookie just used the authlogic default implementation, which is the pseudonym persistence_token. This is a problem, because that persistence_token only ever changes when the pseudonym password changes, so it's the same everywhere; so if that cookie is stolen, it's valid for a very long time. This switches us to one-time-use tokens that expire as soon as the token logs the user in once. Each user agent also gets a different one-time-use token. Change-Id: I4f20cd7759fd74590e82ed55797552e342243d49 testplan: * Check that no token is set at all when "stay logged in" isn't selected. * Check "stay logged in", and verify: * That you don't have to login again after restarting your browser, but your _normandy_session got reset. * That if you save and try to replay using the same pseudonym_credentials, they don't work the second time. * That a second browser will get a different pseudonym_credentials value, and using one token doesn't affect the other. * That once the token is used, a new one is generated and set in your cookies. Verify this new token works as well. * That logging out removes the pseudonym_credentials cookie in your browser. And also that manually restoring this cookie still doesn't log you in, since it was removed server-side as well. * Change your password, and verify that the existing "stay logged in" tokens no longer work. * Delete your pseudonym, and verify the same. Reviewed-on: https://gerrit.instructure.com/7093 Tested-by: Hudson <hudson@instructure.com> Reviewed-by: Cody Cutrer <cody@instructure.com> Reviewed-by: Zach Wily <zach@instructure.com>
2011-11-22 05:20:48 +08:00
gem 'bcrypt-ruby', '3.0.1'
2011-02-01 09:57:29 +08:00
gem 'builder', '2.1.2'
if !CANVAS_RAILS3
gem 'canvas_connect', '0.1.1'
end
2011-02-01 09:57:29 +08:00
gem 'daemons', '1.1.0'
gem 'diff-lcs', '1.1.3', :require => 'diff/lcs'
if !CANVAS_RAILS3
gem 'encrypted_cookie_store-instructure', '1.0.4', :require => 'encrypted_cookie_store'
end
gem 'erubis', CANVAS_RAILS3 ? '2.6.6' : '2.7.0'
if !CANVAS_RAILS3
gem 'fake_arel', '1.0.0'
end
gem 'fake_rails3_routes', '1.0.4'
gem 'ffi', '1.1.5'
gem 'hairtrigger', '0.2.3'
Fully adopt Bootstrap & update css to work with it, closes: #CNVS-1344 this commit does the following: * upgrade bootstrap-sass gem to most recent version * switches to using bootstrap's normalize.css and forms.css which fixes a whole bunch of misformatting of how bootstrap stuff is supposed to look, but changing those 2 affects a lot of our old stylesheets. * gets rid of unified_buttons.sass and just uses bootstraps buttons. .ui-button @extends these because we still have to support .ui-button for modals & buttonsets. but .button is no longer supported. * a lot of css file reorganization (there's no more 'blue' and 'normal canvas', there's just canvas) * a bunch of files had to be tweaked to look good with these changes. test plan: This change touches every page in canvas so, no kidding, we need to make sure every page looks OK. In order to do that: 1. each sprint team needs to give a +1 after they make sure all the pages in the features they are over look good. 2. the QA person on each team needs to look at the pages for their teams features for a QA +1 things to look for specifically when testing: * buttons: this gets rid of all those red 'cancel' links that are actually buttons, make sure all the buttons you see look right. if you see 2 plain gray buttons next to each other like [Save] [Cancel], we should make the primary one blue (by adding the .btn-primary class) * Forms: a lot of this change has to do with how form elements look, especially <select>s, <input>s and <label>s. look at the diffs for the ones that have the most changes and make sure those look good, but also check for the ones I missed and make sure those look good too. * and just random style changes, if something looks ugly or broken (and it didn't before), we should fix that. Also: just use a link instead of a drop-menu for adding event from sidebar we used to have a drop down menu for adding events to cal2 from the sidebar where you'd hit a cog and it'd ask you if you wanted to add an event or an assignment. this just simplifies it to an add icon. this: http://cl.ly/image/133a2A3q3q1M instead of: http://cl.ly/image/46463o2s3W0g Change-Id: I384fe273934bca96bf28423afb1402c7792d8766 Reviewed-on: https://gerrit.instructure.com/15422 Tested-by: Jenkins <jenkins@instructure.com> Reviewed-by: Ryan Florence <ryanf@instructure.com> QA-Review: Ryan Florence <ryanf@instructure.com>
2012-12-21 14:46:28 +08:00
gem 'sass', '3.2.3'
gem 'hashery', '1.3.0', :require => 'hashery/dictionary'
gem 'highline', '1.6.1'
