test plan:
- take the flat manifest attached to CNVS-13219 and find the <gradable>
tag
- add a points_possible attribute to it, for example
<gradable points_possible="101">
- import the manifest as a common cartridge
- the imported assignment should have the specified points possible
refs CNVS-13503
fixes CNVS-13576
Change-Id: Ifc546c47cada7fcf7ec817395ceb525028406bf1
Reviewed-on: https://gerrit.instructure.com/36269
Tested-by: Jenkins <jenkins@instructure.com>
Reviewed-by: James Williams <jamesw@instructure.com>
QA-Review: Nathan Rogowski <nathan@instructure.com>
Product-Review: Jeremy Stanley <jeremy@instructure.com>
also fix a couple other minor cc issues
test plan:
* import the test packages referenced in the ticket
* should reference the images correctly in the first package
* should import a quiz in the second
fixes #CNVS-13340
Change-Id: I39dca77953d2b46703fa5163240329b039075ec3
Reviewed-on: https://gerrit.instructure.com/35815
Tested-by: Jenkins <jenkins@instructure.com>
QA-Review: Clare Strong <clare@instructure.com>
Reviewed-by: Jeremy Stanley <jeremy@instructure.com>
Product-Review: Jeremy Stanley <jeremy@instructure.com>
test plan:
* importing the example package with cc assignment data
should bring in canvas specific assignment data (like grading type)
* cc and canvas package import regressions
closes #CNVS-13270
Change-Id: Ic053837aa7642212bc0360f5e5ecf2cd27a88d9b
Reviewed-on: https://gerrit.instructure.com/35747
Tested-by: Jenkins <jenkins@instructure.com>
Reviewed-by: Bracken Mosbacker <bracken@instructure.com>
Product-Review: Bracken Mosbacker <bracken@instructure.com>
QA-Review: Clare Strong <clare@instructure.com>
test plan:
* import the common cartridge package referenced in
the ticket and other common cartridge packages with
external tools
* instead of having many copies of an external tool
with the same settings and domain, merge them together into
one
* each module item should still work with their individual url
and config, even though they're pointing to the same external tool
fixes #CNVS-13144
Change-Id: Idabe9ac95ea0605feb6dd9121a171b5e45e05a2e
Reviewed-on: https://gerrit.instructure.com/35193
Tested-by: Jenkins <jenkins@instructure.com>
QA-Review: Clare Strong <clare@instructure.com>
Reviewed-by: Brad Humphrey <brad@instructure.com>
Product-Review: Bracken Mosbacker <bracken@instructure.com>
test plan:
* import the test assignment fixtures as a common cartridge file
* there should be an assignment in the course
* also test import of flat manifest xml files
closes #CNVS-5906 #CNVS-13219
Change-Id: I0b765ed0d140516f78a5f4fb5dbe9b81ac77ecd4
Reviewed-on: https://gerrit.instructure.com/35394
Tested-by: Jenkins <jenkins@instructure.com>
Reviewed-by: Jeremy Stanley <jeremy@instructure.com>
Product-Review: Jeremy Stanley <jeremy@instructure.com>
QA-Review: Clare Strong <clare@instructure.com>
test plan:
* course migration regressions (canvas cc, course copy)
* in addition:
use the content migrations api to queue a content migration
for an account ("/accounts/:account_id/content_migrations")
to import a qti/cc package.
* confirm that the question banks from the package
that would have been normally imported into a course are now
imported into the account
closes #CNVS-12529
Change-Id: I2ef306341d2f7defe03c63a981679a3987f1aaa0
Reviewed-on: https://gerrit.instructure.com/34303
Tested-by: Jenkins <jenkins@instructure.com>
Reviewed-by: Jeremy Stanley <jeremy@instructure.com>
QA-Review: Clare Strong <clare@instructure.com>
Product-Review: James Williams <jamesw@instructure.com>
fixes: CNVS-12328
test plan:
- as admin enable the google_doc plugin
- as student visit `/profile/settings`
- click 'Google Docs' under the 'Other Services' section
- click 'Authorize Google Doc Access' in modal
- when redirect to google, click 'Allow access'
- verify success banner displays
Change-Id: I2b45ffa38ac0d1d810fb988335f4cd39154ae2a6
Reviewed-on: https://gerrit.instructure.com/32949
Tested-by: Jenkins <jenkins@instructure.com>
Reviewed-by: Simon Williams <simon@instructure.com>
QA-Review: Trevor deHaan <tdehaan@instructure.com>
Product-Review: Simon Williams <simon@instructure.com>
because the zip central directory can lie
test plan:
1. Create a huge file (say a gigabyte) where every byte is the
same.
