use file_download_url+verifier for discussion attachments

since these are attached to the user now, instead of
the course, after commit 5ab1d2.

test plan:
 1. enable "let students attach files to discussions" in
    a course's settings.
 2. create a graded discussion.
 3. as a student, post to the discussion and attach a file.
 4. as a teacher, view the post in SpeedGrader
    and ensure the attachment can be downloaded

fixes CNVS-9572

Change-Id: I503fb63db8325c5851408cc4d092aafad7afe10f
Reviewed-on: https://gerrit.instructure.com/26468
Tested-by: Jenkins <[email protected]>
QA-Review: Matt Fairbourn <[email protected]>
Reviewed-by: Bracken Mosbacker <[email protected]>
Product-Review: Bracken Mosbacker <[email protected]>

app/views/discussion_topics/_entry.html.erb

@@ -61,10 +61,11 @@
     <div class="message user_content"><%= user_content(entry.try_rescue(:message)) || nbsp %></div>
     <textarea class="message_html" style="display: none;"><%= h(entry.try_rescue(:message)) %></textarea>
     <div class="link_box">
-      <div class="attachment_data" style="<%= hidden unless entry && entry.attachment %>; float: left;">
-        <%= before_label :attached_file, "Attached File" %> <a href="<%= context_url(entry_context, :context_file_download_url, entry && entry.attachment ? entry.attachment_id : "{{ attachment_id }}") %>" class="attachment_name"><%= entry.try_rescue(:attachment).try_rescue(:display_name) || nbsp %></a>
-        <a href="<%= context_url(entry_context, :context_file_download_url, "{{ attachment_id }}") %>" class="entry_attachment_url" style="display: none;">&nbsp;</a>
-      </div>
+      <% if entry && entry.attachment %>
+        <div class="attachment_data" style="float: left;">
+          <%= before_label :attached_file, "Attached File" %> <a href="<%= file_download_url(entry.attachment, :verifier => entry.attachment.uuid) %>" class="attachment_name"><%= entry.attachment.try_rescue(:display_name) || nbsp %></a>
+        </div>
+      <% end %>
       <div class="clear"></div>
     </div>
     <div class="subcontent" style="<%= hidden if entry && entry.new_record? %>">

spec/selenium/teacher_speed_grader_spec.rb

@@ -183,8 +183,9 @@
         create!(:user => student, :message => first_message)
     entry.update_topic
     entry.context_module_action
+    attachment_thing = attachment_model(:context => student_2, :filename => 'horse.js')
     entry_2 = discussion_topic.discussion_entries.
-        create!(:user => student_2, :message => second_message)
+        create!(:user => student_2, :message => second_message, :attachment => attachment_thing)
     entry_2.update_topic
     entry_2.context_module_action
 
@@ -201,6 +202,9 @@
     in_frame 'speedgrader_iframe' do
       f('#main').should_not include_text(first_message)
       f('#main').should include_text(second_message)
+      url = f('#main div.attachment_data a')['href']
+      url.should be_include "/files/#{attachment_thing.id}/download?verifier=#{attachment_thing.uuid}"
+      url.should_not be_include "/courses/#{@course}"
     end
   end