Commit Graph

165 Commits

Author SHA1 Message Date
James Williams e45ff7189a use double-cookie csrf protection
test plan:
* in one tab, start to fill out an ajax form
 (e.g. editing a quiz)
* in another tab, log out of canvas
* return to the original tab and try to
 submit the form (e.g. save your changes)
* should get an error message with a link to
 login in a new tab
* login in the new tab
* return to the original, and try to resubmit
* should save successfully

closes #CNVS-3957 #CNVS-13673

Change-Id: I7758514de8ce09361fef469034645d8a29e2a5e5
Reviewed-on: https://gerrit.instructure.com/40396
Reviewed-by: Jacob Fugal <jacob@instructure.com>
QA-Review: Clare Strong <clare@instructure.com>
Tested-by: Jenkins <jenkins@instructure.com>
Product-Review: Cosme Salazar <cosme@instructure.com>
2014-09-23 15:29:03 +00:00
Cody Cutrer 0b594c01ca allow language mappings to be passed to transifex importer
Change-Id: I4199e308c31feb47a3d523916337111ffd06bdf8
Reviewed-on: https://gerrit.instructure.com/41439
Reviewed-by: Duane Johnson <duane@instructure.com>
Tested-by: Jenkins <jenkins@instructure.com>
Reviewed-by: Rob Orton <rob@instructure.com>
QA-Review: Rob Orton <rob@instructure.com>
Product-Review: Cody Cutrer <cody@instructure.com>
2014-09-22 16:42:17 +00:00
Matt Wheeler 290e7928d3 Gemspec for Academic Benchmarks gem uses a URI
Fixes CNVS-15705

This 'just' needed a valid uri to keep some versions of bundler from
throwing an invalid gemspec error, which could prevent bins or native
extensions from getting installed, causing problems in extreme cases.

Test plan:

Run `bundle install` and see that you don't get an error about an
invalid gemspec (using an impacted version of bundler, such as 1.3.2.

Alternative, just trust me that this fixes the error, don't worry about
changing your bundler version, and simply verify that Canvas
still bundles.

Change-Id: Ibd658c55e47118355f5bed516f23c627edf1d153
Reviewed-on: https://gerrit.instructure.com/41482
Tested-by: Jenkins <jenkins@instructure.com>
Reviewed-by: Simon Williams <simon@instructure.com>
Product-Review: Simon Williams <simon@instructure.com>
QA-Review: Simon Williams <simon@instructure.com>
2014-09-22 13:14:35 +00:00
Brian Palmer 2eb1b4db7c rails4: gemify attachment_fu
closes CNVS-14268

Since this is very clearly our own fork of the gem at this point, I've
removed a lot of unused code, rather than fixing it up to work as a gem.
This includes:

* all the other processors besides mini_magick
  * red_artisan, it was only used by the core_image processor
  * geometry and the Array monkey patch, it was only used by image science
* the db_file_backend
* the Tempfile monkey patch, I fixed the AttachmentFu code to properly
  create tempfiles with the desired extension
* removed the Technoweenie outer namespace, to match normal gem practices

test plan:

Attachments should still work as before, including viewing, uploading,
downloading, and thumbnail generation.

Change-Id: I94ff63182af839ec54b64714defd6912b0d91f65
Reviewed-on: https://gerrit.instructure.com/41281
Tested-by: Jenkins <jenkins@instructure.com>
Reviewed-by: Cody Cutrer <cody@instructure.com>
QA-Review: August Thornton <august@instructure.com>
Product-Review: Brian Palmer <brianp@instructure.com>
2014-09-18 22:28:54 +00:00
Brian Palmer 6736b69401 rails4: gemify simply_versioned
closes CNVS-14287

test plan: versions should work same as before. for instance, wiki page
versions and quiz versions.

Change-Id: Ibbf9dd9787711c9d6d08f40add6378a906fde968
Reviewed-on: https://gerrit.instructure.com/41243
Tested-by: Jenkins <jenkins@instructure.com>
Reviewed-by: Cody Cutrer <cody@instructure.com>
QA-Review: August Thornton <august@instructure.com>
Product-Review: Brian Palmer <brianp@instructure.com>
2014-09-17 20:27:46 +00:00
Brian Palmer 5a9cae7d0f rails4: gemify delayed_job
closes CNVS-14275

While we're at it, fix all the rspec deprecation warnings.

test plan: delayed jobs should still work as before, including queuing,
viewing in the UI, and running.