2. Zip it. The repeating data will be compressed. The ZIP will
be tiny but will uncompress to a huge file.
3. Edit the zip file binary. Open it with a hex editor and
change the file size in the directory. Make the file
appear to be small enough to fit into the course quota.
(The zip file format is documented at
http://www.pkware.com/documents/casestudies/APPNOTE.TXT
or ask the committer for help)
4. Try to import the zip file into a course (migrations/
import zip file into folder)
5. You should receive a quota error.
fixes CNVS-10722
Change-Id: Ib1bd1c432ef900f0c6c61ebe6eab2881f8515104
Reviewed-on: https://gerrit.instructure.com/29704
Reviewed-by: Mark Severson <markse@instructure.com>
Tested-by: Jenkins <jenkins@instructure.com>
QA-Review: Nathan Rogowski <nathan@instructure.com>
Product-Review: Jeremy Stanley <jeremy@instructure.com>
test plan:
- create a new discussion
- attach a non-ASCII file
- save the discussion
- it shouldn't explode
Change-Id: I9ada9dbf2bf25e63baab22f6117171436d4808c6
Reviewed-on: https://gerrit.instructure.com/27832
Tested-by: Jenkins <jenkins@instructure.com>
QA-Review: Matt Fairbourn <mfairbourn@instructure.com>
Reviewed-by: Bracken Mosbacker <bracken@instructure.com>
Product-Review: Bracken Mosbacker <bracken@instructure.com>
test plan:
* import the package referenced in the ticket
* only select certain quizzes
* confirm that question banks are created only
for those quizzes that you selected
fixes #CNVS-7633
Change-Id: Ib19eef3fc0e69b56e1cb0eab89938e24c13bfa4b
Reviewed-on: https://gerrit.instructure.com/23584
Tested-by: Jenkins <jenkins@instructure.com>
Reviewed-by: Jeremy Stanley <jeremy@instructure.com>
Product-Review: Jeremy Stanley <jeremy@instructure.com>
QA-Review: August Thornton <august@instructure.com>
test plan:
* import the qti file referenced in the ticket
* should not get duplicated questions in the question banks
fixes #CNVS-7607
Change-Id: I97391135349d170ac307168506a39afb0f078077
Reviewed-on: https://gerrit.instructure.com/23556
Tested-by: Jenkins <jenkins@instructure.com>
Reviewed-by: Bracken Mosbacker <bracken@instructure.com>
Product-Review: Bracken Mosbacker <bracken@instructure.com>
QA-Review: August Thornton <august@instructure.com>
this was removed from the UI in Mar 2011 but was never completely ripped out.
we'd like to remove it now since it was adding extra complexity for no benefit.
closes CNVS-5929
refs #3974
test plan:
- create/update/delete an assignment from the index page, and the show page
- grade an assignment (with and without muting)
- test assignment notifications (with and without muting)
- creating an assignment
- editing an assignment
- changing a due date (after 3 hours of being edited)
- grading an assignment
Change-Id: Ie455bed41154018b5bd2c9c0e69e1e3285a0ac09
Reviewed-on: https://gerrit.instructure.com/20778
Tested-by: Jenkins <jenkins@instructure.com>
Reviewed-by: Simon Williams <simon@instructure.com>
Product-Review: Simon Williams <simon@instructure.com>
QA-Review: Simon Williams <simon@instructure.com>
Course copying and importing .zip files will now work the
same as other content migrations.
Test Plan:
* Using the ContentMigration api test course copy and zip imports
* Make sure the current course copy and zip import UIs still work
* for course copy make sure selective options work
closes CNVS-4228
Change-Id: I80a849471dffaf44d683e980cf0b73505b353d83
Reviewed-on: https://gerrit.instructure.com/19740
Tested-by: Jenkins <jenkins@instructure.com>
Reviewed-by: James Williams <jamesw@instructure.com>
QA-Review: Clare Strong <clare@instructure.com>
Product-Review: Bracken Mosbacker <bracken@instructure.com>
Reviewed-by: Jeremy Stanley <jeremy@instructure.com>
fixes CNVS_5151
test plan:
by using the new image button in the tinymce toolbar, you
should be able to:
* insert an image from Canvas content (course or group files;
whatever the context for the editor is)
* test in wikis, discussions, quizzes, eportfolios...
anywhere you can find a rich content editor
* if you're in a course or group context, you should be
able to add course/group files. otherwise (in account
context, for instance) you will only see "my files".
