…Galaxy admins

Fix galaxyproject/security#29

[18.05] Restrict loading of JSON files on the server via the workflow API to Galaxy admins

Reported by @erasche in #7503 (comment),
broken in e439902

[18.09] Fix warning message formatting in sharing controller

The rename action works, the hide action fails.
Building this to fix
#7473.

`change_datatype` wasn't part of gxformat2, so this also requires
a new release of gxformat2 with galaxyproject/gxformat2#7

This fixes dataset being added to histories when the source
HDA is visible.

[19.01] Backport Fix post job actions for Database Operation tools, implement change_datatype for collection output

Use a relative output.publicPath to avoid 404 errors when serving with a url prefix

…ectly.

…is up with more improvements in the actual router.

…er__ links.

Otherwise state inputs contain history datasets.
This is a bug that might result in non-deterministic tool module
behavior.

whose child-workflow is included more than once.
Fixes #7261 and probably #6032

…ication

[19.01] Backport workflow output rectification

[19.01] Backport #7466: Don't display outputs that aren't going to be produced in workflow editor

[19.01] Backport fix saving imported subworkflows

[18.05] backport circleci testing

which will not strip safe HTML tags and attributes, which we use.

Also, restrict the possible values of `status` instead of trying to
escape it.

[19.01] Improve string escaping and changeset validation on toolshed

which will not strip safe HTML tags and attributes, which we use.

Also, restrict the possible values of `status` instead of trying to
escape it.

This will allow anyone with an up-to-date 19.01 server to run tests with multiple levels of subdirectories in the `test-data` directory.

We should only finalize collections up until the map over depth,
as indicated by the TODO that is now obsolete.
Fixes #5867 and probably
a bunch of other issues where workflows don't run to completion.

Fixes #998

[19.01] backport fix from #7519

[19.01] Fix float to int casting

and expand to the messageLarge method

[18.09] backport xss

[19.01] Delay workflow step execution for discovered & mapped-over input