Change-Id: I36c6b74aa2b59a99e4f1f36e25e6d0e9e153f92a
Reviewed-on: https://gerrit.instructure.com/41211
Reviewed-by: Cody Cutrer <cody@instructure.com>
QA-Review: August Thornton <august@instructure.com>
Tested-by: Jenkins <jenkins@instructure.com>
Product-Review: Brian Palmer <brianp@instructure.com>
2014-09-17 18:14:54 +00:00
Cody Cutrer 06dd36621c set default scope for callbacks
so that first_or_create works as expected

refs CNVS-15126

Change-Id: Idd87063a06f7c042247735fceff3ae420586052e
Reviewed-on: https://gerrit.instructure.com/41152
Tested-by: Jenkins <jenkins@instructure.com>
Reviewed-by: Brian Palmer <brianp@instructure.com>
Product-Review: Cody Cutrer <cody@instructure.com>
QA-Review: Cody Cutrer <cody@instructure.com>
2014-09-17 17:27:05 +00:00
Cody Cutrer c7eb86aeeb no more dynamic finders (gems)
refs CNVS-15126

Change-Id: Id2d93f75769cfcb34f2edce08ea682ce050a2354
Reviewed-on: https://gerrit.instructure.com/41216
Tested-by: Jenkins <jenkins@instructure.com>
Reviewed-by: Brian Palmer <brianp@instructure.com>
Product-Review: Cody Cutrer <cody@instructure.com>
QA-Review: Cody Cutrer <cody@instructure.com>
2014-09-17 16:48:18 +00:00
Bracken Mosbacker 6656a06c47 add new ext_roles lti param for all the roles user has
this is a list of all the roles the user has in canvas
not just the ones for the current context.

This is how it should have been all along, but we can't
make the normal roles parameter do it this way because
tools depend on our current format. So send a new one
and tell people to  migrate over as they can

Test Plan:
 * do an lti launch, ext_roles should always have "user"
   and any of learner, instructure, administrator as appropriate

refs RD-518
closes PLAT-641

Change-Id: I8cf7e96ac88e1b17528cd3d717834762cc9b575b
Reviewed-on: https://gerrit.instructure.com/40875
Tested-by: Jenkins <jenkins@instructure.com>
Reviewed-by: Brad Humphrey <brad@instructure.com>
QA-Review: Clare Strong <clare@instructure.com>
Product-Review: Bracken Mosbacker <bracken@instructure.com>
2014-09-16 13:13:54 +00:00
Simon Williams ab6433ddb2 gemify acacemic_benchmark
closes CNVS-14265

move it from vendor/plugins to gems/plugins as a canvas-dependent
rails engine.

test plan: regerssion test on academic benchmark importing. no
behavior should change.

Change-Id: I2e06321c850cf6b981bbd3e313479b9d1f0bcb8e
Reviewed-on: https://gerrit.instructure.com/39852
Tested-by: Jenkins <jenkins@instructure.com>
Reviewed-by: Cody Cutrer <cody@instructure.com>
QA-Review: August Thornton <august@instructure.com>
Product-Review: Brian Palmer <brianp@instructure.com>
2014-09-15 15:10:27 +00:00
Joel Hough 1f16889586 handle multipart incoming email with no html part
fixes CNVS-15232

test plan
- reply to a conversation message notification email with a
 multipart message that doesn't have an html part
- ensure that the reply shows up in canvas
- ensure that no error report is generated from the incoming
 message processor

Change-Id: If7b4913fe28815312360e58e50f47bf44ff2ead2
Reviewed-on: https://gerrit.instructure.com/40971
Tested-by: Jenkins <jenkins@instructure.com>
Reviewed-by: Mark Severson <markse@instructure.com>
QA-Review: Steven Shepherd <sshepherd@instructure.com>
Product-Review: Joel Hough <joel@instructure.com>
2014-09-11 22:30:45 +00:00
Jacob Fugal 954e77d645 rework error handling in event stream
fixes CNVS-15153

 * don't raise if the configured cassandra database can't be connected
   to; instead, return nil (uncached, so it can be retried next time)
   and treat it as connected but unavailable
 * allow configuring whether an error is re-raised (configured true for
   test only in canvas), rather than peeking into rails directly from
   event stream.
 * allow registering callbacks to run on insert/update error via
   on_error
 * on insert/update error, before (maybe) reraising the error, call any
   registered callbacks
 * configure canvas to log to Rails.logger and statsd (removed from
   EventStream::Failure) on insert/update error

EventStream::Failure is now unused, but not yet removed from the code.
it should be considered deprecated and remain unused; it will be removed
in the near future.

test-plan:
 - start canvas in non-test mode (e.g. development mode) with cassandra
   and statsd configured and running
 - turn off cassandra, so even stream inserts should fail
 - change a grade (to trigger a GradeChange event)
 - with cassandra off, event insert should fail, but should *not*
   impede the remainder of the grade change action
 - EventStream::Failure record should *not* be created in the database
 - an error line should appear in the Rails log for the failed insert
 - the appropriate 'event_stream_failure.*' statsd counters should be
   incremented

Change-Id: I5c6d29c2a08276ccc06ebc8c1a59e0d33ce2cc4e
Reviewed-on: https://gerrit.instructure.com/40088
QA-Review: August Thornton <august@instructure.com>
Tested-by: Jenkins <jenkins@instructure.com>
Reviewed-by: Brian Palmer <brianp@instructure.com>
Product-Review: Jacob Fugal <jacob@instructure.com>
2014-08-28 21:19:24 +00:00
Paul Hinze 9e3739e553 bugfix: don't strip hyphens from media thumbnail URLs
some media ids have dashes in them, but sanitization in the canvas
kaltura client was stripping them, causing video thumbnails to not work
in some cases.

this fixes the sanitization so those ids are handled properly.