* also, pls to test that subfolders work
* single-click an image to select it (and set size/alt text etc.
before pressing Update)
* double-click an image to select it and insert with the
default alt-text and size
* note that the size is constrained to the image's aspect ratio
* insert an image from the user's own files
* insert an image by URL
* insert an image from Flickr via search
* images inserted from flickr should link to the source flickr page
(this is part of flickr TOS, and is not a new behavior, but should
be tested explicitly)
* make sure if you change to a different flickr image, the link
is updated
* also test that if you change a flickr image to a canvas image
or url image that the flickr link goes away
* NOTE: also test the old flickr search dialog on the wiki sidebar
(the blue magnifying glass thing) for possible regressions.
(the tinymce plugin that powers this thing was modified.)
* create or edit alt text for any image type
(note, it does not add uploading new files, that will come in another commit)
Change-Id: I2d5f8ca9f2301168f442955fda791631ee886636
Reviewed-on: https://gerrit.instructure.com/14391
Reviewed-by: Bracken Mosbacker <bracken@instructure.com>
Product-Review: Bracken Mosbacker <bracken@instructure.com>
Tested-by: Jenkins <jenkins@instructure.com>
QA-Review: Adam Phillipps <adam@instructure.com>
i was unable to re-create this bug, however on the live server i
was able to step through the code and determine the failure point.
fixes CNVS-4404
Change-Id: Ied185dc829ec1e2b972a102da9426ffab6541895
Reviewed-on: https://gerrit.instructure.com/18423
Tested-by: Jenkins <jenkins@instructure.com>
QA-Review: Marc LeGendre <marc@instructure.com>
Reviewed-by: Zach Pendleton <zachp@instructure.com>
Provides support for listing a user's google docs via ajax. The
front end will be implemented later.
Test Plan:
1. This shouldn't interrupt or affect the current way in
which we load all google docs on page load.
fixes CNVS-3592
Change-Id: Ia3a4283ab910f4759c3cc9880a5ff8d613f2463f
Reviewed-on: https://gerrit.instructure.com/17560
Tested-by: Jenkins <jenkins@instructure.com>
Reviewed-by: Ethan Vizitei <ethan@12spokes.com>
QA-Review: Clare Hetherington <clare@instructure.com>
In anticipation of adding a faster google docs listing, first
refactor the specs.
Test Plan:
- google docs should behave as before
refs CNVS-3592
Change-Id: Ic62d0cd170f491b5f36f516c0a71fde367dab0b2
Reviewed-on: https://gerrit.instructure.com/17548
Tested-by: Jenkins <jenkins@instructure.com>
Reviewed-by: Brian Palmer <brianp@instructure.com>
QA-Review: Clare Hetherington <clare@instructure.com>
this was a course setting which allowed students to edit assignment
descriptions only. unfortunately, it didn't work, because the form validation
code assumed a title input field would be present and tried to require that it
was there.
closes CNVS-3267
test plan:
- make sure the setting is not availble in course settings
- make sure students cannot edit assignments
- make sure teachers can still edit assignments
Change-Id: Iebeaa00f357a59bff8462ecde79c57d68c04320f
Reviewed-on: https://gerrit.instructure.com/17056
Tested-by: Jenkins <jenkins@instructure.com>
Reviewed-by: Cody Cutrer <cody@instructure.com>
QA-Review: Myller de Araujo <myller@instructure.com>
fixes CNVS-3413
when submitting an assignment with a google doc, user
was previously presented with an endless authorization
loop; google docs list was never displayed. this commit
restores proper behavior.
test plan:
* create an assignment that allows online submissions;
* as a student, attempt to submit the assignment as a
google doc (if you have not already authorized google
docs access, you will need to do that first);
* verify that the student is presented with a list of
their available google docs and not asked to
re-authorize their google docs access.