gem 'i18n', CANVAS_RAILS3 ? '0.5.0' : '0.6.0'
if !CANVAS_RAILS3
gem 'i18nema', '0.0.7'
end
gem 'icalendar', '1.1.5'
gem 'jammit', '0.6.6'
gem 'json', '1.8.0'
2011-02-01 09:57:29 +08:00
# native xml parsing, diigo
gem 'libxml-ruby', '2.6.0', :require => 'xml/libxml'
gem 'macaddr', '1.0.0' # macaddr 1.2.0 tries to require 'systemu' which isn't a dependency
gem 'mail', CANVAS_RAILS3 ? '2.2.19' : '2.5.3'
# using this forked gem until https://github.com/37signals/marginalia/pull/15 is in the source gem
gem 'instructure-marginalia', '1.1.3', :require => false
gem 'mime-types', '1.17.2', :require => 'mime/types'
2011-02-01 09:57:29 +08:00
# attachment_fu (even the current technoweenie one on github) does not work
# with mini_magick 3.1
gem 'mini_magick', '1.3.2'
gem 'netaddr', '1.5.0'
gem 'nokogiri', '1.5.6'
# oauth gem, with rails3 fixes rolled in
gem 'oauth-instructure', '0.4.9', :require => 'oauth'
gem 'rack', CANVAS_RAILS3 ? '1.2.5' : '1.1.3'
gem 'rake', '10.1.0'
gem 'rdoc', '3.12'
gem 'ratom-instructure', '0.6.9', :require => "atom" # custom gem until necessary changes are merged into mainstream
gem 'rdiscount', '1.6.8'
gem 'ritex', '1.0.1'
if CANVAS_RAILS3
gem 'routing_concerns', '0.1.0'
end
multi-factor authentication closes #9532 test plan: * enable optional MFA, and check the following: * normal log in should not be affected * you can enroll in MFA from your profile page * you can re-enroll in MFA from your profile page * you can disable MFA from your profile page * MFA can be reset by an admin on your user page * when enrolled, you are asked for verification code after username/password when logging in * you can't access any other part of the site directly until until entering your verification code * enable required MFA, and check the following * when not enrolled in MFA, and you log in, you are forced to enroll * you cannot disable MFA from your profile page * you can re-enroll in MFA from your profile page * an admin (other than himself) can reset MFA from the user page * for enrolling in MFA * use Google Authenticator and scan the QR code; you should have 30-seconds or so of extra leeway to enter your code * having no SMS communication channels on your profile, the enrollment page should just have a form to add a new phone * having one or more SMS communication channels on your profile, the enrollment page should list them, or allow you to create a new one (and switch back) * having more than one SMS communication channel on your profile, the enrollment page should remember which one you have selected after you click "send" * an unconfirmed SMS channel should go to confirmed when it's used to enroll in MFA * you should not be able to go directly to /login/otp to enroll if you used "Remember me" token to log in * MFA login flow * if configured with SMS, it should send you an SMS after you put in your username/password; you should have about 5 minutes of leeway to put it in * if you don't check "remember computer" checkbox, you should have to enter a verification code each time you log in * if you do check it, you shouldn't have to enter your code anymore (for three days). it also shouldn't SMS you a verification code each time you log in * setting MFA to required for admins should make it required for admins, optional for other users * with MFA enabled, directly go to /login/otp after entering username/password but before entering a verification code; it should send you back to the main login page * if you enrolled via SMS, you should not be able to remove that SMS from your profile * there should not be a reset MFA link on a user page if they haven't enrolled * test a login or required enrollment sequence with CAS and/or SAML Change-Id: I692de7405bf7ca023183e717930ee940ccf0d5e6 Reviewed-on: https://gerrit.instructure.com/12700 Tested-by: Jenkins <jenkins@instructure.com> Reviewed-by: Brian Palmer <brianp@instructure.com>
2012-08-03 05:17:50 +08:00
gem 'rotp', '1.4.1'
gem 'rqrcode', '0.4.2'
2011-02-01 09:57:29 +08:00
gem 'rscribd', '1.2.0'
gem 'net-ldap', '0.3.1', :require => 'net/ldap'
gem 'ruby-saml-mod', '0.1.22'
gem 'rubycas-client', '2.2.1'
gem 'rubyzip', '0.9.5', :require => 'zip/zip'
gem 'safe_yaml-instructure', '0.8.0', :require => false
gem 'sanitize', '2.0.3'
gem 'shackles', '1.0.0'
gem 'tzinfo', '0.3.35'
gem 'useragent', '0.4.16'
gem 'uuid', '2.3.2'
2011-02-01 09:57:29 +08:00
gem 'will_paginate', '2.3.15'
gem 'xml-simple', '1.0.12', :require => 'xmlsimple'
gem 'foreigner', '0.9.2'
gem 'crocodoc-ruby', '0.0.1', :require => 'crocodoc'