Change-Id: I23b4c392dfc79eff4d57bea84c3509a1e6bf3137
Reviewed-on: https://gerrit.instructure.com/39694
Tested-by: Jenkins <jenkins@instructure.com>
Reviewed-by: Cody Cutrer <cody@instructure.com>
Product-Review: Paul Hinze <paulh@instructure.com>
QA-Review: Paul Hinze <paulh@instructure.com>
2014-08-28 21:11:02 +00:00
James Williams 10146e8175 fix wiki_page_importer only_when_blank setting overwriting
also protect the class level variables set by acts_as_url
from being overwritten in the future

test plan:
* running spec/apis/v1/content_exports_api_spec.rb and
 spec/apis/v1/pages_api_spec.rb together in that order
 should not cause spec failures

Change-Id: I7c6cde252b2780365ae05438ef4f56135c6edd2f
Reviewed-on: https://gerrit.instructure.com/40080
Tested-by: Jenkins <jenkins@instructure.com>
Reviewed-by: Jeremy Stanley <jeremy@instructure.com>
Product-Review: James Williams  <jamesw@instructure.com>
QA-Review: James Williams  <jamesw@instructure.com>
2014-08-28 15:02:08 +00:00
Cody Cutrer 48864de3f6 begin rails 4
enough for bundle install to work with 4.1.5

Change-Id: I277df9e4315fa250b6028139113c74721148e2f0
Reviewed-on: https://gerrit.instructure.com/39656
Reviewed-by: Brian Palmer <brianp@instructure.com>
Tested-by: Jenkins <jenkins@instructure.com>
Product-Review: Cody Cutrer <cody@instructure.com>
QA-Review: Cody Cutrer <cody@instructure.com>
2014-08-27 23:09:17 +00:00
Jeremy Stanley 5baca5c7b2 add :preload_courses option to User#cached_current_enrollments
many consumers of this function proceed to load the course for
each enrollment (note that #active? etc. load the course, to get
term dates). this causes an N+1 query each time. add an option
to preload courses for the returned enrollments, and use it
where it makes sense.

test plan:
 - have a user with many active enrollments
 - load the dashboard for the user (/)
 - consult the system log and ensure this isn't sequentially
   queried for every course the user is enrolled in:
SELECT "courses".* FROM "courses" WHERE "courses"."id" IN (x)

fixes CNVS-14880

Change-Id: Ie7be8f402b49516aa7bc667f9cf8b7598d2abfc7
Reviewed-on: https://gerrit.instructure.com/40070
Tested-by: Jenkins <jenkins@instructure.com>
Reviewed-by: Cody Cutrer <cody@instructure.com>
QA-Review: Clare Strong <clare@instructure.com>
Product-Review: Jeremy Stanley <jeremy@instructure.com>
2014-08-27 14:04:25 +00:00
Brad Horrocks ae4806cb6d It is now possible to extract email bodies from nested multipart messages
This fixes an issue where receiving a nested multipart message would
show some of the raw message pieces instead of the actual message. A
new test case has been added.

Fixes CNVS-5873

Test Plan:

- Set Notifications for Conversations so that you will be emailed to an email account you have set up in Outlook.
- As another user, message that student to prompt the notification to be sent
- From Outlook, reply to the Conversation Message notification and include an image somewhere in the body of your reply
- Return to the Conversations Inbox of the user that was being replied to and observe that the message displays in Canvas with all the encoding data.

Change-Id: I497cf421ee231d7e95c0bacd34cb2448fb7220ff
Reviewed-on: https://gerrit.instructure.com/38684
Tested-by: Jenkins <jenkins@instructure.com>
Reviewed-by: Joel Hough <joel@instructure.com>
Product-Review: Matthew Wheeler <mwheeler@instructure.com>
QA-Review: Steven Shepherd <sshepherd@instructure.com>
2014-08-25 20:02:10 +00:00
Brian Palmer a0c74ff3b3 add an auto-generated comment to language yml files
Change-Id: Ib5edd010f8a6268d2ece5857ea6d5eca383c6d6a
Reviewed-on: https://gerrit.instructure.com/39786
Reviewed-by: Jacob Fugal <jacob@instructure.com>
Tested-by: Jenkins <jenkins@instructure.com>
Product-Review: Brian Palmer <brianp@instructure.com>
QA-Review: Brian Palmer <brianp@instructure.com>
2014-08-22 18:34:08 +00:00
Brian Palmer b55992e8ac gemify respondus_soap_endpoint
This turns the vendor/plugin into a rails engine, and establishes the
convention of canvas-dependent rails engines/gems going into
gems/plugins, and everything in that dir being auto-required and added
to canvas spec runs.

closes CNVS-14286

test plan: regression test on the respondus quiz builder client. no
behavior should change.