Change-Id: Iba9ffda7e35a88aa67b856689680c894a44c4532
Reviewed-on: https://gerrit.instructure.com/17265
Reviewed-by: Brian Palmer <brianp@instructure.com>
Tested-by: Jenkins <jenkins@instructure.com>
QA-Review: Marc LeGendre <marc@instructure.com>
test plan:
- import a Canvas course containing attachments with non-ASCII
filenames, on ruby 1.9 (there must be at least two attachments)
fixes #CNVS-3195
Change-Id: I0c7f19b6f7a477858bfba3cd2501bcbf16ba0567
Reviewed-on: https://gerrit.instructure.com/17006
Tested-by: Jenkins <jenkins@instructure.com>
Reviewed-by: Bracken Mosbacker <bracken@instructure.com>
QA-Review: Adam Phillipps <adam@instructure.com>
work around the issue where creating a temp file whose basename
starts with '~' fails on ruby 1.9
ruby issue: https://bugs.ruby-lang.org/issues/7547
test plan: try to import the course linked in the ticket
fixes #CNVS-2922
Change-Id: Iafbbae05c90dbef22e73e6311379e3aeee0a5f32
Reviewed-on: https://gerrit.instructure.com/16796
Tested-by: Jenkins <jenkins@instructure.com>
QA-Review: Adam Phillipps <adam@instructure.com>
Reviewed-by: Jeremy Stanley <jeremy@instructure.com>
handles the case when the content migration import page is stuck
on the loading screen when the content import doesn't have any
items to select on the import page (and thus populateItem never
gets run)
test plan:
* import the attached import (which only has questions, no course
items to select)
* should load the content import screen, (even though there's
only one option: "Copy Everything"
closes #CNVS-2662
Change-Id: I17ddeca10752f42000edc928995dd8766e9ff51c
Reviewed-on: https://gerrit.instructure.com/16661
Tested-by: Jenkins <jenkins@instructure.com>
Reviewed-by: Jeremy Stanley <jeremy@instructure.com>
QA-Review: Adam Phillipps <adam@instructure.com>
refs #CNVS-1125
this prevents any funky user input to the
xml_schema action in the ContentExport controller
from pulling up anything other than the
items in the target xsd directory.
TEST PLAN:
tough to test from the outside
because the existing pathing prevents
very much monkeying with the file path,
so most attack attempts would be prevented
simply by naively interpreting the path
as nonexistent for our routing config. If you
find any way to get any other file in
the system except the ones in that
directory via the "/xsd/#{something}.xsd"
url path then you win and I have more to fix.
Change-Id: Iddb22c9bbd5778d67c3737c5425126419297a5d3
Reviewed-on: https://gerrit.instructure.com/15774
Reviewed-by: Cody Cutrer <cody@instructure.com>
Tested-by: Jenkins <jenkins@instructure.com>
refs #11857
don't allow zip files with more than
100000 files to get attached
don't allow zip files that add enough
data (with a minimum file size of 512)
to go over the context quota
also refactor unzip_attachment.rb a
bit as long as we're in there because
it's a bit dense and monolithic. There
is still much that could be done there,
but it's not one enormous method anymore.
TEST PLAN:
1) login as any user with permissions
to upload files.
2) attempt to upload a zip archive with
more than the configured max number of
files inside of it (currently 100,000)
3) you should get an error preventing
this action from occuring and no
new attachments should have been made
to that context
4) navigate to some context where the
attachment quota is known.
5) attempt to upload a zip archive to
that context with enough size to exceed
that quota.
6) you should get an error preventing
any of the new attachments from being
attached to that context.
Change-Id: I35ce673e96fb98728cb36cfd27538fd802a249f2
Reviewed-on: https://gerrit.instructure.com/15671
Reviewed-by: Cody Cutrer <cody@instructure.com>
Tested-by: Jenkins <jenkins@instructure.com>
Reviewed-by: Clare Hetherington <clare@instructure.com>
Ruby 1.9 uses a different YAML engine (although
we reset it to the 1.8 engine in the delayed
job plugin). This resulted in the yaml
dump to the assets.yml file (for plugin
asset inclusion) not producing
quite the expected output format at server
startup (before the delayed job plugin had
loaded), which caused
selenium tests to fail in the canvalytics
plugin because they ONLY loaded the assets.yml
file at startup rather than before each
request like in development.
A small regex change in the ruby block
in assets.yml fixed the actual problem. While
I was in here, I moved the ruby block into
it's own class so that all the processing
can be tested. the "subdoc" stuff in bundle_yml
could probably still stand to be slimmed down
a bit but this is a decent intermediate step.
