don't allow negative quiz question point values

test plan:
* should not be able to create a quiz question
with a negative point value

* import the package referenced in the ticket
* should not have questions with negative point values

closes #CNVS-19877

Change-Id: I184bf4705af59bfddfe6bce09c7930e0957dccd6
Reviewed-on: https://gerrit.instructure.com/52611
Tested-by: Jenkins
Reviewed-by: Dan Minkevitch <dan@instructure.com>
QA-Review: Clare Strong <clare@instructure.com>
Product-Review: Hilary Scharton <hilary@instructure.com>

app/models/importers/quiz_question_importer.rb

@@ -11,6 +11,7 @@ module Importers
       hash = aq_hash.dup
       hash[:position] = position
       hash[:points_possible] = qq_hash[:points_possible] if qq_hash[:points_possible]
+      hash[:points_possible] = 0 if hash[:points_possible].to_f < 0
 
       mig_id = qq_hash['quiz_question_migration_id'] || qq_hash['migration_id']
 

app/models/quizzes/quiz.rb

@@ -695,6 +695,7 @@ class Quizzes::Quiz < ActiveRecord::Base
       end
       e[:published_at] = t
     end
+    possible = 0 if possible < 0
     data = entries
     if opts[:persist] != false
       self.quiz_data = data

public/javascripts/quizzes.js

@@ -793,12 +793,12 @@ define([
       var tally = 0;
       $("#questions .question_holder:not(.group) .question:not(#question_new)").each(function() {
         var val = parseFloat($(this).find(".question_points,.question_points.hidden").text());
-        if (isNaN(val)) { val = 0; }
+        if (isNaN(val) || val < 0) { val = 0; }
         tally += val;
       });
       $("#questions .group_top:not(#group_top_new)").each(function() {
         var val = parseFloat($(this).find(".question_points").text());
-        if (isNaN(val)) { val = 0; }
+        if (isNaN(val) || val < 0) { val = 0; }
         var cnt = parseInt($(this).find(".pick_count").text(), 10);
         if (isNaN(cnt)) { cnt = 0; }
         tally += val * cnt;
@@ -1267,7 +1267,7 @@ define([
       }
       question.position = i;
       question.question_points = parseFloat(question.question_points);
-      if (isNaN(question.question_points)) {
+      if (isNaN(question.question_points) || question.question_points < 0) {
         question.question_points = 0;
       }
       quiz.points_possible += question.question_points;
@@ -1827,7 +1827,7 @@ define([
 
       question.matching_answer_incorrect_matches = matches.join("\n");
       question.question_points = parseFloat(question.question_points, 10);
-      if (isNaN(question.question_points)) { question.question_points = 0; }
+      if (isNaN(question.question_points) || question.question_points < 0) { question.question_points = 0; }
       var $form = $("#question_form_template").clone(true).attr('id', '');
       var $formQuestion = $form.find(".question");
       $formQuestion.addClass('initialLoad');
@@ -2695,6 +2695,11 @@ define([
         htmlValues: ['correct_comments_html', 'incorrect_comments_html', 'neutral_comments_html']
       });
 
+      if (questionData.question_points && questionData.question_points < 0) {
+        $form.find("input[name='question_points']").errorBox(I18n.t('question.positive_points', "Must be zero or greater"));
+        return;
+      }
+
       questionData.assessment_question_bank_id = $(".question_bank_id").text() || ""
       var error_text = null;
       if (questionData.question_type == 'calculated_question') {

spec/selenium/quizzes_question_creation_spec.rb

@@ -354,6 +354,19 @@ describe "quizzes question creation" do
     expect(quiz.quiz_questions.first.question_data["answers"].detect { |a| a["text"] == "" }).to be_nil
   end
 
+  it "doesn't allow negative question points" do
+    quiz = @last_quiz
+    question = fj(".question_form:visible")
+    click_option('.question_form:visible .question_type', 'essay_question', :value)
+
+    replace_content(question.find_element(:css, "input[name='question_points']"), '-4')
+    submit_form(question)
+
+    wait_for_ajaximations
+    expect(question).to be_displayed
+    assert_error_box(".question_form:visible input[name='question_points']")
+  end
+
   it "respects character limits on short answer questions" do
     quiz = @last_quiz
     question = fj(".question_form:visible")