Change-Id: I51b548418bcb70af77e87c2c2d62cac27ed4ab44
Reviewed-on: https://gerrit.instructure.com/38394
Tested-by: Jenkins <jenkins@instructure.com>
QA-Review: August Thornton <august@instructure.com>
Reviewed-by: Cody Cutrer <cody@instructure.com>
Product-Review: Brian Palmer <brianp@instructure.com>
2014-08-21 16:49:54 +00:00
Cody Cutrer 5e53eb3a33 remove rails2 from active_polymorph
Change-Id: I3a7ca146f037d0c7fa46efc1dcb11ba483938dac
Reviewed-on: https://gerrit.instructure.com/39669
Tested-by: Jenkins <jenkins@instructure.com>
Reviewed-by: Anthus Williams <awilliams@instructure.com>
Product-Review: Cody Cutrer <cody@instructure.com>
QA-Review: Cody Cutrer <cody@instructure.com>
2014-08-21 16:45:08 +00:00
Ahmad Amireh b2427f45c2 I18n JS parser: support precompiled assets
This patch makes `i18n:check` and `i18n:generate_js` able to parse
source files that may contain more than one AMD module. Usage is
described in the gem's (newly added) README.md file.

Closes CNVS-14691

TEST PLAN
---- ----

  - make sure `i18n:generate` and `i18n:check` rake tasks work

Change-Id: Ic1280c0b31fd274da2529ebeac7f72f72934f1ab
Reviewed-on: https://gerrit.instructure.com/39014
Tested-by: Jenkins <jenkins@instructure.com>
Reviewed-by: Jon Jensen <jon@instructure.com>
Product-Review: Jon Jensen <jon@instructure.com>
QA-Review: Jon Jensen <jon@instructure.com>
2014-08-16 07:47:23 +00:00
Nick Cloward 8315ec1371 fix audit records as they are queried
refs: CNVS-13987

Adds a parameter to event stream that allows us to add in a method to fix the
data before the event stream pulls the records.  Once the fixup is complete we
should remove these changes.

Requres g/37541.

Test Plan:

  - Corrupt some Audit log data for authentications, grade changes, and course
    changes.
  - Do not run the data fixup.
  - Use the UI or API endpoints to query the corrupted records.
  - Should fix the corrupted indexes for the corrupted records.
  - Should return corrupted event type records in results just as if the data
    fixup has ran on the records.
  - Should behave normally on records that are not corrupted or have never been
    corrupted.

Reference g/37605 for setting up corrupted event data.

Change-Id: Id0e1278c7d377ef836866e2e146e2b52887fdc68
Reviewed-on: https://gerrit.instructure.com/39089
Reviewed-by: Jacob Fugal <jacob@instructure.com>
QA-Review: August Thornton <august@instructure.com>
Tested-by: Jenkins <jenkins@instructure.com>
Product-Review: Nick Cloward <ncloward@instructure.com>
2014-08-16 01:53:45 +00:00
Paul Hinze 071d6d8a96 align rspec version in gems with parent
update spec_helpers to fix deprecation warning after upgrade

Change-Id: I31b370d1d60f73d5256c69a8d5e69418657f880d
Reviewed-on: https://gerrit.instructure.com/39144
Tested-by: Jenkins <jenkins@instructure.com>
Reviewed-by: Brian Palmer <brianp@instructure.com>
Product-Review: Paul Hinze <paulh@instructure.com>
QA-Review: Paul Hinze <paulh@instructure.com>
2014-08-12 22:27:39 +00:00
James Williams 81558f728c remove rails 2 support
closes #CNVS-14261

Change-Id: I1b0e8a4438ab659ecd1ac8462bc3559d810989b3
Reviewed-on: https://gerrit.instructure.com/38744
Reviewed-by: Cody Cutrer <cody@instructure.com>
Product-Review: Cody Cutrer <cody@instructure.com>
QA-Review: Cody Cutrer <cody@instructure.com>
Tested-by: Jenkins <jenkins@instructure.com>
2014-08-06 18:16:19 +00:00
Ryan Shaw 485b90a6f7 replace compass with node-sass
after many steps towards this moment, we're finally here

This yanks sass and compass out of canvas-lms
completely and instead uses the libsass based
node-sass to compile our SASS files.

wins:

It is WAYYY faster!
as in, < 10 seconds to recompile all css in canvas
(compared to the 5+ minutes it used to take)

It is all in JS, helping use move to a completely
nodeJS based fronted tooling workflow.

next steps:

remove jammit: we don't need an assets.yml file
since node-sass can output compressed css for us
and we use sass to do all of our @import'ing of other
files (@colleen calls those "compiler" sheets), this
would simplify and speed up fronted asset building
even more

use gulp/broccoli/whatev to do cached, incremental builds

test plan:

all outputted css should look exactly the
same as it used to.