Change-Id: I9300c167130fb3305c7f37710b0e3cfcfda19f48
Reviewed-on: https://gerrit.instructure.com/15111
Reviewed-by: Jacob Fugal <jacob@instructure.com>
Tested-by: Jenkins <jenkins@instructure.com>
fixes#9185
This adds a new version of export files and ensures
older exports will work. We are now using a
canvas_export.txt resource to identify if this is a
canvas cartridge or a common cartridge.
Test Plan
1. Copy a course
2. When copying, unselect copy all and course syllabus
3. The syllabus shouldn't be copied over.
Change-Id: I37c9aa12aabe453ef4481c6f39b7b33c97b130bb
Reviewed-on: https://gerrit.instructure.com/14971
Tested-by: Jenkins <jenkins@instructure.com>
Reviewed-by: Jeremy Stanley <jeremy@instructure.com>
Fixes#9904
Test plan:
1. View GB2 in a course
2. On an assignment column, click the dropdown button,
and click download submissions
3. Once downloaded, close the dialog, and click that
same dropdown arrow again, and hit re-upload submissions
4. Choose the file you just downloaded. Prior to this change,
uploading the file caused an InvalidAuthenticityToken error.
With this fix, the file gets processed as it should, and
you are taken to the summary page.
Other notes:
* Also adds selenium test for submission downloading
and uploading on gradebook2 that covers behavior of this
fix as well as the feature as a whole
Change-Id: Ib0ddefbcd6f9bd4f40d28e51f4793752ae67a221
Reviewed-on: https://gerrit.instructure.com/14644
Tested-by: Jenkins <jenkins@instructure.com>
Reviewed-by: Amber Taniuchi <amber@instructure.com>
Reviewed-by: Simon Williams <simon@instructure.com>
test plan for course, account, and sub-account
outcomes page:
- using the 'New' buttons in the toolbar
create, edit, and delete a bunch of outcomes
and groups and nested groups
- when editing an outcome, insert, edit, and delete the criterion ratings
- find dialog
- inside any top level standard group
- select an individual outcome or a group to import
- after importing, the outcome or group should show up in the
seleced group of the main window and show it's details on the right
- account standards
- the account groups (the first level under 'Account Standards') should
not be importable
- pagination
- add 20-30 outcomes and groups to a group
- groups should load first and then the outcomes
- a 'Loading more results' item should be displayed when fetching
more pages
- test out the 'Back' button
Change-Id: Iba1bb0533fb962ac6d206179c82c388f5fee1d84
Reviewed-on: https://gerrit.instructure.com/13086
Reviewed-by: Zach Pendleton <zachp@instructure.com>
Tested-by: Bryan Madsen <bryan@instructure.com>
fixes#10036
This commit removes the ability to sort files and folders by
dragging and replaces it with a default of alphabetizing every
item.
Test plan:
*Folder
1. Go the to files page http://localhost:3000/dashboard/files
2. Create a folder named "d_folder" then add a folder named "a_folder"
3. Ensure "a_folder" is before "d_folder"
*Files
1. Go the to files page http://localhost:3000/dashboard/files
2. Upload a file named "d_file.txt" then add a file named
"a_file.txt" (must have characters in the file"
3. Ensure "a_file.txt" is before "d_file.txt"
Change-Id: I3776ff996e338f8aa6fc3858b59e1460b8b1cdf0
Reviewed-on: https://gerrit.instructure.com/13554
Tested-by: Jenkins <jenkins@instructure.com>
Reviewed-by: Zach Pendleton <zachp@instructure.com>
Test plan:
(We need two users here because Canvas doesn't notify you about
files you upload yourself. We'll call them Student and Teacher
here, but they don't actually have to be these things.)
* As Student, enable notifications for new files in Profile.
* As Teacher, upload a file.
* Within an hour or so (everything about notifications occurs
in low-priority background tasks), Student should receive
a notification for the file.
* As Teacher, upload multiple files.
* Student should eventually receive a notification that
X number of files were added.
Note that files are batched over a five-minute period; that is,
if a file is added to a course within five minutes of a previous
file, it will be counted in the same batch.
