Disable completion of R code inside quotes, closes #401 (#413)

* Disbale completion of R code inside quotes, closes #401

* Also set files = FALSE

Co-authored-by: Barret Schloerke <barret@rstudio.com>

* Add news and comment

Co-authored-by: Barret Schloerke <barret@rstudio.com>

NEWS.md

@@ -34,7 +34,8 @@ learnr (development version)
 * Fixed unexpected behavior for `question_is_correct.learnr_text()` where `trim = FALSE`. Comparisons will now happen with the original input value, not the `HTML()` formatted answer value. ([#376](https://github.com/rstudio/learnr/pull/376))
 * Fixed exercise progress spinner being prematurely cleared. ([#384](https://github.com/rstudio/learnr/pull/384))
 * Updated `run_tutorial()` to render tutorials in a temp directory if the R user does not have write permissions. ([#347](https://github.com/rstudio/learnr/issues/347))
-* An informative error is now thrown when an exercise chunk's body contains nothing, which lets the tutorial author know that something (e.g., empty line(s)) must be present in the chunk body for it to be rendered as an exercise. ([#410](https://github.com/rstudio/learnr/issues/410)) ([#172](https://github.com/rstudio/learnr/issues/172)) 
+* An informative error is now thrown when an exercise chunk's body contains nothing, which lets the tutorial author know that something (e.g., empty line(s)) must be present in the chunk body for it to be rendered as an exercise. ([#410](https://github.com/rstudio/learnr/issues/410)) ([#172](https://github.com/rstudio/learnr/issues/172))
+* When `exercise.completion=TRUE`, completion is no longer performed inside of quotes. This (intentionally) prevents the student from being able to list files on the R server ([#401](https://github.com/rstudio/learnr/issues/401)).
 
 learnr 0.10.1
 ===========

R/http-handlers.R

@@ -184,10 +184,13 @@ register_http_handlers <- function(session, metadata) {
                       function.suffix = "(")
     on.exit(do.call(utils::rc.options, as.list(options)), add = TRUE)
 
+    # If and when exercises gain access to files, then we should evaluate this
+    # code in the exercise dir with `quotes = TRUE` (and sanitize to keep
+    # filename lookup local to exercise dir)
     settings <- utils::rc.settings()
     utils::rc.settings(ops = TRUE, ns = TRUE, args = TRUE, func = FALSE,
                        ipck = TRUE, S3 = TRUE, data = TRUE, help = TRUE,
-                       argdb = TRUE, fuzzy = FALSE, files = TRUE, quotes = TRUE)
+                       argdb = TRUE, fuzzy = FALSE, files = FALSE, quotes = FALSE)
     on.exit(do.call(utils::rc.settings, as.list(settings)), add = TRUE)
 
     # temporarily attach global setup to search path