run `npm run compile-sass`, make sure it works
and is way faster than `rake css:generate` used to be

Change-Id: I7d865ea6b3e374cdc27a883d2019a4c15746c0e2
Reviewed-on: https://gerrit.instructure.com/38416
Tested-by: Jenkins <jenkins@instructure.com>
Reviewed-by: Jeremy Stanley <jeremy@instructure.com>
QA-Review: Trevor deHaan <tdehaan@instructure.com>
Product-Review: Ryan Shaw <ryan@instructure.com>
2014-08-04 15:28:29 +00:00
James Williams 829478bc38 add support for tar and tar.gz archives in content migrations
also add limits for byte size and file count to prevent
zip/tar "bombs"

test plan:
 * import the package referenced in the ticket
 * should import successfully

 * content migration regressions

closes #CNVS-14303 #CNVS-14428

Change-Id: Ia424b5260e34f35b62ca47f7aafa77118c4f5b5b
Reviewed-on: https://gerrit.instructure.com/37881
Reviewed-by: Jeremy Stanley <jeremy@instructure.com>
Tested-by: Jenkins <jenkins@instructure.com>
QA-Review: Trevor deHaan <tdehaan@instructure.com>
Product-Review: James Williams  <jamesw@instructure.com>
2014-08-01 12:36:27 +00:00
Jon Jensen 4db746a1c0 don't allow locale names or codes to be overridden, fixes CNVS-14465
basically two changes:
1. ensure locales.yml is loaded last, to ensure we don't get any wonky
   overrides from translators
2. don't send those strings off for translation any more

test plan:
1. in a rails console w/ RAILS_LOAD_ALL_LOCALES=true, confirm that:
   >  I18n.backend.direct_lookup("nl", "qualified_locale")
  => "nl-NL"`
2. run `rake i18n:generate` and confirm that "qualified_locale" does
   not appear anywhere in ./config/locales/generated/en.yml
3. in canvas (w/ RAILS_LOAD_ALL_LOCALES=true), change your locale to
   "Nederlands (Crowd Sourced)"
4. confirm that you can still view wiki pages

Change-Id: I3923f58d7b9433a9e5e062e16e1556d79f845ae4
Reviewed-on: https://gerrit.instructure.com/38475
Reviewed-by: Cody Cutrer <cody@instructure.com>
Reviewed-by: Brian Palmer <brianp@instructure.com>
Tested-by: Jenkins <jenkins@instructure.com>
QA-Review: Steven Shepherd <sshepherd@instructure.com>
Product-Review: Matt Fairbourn <mfairbourn@instructure.com>
2014-07-31 16:48:58 +00:00
Jacob Fugal daf6143e0b session_affects_permissions -> permissions_key
fixes CNVS-13711

test-plan:
 - regression tests of:
   * permissions of admin with pending invitation to a course
   * user that typically would not have access to a portfolio, but
     visited the portfolio with a verifier string earlier in the session
     (but has no verifier string now)
   * access to attachments on the safe file domain

Change-Id: Ie321c77655e6ba5e87fd35a079086a48608f5d0e
Reviewed-on: https://gerrit.instructure.com/38029
Tested-by: Jenkins <jenkins@instructure.com>
QA-Review: August Thornton <august@instructure.com>
Reviewed-by: Nick Cloward <ncloward@instructure.com>
Product-Review: Jacob Fugal <jacob@instructure.com>
2014-07-30 16:16:18 +00:00
Jeremy Stanley 6b7f0b3dc4 ignore zip entries containing '..' elements or symlinks
extract core unzip functionality into canvas_unzip gem, and put
security logic there. use this gem instead of shelling out to
`unzip` (which does not have the option to skip symlinks).

test plan:
 1. import 'evil_course_2.imscc' from CNVS-14338
    * there should be an import warning
    * you should get a blank syllabus body and
      definitely not see sensitive system data
 2. import 'evil_sis_import.zip' from CNVS-14346
    * a file called '/tmp/pwn3d' should not have been
      created on your app server
 3. sanity check the parts of canvas that unzip things:
    * course copy
    * course import
    * zip content imports via the API
    * zip file uploads from files page
    * assignment submission comments download/upload
    * sis imports

fixes CNVS-14338
fixes CNVS-14346

Change-Id: I38fa141653eb7bc483e99a28a135831b8cb3b2a6
Reviewed-on: https://gerrit.instructure.com/37959
Reviewed-by: Cody Cutrer <cody@instructure.com>
QA-Review: Clare Strong <clare@instructure.com>
Tested-by: Jenkins <jenkins@instructure.com>
Product-Review: Jeremy Stanley <jeremy@instructure.com>
2014-07-24 15:41:21 +00:00
Brian Palmer 1c1455185b log auditor events to the rails log
closes CNVS-14174

test plan: Generate some audit events, such as login/logout and grade
changes. grep your canvas log for AUDITOR lines, which should contain
a json object with the attributes of the audit event.