Change-Id: I09b5f497cae1d726b7aaf85824e98e69e45b0c1b
Reviewed-on: https://gerrit.instructure.com/12346
Tested-by: Jenkins <jenkins@instructure.com>
Reviewed-by: Simon Williams <simon@instructure.com>
Test Plan:
* Upload a zip file
* The files should be in alphabetical order in the course
refs #8602
Change-Id: I703cce328d8dce46663379250dce2e6ce8a7c3a9
Reviewed-on: https://gerrit.instructure.com/11310
Tested-by: Jenkins <jenkins@instructure.com>
Reviewed-by: Brian Palmer <brianp@instructure.com>
Some vendors want to be able to create assignments when importing
common cartridge packages with grade-writeback LTI tools. This
allows them to set outcome points as a custom flag to do that
Test Plan:
* Import the CC fixture for the modified spec into a course
* There should be an LTI assignment and a module item pointing to it
closes#8887
Change-Id: I507e732b24ee392540b652499acb8dc305e42c69
Reviewed-on: https://gerrit.instructure.com/11303
Tested-by: Jenkins <jenkins@instructure.com>
Reviewed-by: Cody Cutrer <cody@instructure.com>
The canvas cartridge import would fail if there was no
'non_cc_assessments' folder, or if the discussion topic
meta file was incorrectly referenced
Test Plan:
* Import the new .zip fixture
* It shouldn't fail and there should be a discussion topic
closes#8886
Change-Id: I94c965c2e1f52437a395288e389cbf4c6fa89d41
Reviewed-on: https://gerrit.instructure.com/11271
Tested-by: Jenkins <jenkins@instructure.com>
Reviewed-by: Cody Cutrer <cody@instructure.com>
This allows us to have external tools that let the user pick
content to insert that has a different URL than what the tool
is configured to use. That way you could, for example, more
easily have a Khan Academy tool that let you insert Khan
Academy resources as items in a module, instead of just as
content in the WYSIWYG like you get now.
test plan:
- configure the dummy external tool included in Canvas
("<canvasdomain>/selection_test" is the launch URL,
make sure it's a resource_selection tool -- there's
a template xml in spec/fixtures/selection_test_lti.xml)
- use it to insert the blti module link which will be a link
to example.com instead of <canvasdomain>
- verify that the link launches as an lti tool launch
with the dummy tool's credentials (check the request's
POST parameters)
- configure an external tool without resource selection
- pick it from the list of tools to insert an item into a module
- manually edit the link and change the URL to something different
- verify that when clicking the changed URL, Canvas doesn't
know what to do with it (it should redirect back to the modules
page).
Change-Id: Ic2bf3145fe87e19307b185dd1c437f79d1282a49
Reviewed-on: https://gerrit.instructure.com/9914
Reviewed-by: Bracken Mosbacker <bracken@instructure.com>
Tested-by: Jenkins <jenkins@instructure.com>
The selective imports mostly worked before, but if a
given section was completely unchecked the previous
code would import it anyway. This fixes that and makes all
the decision code in one place and easy to test.
Test Plan:
* Import a content package and only choose certain items
* Only the items you chose should be imported
closes#5528
Change-Id: Ia6c0c1f5f9a44497053733101140cc74d6239129
Reviewed-on: https://gerrit.instructure.com/9799
Tested-by: Hudson <hudson@instructure.com>
Reviewed-by: Cody Cutrer <cody@instructure.com>
Some files were being missed on import because they were
getting a duplicate migration_id. Those are added now.
The text from QTI questions wasn't being processed to
point to files in the appropriate recourse directory.
Test Plan:
* Import the fixture package
* Make sure that the quiz has images
closes#7469
Change-Id: I1656e741ea1d97c7cd3d5c89791bd4da4f5472b0
Reviewed-on: https://gerrit.instructure.com/9674
Tested-by: Hudson <hudson@instructure.com>
Reviewed-by: Cody Cutrer <cody@instructure.com>
It's not valid for a zip to use backslashes, but some vendors
use them anyway. unzip handles it well so try to process it
anyway
Test Plan:
* Try to migrate a zip with backslashes
* It should not fail with a "could not unzip" error
closes#7379
Change-Id: Ie74506bffe70937871d865f63b1b5037b6678b2c
Reviewed-on: https://gerrit.instructure.com/9258
Reviewed-by: Cody Cutrer <cody@instructure.com>
Tested-by: Hudson <hudson@instructure.com>
also move notifications in "new email messages" to "administrative alerts",
because that's a much better description of them
test plan:
* go to communication preferences
* the last one should be "administrative alerts"
* "Files", "Private message from student", "New email messages",
and "Context Message" should be nowhere to be found
Change-Id: I8b30d53b8137ab4b17cb436920d87331327e01f9
Reviewed-on: https://gerrit.instructure.com/8996
Tested-by: Hudson <hudson@instructure.com>
Reviewed-by: Simon Williams <simon@instructure.com>
FileInContext (used by the zip importer) was bypassing the filename= setter
for Attachment, so when using attachment_fu, sanitize_filename was not getting
called on the filename. This resulted in us generating S3 urls with characters
in them like filename[0].txt. That normally worked fine. However, Firefox
would escape those characters when redirected to a URL like that, which would
cause a signature mismatch with S3.