# needs https://github.com/regru/premailer/commit/8d3ae698eff135011b19e1587a68c399ec97b185
# we can go back to the gem once 1.7.8 is released
gem 'regru-premailer', :require => 'premailer', :git => "https://github.com/regru/premailer.git", :ref => "08a73c70701f5d81bc4a5cf6c959a45ad94db88e"
2011-02-01 09:57:29 +08:00
group :assets do
Fully adopt Bootstrap & update css to work with it, closes: #CNVS-1344 this commit does the following: * upgrade bootstrap-sass gem to most recent version * switches to using bootstrap's normalize.css and forms.css which fixes a whole bunch of misformatting of how bootstrap stuff is supposed to look, but changing those 2 affects a lot of our old stylesheets. * gets rid of unified_buttons.sass and just uses bootstraps buttons. .ui-button @extends these because we still have to support .ui-button for modals & buttonsets. but .button is no longer supported. * a lot of css file reorganization (there's no more 'blue' and 'normal canvas', there's just canvas) * a bunch of files had to be tweaked to look good with these changes. test plan: This change touches every page in canvas so, no kidding, we need to make sure every page looks OK. In order to do that: 1. each sprint team needs to give a +1 after they make sure all the pages in the features they are over look good. 2. the QA person on each team needs to look at the pages for their teams features for a QA +1 things to look for specifically when testing: * buttons: this gets rid of all those red 'cancel' links that are actually buttons, make sure all the buttons you see look right. if you see 2 plain gray buttons next to each other like [Save] [Cancel], we should make the primary one blue (by adding the .btn-primary class) * Forms: a lot of this change has to do with how form elements look, especially <select>s, <input>s and <label>s. look at the diffs for the ones that have the most changes and make sure those look good, but also check for the ones I missed and make sure those look good too. * and just random style changes, if something looks ugly or broken (and it didn't before), we should fix that. Also: just use a link instead of a drop-menu for adding event from sidebar we used to have a drop down menu for adding events to cal2 from the sidebar where you'd hit a cog and it'd ask you if you wanted to add an event or an assignment. this just simplifies it to an add icon. this: http://cl.ly/image/133a2A3q3q1M instead of: http://cl.ly/image/46463o2s3W0g Change-Id: I384fe273934bca96bf28423afb1402c7792d8766 Reviewed-on: https://gerrit.instructure.com/15422 Tested-by: Jenkins <jenkins@instructure.com> Reviewed-by: Ryan Florence <ryanf@instructure.com> QA-Review: Ryan Florence <ryanf@instructure.com>
2012-12-21 14:46:28 +08:00
gem 'compass-rails', '1.0.3'
gem 'dress_code', '1.0.2'
end
group :mysql do
gem 'mysql2', '0.2.18'
end
group :postgres do
gem 'pg', '0.15.0'
end
group :sqlite do
gem 'sqlite3-ruby', '1.3.2'
end
2011-02-01 09:57:29 +08:00
group :test do
gem 'simplecov', '0.7.1' if ENV['COVERAGE'] != nil && ENV['COVERAGE'] == "1" # for coverage reporting
gem 'bluecloth', '2.0.10' # for generating api docs
gem 'mocha', :git => 'git://github.com/ccutrer/mocha.git', :require => false
gem 'parallelized_specs', '0.4.64'
gem 'thin', '1.5.1'
if CANVAS_RAILS3
gem 'rspec-rails', '2.13.0'
else
gem 'rspec', '1.3.2'
gem 'rspec-rails', '1.3.4'
end
gem 'selenium-webdriver', '2.35.0'
gem 'webrat', '0.7.3'
gem 'yard', '0.8.0'
integrate yard-appendix plugin with canvas YARD cfg Useful things the commit brings: 1. Source documentation can now include images and out-of-source examples 2. Source documentation can now be supplemented by "appendixes" for documenting advanced or uncommon usage, auxiliary examples, or any supplementary content 3. An implementation of the YARD @see tag that utilizes the canvas YARD linkify helper Necessary changes for integration were: * Gemfile now includes 'yard-appendix' * Rake task for generating API docs (doc:api) made more readable and now supports asset migration (images and examples) * Canvas YARD 'api' template now handles :appendix sections provided by the plugin * Canvas YARD 'linkify' helper modified: * uses a shared linker to look up a topic and controller * overrides default handling of 'Appendix: ' links * defaults to using the @object title as the link body when no title was explicitly passed instead of the path.to.object * Canvas YARD 'fulldoc' handler respects a DOC_OPTIONS[:all_resource_appendixes] that when turned on would generate appendix entries in the All Resources section[1] [1] I've already implemented this functionality because I misread the requirement (as seen in PB 6) so I thought we could keep it around and toggle it if need be. The options are