Change-Id: Icbf67b94120e2e22ba656e673edc04ab30de5945
Reviewed-on: https://gerrit.instructure.com/37572
Reviewed-by: Jacob Fugal <jacob@instructure.com>
Tested-by: Jenkins <jenkins@instructure.com>
QA-Review: Jeremy Putnam <jeremyp@instructure.com>
Product-Review: Brian Palmer <brianp@instructure.com>
2014-07-23 14:26:25 +00:00
Cody Cutrer 2148803b55 don't use a rake_tasks bundler group
it's nonstandard, and messes with spring

Change-Id: I6e9d4a663d5bfb94f58028613f70176eec23a637
Reviewed-on: https://gerrit.instructure.com/37827
Reviewed-by: Cameron Sutter <csutter@instructure.com>
Tested-by: Jenkins <jenkins@instructure.com>
Product-Review: Cody Cutrer <cody@instructure.com>
QA-Review: Cody Cutrer <cody@instructure.com>
2014-07-21 19:36:07 +00:00
Cody Cutrer f20c2a144e fix caching of non-persisted objects
refs CNVS-13848

they can't be cached, because they likely differ

Change-Id: I9f4a98f0bad4da399d02e10b0165892245584dff
Reviewed-on: https://gerrit.instructure.com/37406
Tested-by: Jenkins <jenkins@instructure.com>
Reviewed-by: Nick Cloward <ncloward@instructure.com>
QA-Review: Clare Strong <clare@instructure.com>
Product-Review: Cody Cutrer <cody@instructure.com>
2014-07-19 00:42:14 +00:00
Jon Willesen ddcd5403ed add content parameters to course_home_sub_navigation lti launch
fixes CNVS-13798

test plan:
 - copy the xml configuration for the lti-tool-provider example
   lti app to a local file.
 - modify the xml by duplicating the migration_selection
   extension, changing the extension name to
   course_home_sub_navigation
 - configure the lti app on a course by pasting the modified xml
 - navigate to the course home page and open the network tab on
   the web inspector
 - launch the tool by clicking on its button on the right
   sidebar
 - inspect the POST request to the lti app and verify that 4
   "ext_content_" parameters are present:
   - intended_use
   - return_types
   - file_extensions
   - return_url
 - click on one of the supported links
 - should be redirected to the "tool use finished" page.

Change-Id: If5df5657c64377fdb2badca1d890c73e95548fbc
Reviewed-on: https://gerrit.instructure.com/37834
Reviewed-by: Brad Humphrey <brad@instructure.com>
QA-Review: Clare Strong <clare@instructure.com>
Tested-by: Jenkins <jenkins@instructure.com>
Product-Review: Bracken Mosbacker <bracken@instructure.com>
2014-07-17 22:41:23 +00:00
Jon Jensen 14319fd7e8 update _core_en.js for rails3
since rails3 is the default, check in the new version so that others
don't get prompted to

test plan:
n/a, see spec ... in the real world compile_assets will ensure it is
current. this file is in version control to ensure dev i18n.js doesn't
asplode if you aren't compiling assets

Change-Id: I182b0864fd8fe4c4176fd71f695e19f6f7b405a9
Reviewed-on: https://gerrit.instructure.com/37795
Tested-by: Jenkins <jenkins@instructure.com>
Reviewed-by: Cody Cutrer <cody@instructure.com>
Product-Review: Jon Jensen <jon@instructure.com>
QA-Review: Jon Jensen <jon@instructure.com>
2014-07-17 18:20:32 +00:00
Brian Palmer c001001f0d machine-readable output from i18n autoimport task
refs CNVS-14225

Change-Id: I38cf5c2dbfae6f1812b7c0b6a866a8f55c2a76a7
Reviewed-on: https://gerrit.instructure.com/37686
Tested-by: Jenkins <jenkins@instructure.com>
Reviewed-by: Jon Jensen <jon@instructure.com>
Product-Review: Brian Palmer <brianp@instructure.com>
QA-Review: Brian Palmer <brianp@instructure.com>
2014-07-15 16:45:24 +00:00
Jacob Fugal d9c6e2a0cd clarify Slug vs. UUID and fix event stream
refs CNVS-13987

what was called CanvasUuid was *not* generating UUIDs. it was generating
slugs. by default, its generate method only creates 4 character slugs.
these should obviously not be used as UUIDs. the misnomer already caused
a bug in EventStream where it used these slugs as UUIDs, causing
collisions. to fix:

 (1) rename canvas_uuid gem to canvas_slug, and rename it's primary
     class CanvasUuid to CanvasSlug
 (2) create new canvas_uuid gem, with class CanvasUUID, extracted from
     lib/uuid_singleton for actual UUID generation
 (3) fix event stream use CanvasUUID, rather than following the rename
     of CanvasUuid to CanvasSlug

test-plan:
 - have cassandra set up for audit logs
 - create an audit log entry (e.g. change a grade)
 - look at the generated audit log entry's id field; it should be a UUID
   value, not a 4 character slug