This commit stops bypassing the filename= setter so files uploaded as zip
files and in migrations have escaped filenames. Because of difficulties
testing S3 attachments, the included spec is weak.
This also includes a migration that will rename attachments with []" in their
filenames, and make a copy of the S3 object to match.
There is also an unrelated spec refactor around faking out a portion of the
code about S3.
test plan:
* Enable S3
* Create a ZIP file with a file in it with a name like test[0].bin
* Upload that ZIP file to your files are, choosing to unpack the ZIP contents
* Verify that you can download the extracted file using firefox
* Also verify that the attachment's filename is escaped in the db
Change-Id: I54fc0682b64a9e0021b4b41236f8cab168a0e56e
Reviewed-on: https://gerrit.instructure.com/8875
Tested-by: Hudson <hudson@instructure.com>
Reviewed-by: Bracken Mosbacker <bracken@instructure.com>
Reviewed-by: Brian Palmer <brianp@instructure.com>
Somehow the after_attachment_saved callback in Attachment was getting called
on non-scribdable attachments with a workflow_state of 'processing'. We were
previously only skipping non-scribdable attachments if the workflow_state was
'pending_upload'. Now we will skip scribd processing for any non-scribdable
attachment, no matter it's state.
Also changed UnzipAttachment to only create a scribd job if there are any
scribdable attachments.
test plan:
* Since we're not sure how the attachments originally got in the state
described above, it's hard to describe repro steps. However, if you upload
some images, they should not get scribd jobs created for them.
Change-Id: I7381af3f0928c2decf4f224834780cc90fbbc103
Reviewed-on: https://gerrit.instructure.com/8028
Reviewed-by: Brian Palmer <brianp@instructure.com>
Tested-by: Hudson <hudson@instructure.com>
This fixes a segfault we're hitting, https://github.com/tenderlove/nokogiri/issues/439
(We can't upgrade to nokogiri 1.5.x without bumping sanitize from 1.x to 2.x)
explanation of spec changes:
* the first xss spec started failing because nokogiri no longer drops
xml directives. however, it's not exploitable.
* the second xss spec started failing due to nokogiri now properly
the selected honoring charset. it's also not exploitable, since
canvas doesn't use utf-7.
* the final spec change is because nokogiri now strips out the invalid
newline, where it left it in before.
test plan: specs will exercise the upgraded nokogiri gem for
compatibility in our use cases
Change-Id: Ie152c8c60f3df5150ee4f14ab41dfee95a342fa8
Reviewed-on: https://gerrit.instructure.com/7958
Reviewed-by: Brian Palmer <brianp@instructure.com>
Tested-by: Brian Palmer <brianp@instructure.com>
If a file was both a webcontent resource and was listed as
a file in another webcontent resource the processing would
fail. Now it doesn't.
Test Plan:
* Upload the common cartridge test fixture
* It should fail
closes#6590
Change-Id: I86d8d9be51d35fd847747802e706e35ca539cd46
Reviewed-on: https://gerrit.instructure.com/7412
Tested-by: Hudson <hudson@instructure.com>
Reviewed-by: Cody Cutrer <cody@instructure.com>
we still need to call a text/html downloaded from a google docs
'document:blah' document id a .doc, since the assignment may be
restricting submissions to '.doc'. however, we don't want to claim that
said document is scribdable, because it's not. fix already uploaded docs
that were scribd when they shouldn't have been.
be smarter about inferring extensions for google docs downloads while
we're at it.
fixes#5811
Change-Id: Ie8025563d99c653e40d719d7dd2fecda0ec9c9d7
Reviewed-on: https://gerrit.instructure.com/5956
Tested-by: Hudson <hudson@instructure.com>
Reviewed-by: Brian Palmer <brianp@instructure.com>
Jeremy Stanley