inside lib/tasks/docs.rake --- Testing: To verify that the changes do not alter or affect the current API docs, fire up a terminal and do the following (inline comments for directions): ```bash cd /path/to/canvas; # generate the original docs before pulling these changes bundle exec rake doc:api mv public/doc public/doc_original # checkout these changes into a branch... after that: bundle install bundle exec rake doc:api diff -r -y -q public/doc_original/api public/doc/api ``` The output of the last command should look like this: Only in doc/api: examples Only in doc/api: images To test the actual @!appendix functionality: * see https://github.com/amireh/yard-appendix for directions on how to define Appendix entries * write an Appendix in any controller, optionally reference it in some method (using @see or {link}) * Appendix entry should be shown at the bottom of the controller's doc page * reference to the appendix entry should take you to it Alternatively, you can check-out the gerrit change 17454 at https://gerrit.instructure.com/#/c/17454/ which utilizes this functionality. Change-Id: Id667b77ff8d36b0f503e0f6752045e3d05bc3649 Reviewed-on: https://gerrit.instructure.com/17453 Tested-by: Jenkins <jenkins@instructure.com> Reviewed-by: Brian Palmer <brianp@instructure.com> QA-Review: Simon Williams <simon@instructure.com>
2013-02-05 14:35:51 +08:00
gem 'yard-appendix', '>=0.1.8'
gem 'timecop', '0.6.3'
gem 'test-unit', '1.2.3'
2011-02-01 09:57:29 +08:00
end
group :development do
gem 'guard', '1.8.0'
gem 'rb-inotify', '~>0.9.0', :require => false
gem 'rb-fsevent', :require => false
gem 'rb-fchange', :require => false
# Option to DISABLE_RUBY_DEBUGGING is helpful IDE-based debugging.
# The ruby debug gems conflict with the IDE-based debugger gem.
# Set this option in your dev environment to disable.
unless ENV['DISABLE_RUBY_DEBUGGING']
gem 'debugger', '1.5.0'
end
end
group :development, :test do
gem 'coffee-script'
gem 'coffee-script-source', '1.6.2' #pinned so everyone's compiled output matches
gem 'execjs', '1.4.0'
gem 'parallel', '0.5.16'
end
group :i18n_tools do
gem 'ruby_parser', '3.1.3'
gem 'sexp_processor', '4.2.1'
gem 'ya2yaml', '0.30'
2011-02-01 09:57:29 +08:00
end
group :redis do
gem 'instructure-redis-store', '1.0.0.2.instructure1', :require => 'redis-store'
gem 'redis', '3.0.1'
user request throttling Define the cost of a request as (user cpu + time spent in db queries), then store that using a leaky bucket algorithm in redis. The algorithm is slightly modified from a normal leaky bucket, see the comments in the code. The parameters (maximum, hwm, outflow) are configurable Settings. Because this code path is hit on every request, I've tried to keep the added latency to a minimum. Uses lua scripting in redis to avoid the latency of an extra round trip (two round trips with lua, one at the beginning of the request and one at the end, vs at least three without lua). closes CNVS-7008 test plan: * Given the default params, you're not going to ever hit the throttling limit without making multiple requests in parallel. Normally local dev environments won't process parallel requests, so you'll want to tweak the config params. * Setting.set('request_throttle.hwm', '2') * Setting.set('request_throttle.outflow', '0.1') * Make canvas http requests as a logged in user, and verify that after a few requests in quick succession, you get a 403 response. After waiting a second for your bucket to fall back below the threshold, you can make requests again. * Do the same using the api and sending your access token in the query string or http auth header. * This should work correctly with a clustered redis as well. * If possible it'd be good to test parallel requests as well. The code should handle this correctly and combine the cost of the parallel requests, rather than stomping on the values. Change-Id: I1fdfd4e009d81bd6525bcf45a93437f4c395f129 Reviewed-on: https://gerrit.instructure.com/24256 Tested-by: Jenkins <jenkins@instructure.com> Reviewed-by: Jacob Fugal <jacob@instructure.com> QA-Review: Jeremy Putnam <jeremyp@instructure.com> Product-Review: Brian Palmer <brianp@instructure.com>
2013-08-21 23:03:42 +08:00
gem 'redis-scripting', '1.0.1'
end
group :cassandra do
gem 'cassandra-cql', '1.1.5'
end
group :embedly do
gem 'embedly', '1.5.5'
end
group :statsd do
gem 'statsd-ruby', '1.0.0', :require => 'statsd'
end
group :icu do
gem 'ffi-icu', '0.1.2'
end
2011-02-01 09:57:29 +08:00
# Non-standard Canvas extension to Bundler behavior -- load the Gemfiles from
# plugins.
Dir[File.join(File.dirname(__FILE__),'vendor/plugins/*/Gemfile')].each do |g|
eval(File.read(g))
end