Change-Id: I19758fff4433cd6cb2e21219217dced19ee05c5a
Reviewed-on: https://gerrit.instructure.com/37506
Reviewed-by: Rob Orton <rob@instructure.com>
Tested-by: Jenkins <jenkins@instructure.com>
QA-Review: August Thornton <august@instructure.com>
QA-Review: Jeremy Putnam <jeremyp@instructure.com>
Product-Review: Brian Palmer <brianp@instructure.com>
2014-07-11 16:58:42 +00:00
Brad Humphrey 4df13caca0 substitute nil values when substitution is present
Test Plan:
 - It should substitute empty variables
   * $Canvas.account.sisSourceId
   * $Canvas.course.sisSourceId
   * $Canvas.user.sisSourceId

Change-Id: Iecbe0f6d2ccff2a0664bd4ec98102a1f3db173b1
Reviewed-on: https://gerrit.instructure.com/37163
Reviewed-by: Nathan Mills <nathanm@instructure.com>
Tested-by: Jenkins <jenkins@instructure.com>
QA-Review: Clare Strong <clare@instructure.com>
Product-Review: Brad Humphrey <brad@instructure.com>
2014-07-11 16:13:27 +00:00
Nick Cloward f96ef2c3d1 make permission_cache_key_for shard aware
fixes: CNVS-13917

Moves the initializer from active record base to an alias method chain
on AdheresToPolicy::Instance methods.  The way its including the
instance methods did not allow it to override the
permission_cache_key_for method.

Test Case:

  - Flush cache
  - Open a Course
  - Look at the cache keys and all the ids should be global ids

Change-Id: Iac6a5ed95a800c27bd53fcb757cabd11976aef21
Reviewed-on: https://gerrit.instructure.com/37226
Tested-by: Jenkins <jenkins@instructure.com>
Reviewed-by: Cody Cutrer <cody@instructure.com>
QA-Review: Jeremy Putnam <jeremyp@instructure.com>
Product-Review: Nick Cloward <ncloward@instructure.com>
2014-07-11 16:11:17 +00:00
Cody Cutrer d00a9473f7 bump rails3 for security fix
Change-Id: Iaa403bbcea1aeb453bded5c068c0eb3b15bfcae0
Reviewed-on: https://gerrit.instructure.com/37320
Reviewed-by: Brian Palmer <brianp@instructure.com>
Tested-by: Jenkins <jenkins@instructure.com>
Product-Review: Cody Cutrer <cody@instructure.com>
QA-Review: Cody Cutrer <cody@instructure.com>
2014-07-07 16:55:55 +00:00
Joel Hough ef0fbc9f87 html_node_to_text doesn't emit src-less images
fixes CNVS-13449

test plan
- create a discussion topic with an image without a src attribute
- ensure that notification is sent for the topic

Change-Id: Idb87eaa955089197aaaa2247cc6172d8dd52c6ba
Reviewed-on: https://gerrit.instructure.com/36756
Tested-by: Jenkins <jenkins@instructure.com>
Reviewed-by: Braden Anderson <braden@instructure.com>
QA-Review: David Josse <david@instructure.com>
Product-Review: Joel Hough <joel@instructure.com>
2014-07-03 21:34:10 +00:00
Sterling Cobb ad0efde549 add accessiblity to sanitization
fixes CNVS-13697

When you create html markup in canvas, you should be able to add
accessible attributes and roles to elements. This commit allows you to
do that.

Test Plan

As a user that can edit a wiki page
When you edit a wiki page
And you toggle to edit the html
Then you add an aria attribute like aria-label
And you toggle back to the yswyg editor
And you toggle back into the html view
Then aria elements should still be on the html elements
And they should still be there when you save the page and inspect the
elements via developer tools.

Change-Id: Id443170fb3eabcbfcec58fd29b6fcfe1ea71279a
Reviewed-on: https://gerrit.instructure.com/36627
Reviewed-by: Jeremy Stanley <jeremy@instructure.com>
Tested-by: Jenkins <jenkins@instructure.com>
QA-Review: Clare Strong <clare@instructure.com>
Product-Review: Hilary Scharton <hilary@instructure.com>
2014-07-03 20:28:32 +00:00
Nick Cloward b995981ccc permissions are not caching correctly due to returns
fixes: CNVS-11197

Cleans and simplifies the code to remove the returns and nexts.
The block was short cuirciting the cache methods withe the returns.
Since the caching for permissions is more aggressive a few places in
specs need to clear the cache.

Test Plan:

- Clear cache
- Open a course page
- Check cache to make sure there are permission keys stored for that
  course.

Change-Id: Ib7f747242bfb4394a73876377f4b6ba632f8b728
Reviewed-on: https://gerrit.instructure.com/37100
Tested-by: Jenkins <jenkins@instructure.com>
Reviewed-by: Cody Cutrer <cody@instructure.com>
QA-Review: Jeremy Putnam <jeremyp@instructure.com>
Product-Review: Nick Cloward <ncloward@instructure.com>
2014-07-02 19:34:22 +00:00
Brad Humphrey 60f1719f07 refactor lti variable substitutor
to allow for a wider range of variable substitutions

Test Plan: All current variable substitutions should still work

Change-Id: I8260b73d05bc90059b2317ddabce4c064940ecc4
Reviewed-on: https://gerrit.instructure.com/36804
Tested-by: Jenkins <jenkins@instructure.com>
Reviewed-by: Nathan Mills <nathanm@instructure.com>
QA-Review: Caleb Guanzon <cguanzon@instructure.com>
Product-Review: Brad Humphrey <brad@instructure.com>
2014-07-01 21:29:30 +00:00
James Williams 58868f9cd4 allow video and audio html tags in html content
test plan:
* try to add audio and video tags in html content
* should not remove the tags when saving

closes #CNVS-9660

Change-Id: I46e363d2150f16a07ec8cf096be8b7652c437254
Reviewed-on: https://gerrit.instructure.com/36594
Tested-by: Jenkins <jenkins@instructure.com>
Product-Review: Jeremy Stanley <jeremy@instructure.com>
Reviewed-by: Jeremy Stanley <jeremy@instructure.com>
QA-Review: Caleb Guanzon <cguanzon@instructure.com>
2014-06-30 15:58:53 +00:00
James Williams 520af09347 don't sanitize title attributes in html content
test plan:
* try to save html content with a title attibute on an
 html element other than a or img:
 e.g. "<p title='a title'>text</p>"
* the attribute should not be removed

closes #CNVS-8357

Change-Id: Ib6bf534a75aa30fff8efc6345189114ff3718e1c
Reviewed-on: https://gerrit.instructure.com/36590
Tested-by: Jenkins <jenkins@instructure.com>
Reviewed-by: Jeremy Stanley <jeremy@instructure.com>
Product-Review: Jeremy Stanley <jeremy@instructure.com>
QA-Review: Caleb Guanzon <cguanzon@instructure.com>
2014-06-30 15:58:48 +00:00
Cody Cutrer b51d0898cd adheres_to_policy improvements
refs CNVS-11425

 * be more strict about the DSL
 * store policies so that we can avoid linear searches for
   an applicable condition block

Change-Id: I68f6414b396e1cb16d744d0719cdd6aa86085784
Reviewed-on: https://gerrit.instructure.com/36222
Tested-by: Jenkins <jenkins@instructure.com>
Reviewed-by: Nick Cloward <ncloward@instructure.com>
Product-Review: Cody Cutrer <cody@instructure.com>
QA-Review: Cody Cutrer <cody@instructure.com>
2014-06-24 15:32:00 +00:00
Brian Palmer 0a71091080 determine canvadocs http/https based on url
This is common functionality, so I pulled it out into the canvas_http
gem.

test plan: a canvadocs config using an http:// url should work, as well
as https:// urls which already worked.

Change-Id: I640445bfcf9b5c903d37aeb9db6c566430e2113d
Reviewed-on: https://gerrit.instructure.com/36760
Reviewed-by: Cameron Matheson <cameron@instructure.com>
Tested-by: Jenkins <jenkins@instructure.com>
Product-Review: Cameron Matheson <cameron@instructure.com>
QA-Review: Cameron Matheson <cameron@instructure.com>
2014-06-24 15:26:18 +00:00
Cody Cutrer 51fb498800 fix callback suspension for ruby 2
need to check for private methods

Change-Id: I5b51b3da9ab3baa8b619c10b684d96fe685a0c9d
Reviewed-on: https://gerrit.instructure.com/36749
Reviewed-by: Jacob Fugal <jacob@instructure.com>
Tested-by: Jenkins <jenkins@instructure.com>
Product-Review: Cody Cutrer <cody@instructure.com>
QA-Review: Cody Cutrer <cody@instructure.com>
2014-06-23 22:01:05 +00:00
Cody Cutrer 5e7d9a7f1f update hairtrigger
so it doesn't puke on newer rubies

Change-Id: I10524adc76478e7908d843c2936b91b795b9ab71
Reviewed-on: https://gerrit.instructure.com/36721
Reviewed-by: Rob Orton <rob@instructure.com>
Reviewed-by: Jon Jensen <jon@instructure.com>
Tested-by: Jenkins <jenkins@instructure.com>
Product-Review: Cody Cutrer <cody@instructure.com>
QA-Review: Cody Cutrer <cody@instructure.com>
2014-06-23 20:06:08 +00:00
Cody Cutrer 36de3c91e4 remove deprecation warning in ruby 2.1
Change-Id: I458ba8a1dc0d399d4a127712addf7f310994d098
Reviewed-on: https://gerrit.instructure.com/36726
Tested-by: Jenkins <jenkins@instructure.com>
Reviewed-by: Rob Orton <rob@instructure.com>
Product-Review: Cody Cutrer <cody@instructure.com>
QA-Review: Cody Cutrer <cody@instructure.com>
2014-06-23 19:33:08 +00:00