Commit Graph

5778 Commits

Author SHA1 Message Date
Neil Williams
19c497dff3 New comment highlighting: restrict scope of timestamp selector.
In reworking new comment highlighting I introduced a regression that
caused child comments to share the timestamp of their parent regardless
of their own time. This was caused by an insufficiently specific
selector.

The structure of a nested comment view looks like:

    <div class="comment">
        <div class="entry">
            <p class="tagline">
                <time>
                <time class="edited-timestamp">
        <div class="child">
            <div class="listing">
                <div class="comment">
                    ...

Selecting '.tagline time' from beneath '.comment' would pick up child
comment timestamps as well and we'd overwrite their timestamp cache. We
would also pick up edited timestamps, but that doesn't appear to do
anything bad since they're not live.

This fixes the bug by specifically sticking to the direct descendants.
2015-04-09 08:59:32 -07:00
Florence Yeun
79cabad2ce Hide subscriber count for private subreddits 2015-04-08 15:26:39 -07:00
Florence Yeun
13dddf722b Remove unused variables from template function score() 2015-04-08 15:26:34 -07:00
Florence Yeun
fe2fc34ca4 Search API: enforce obey_over18
Do not include nsfw results for api and rss requests when obey_over18=true.
2015-04-08 15:26:11 -07:00
Neil Williams
268a629713 New comment highlighting: Remove server-side pv_hex stuff.
Previously, the server would check the user's previous visits when
rendering a comment page and add comment-period-N classes to comments
depending on where they fell in relation to those visits.  The client
side would then add or remove a new-comment class to every comment with
the appropriate (or older) comment-period class on first load or when
the previous visit selection changed.

This removes that server-side addition of comment-period-N classes and
replaces it with ScrollUpdater-based updating of comments based on their
actual timestamps. The goal is to reduce some server-side ugliness and
extraneous memcached lookups.
2015-04-08 13:55:48 -07:00
Chad Birch
133c9d9f3d AutoModerator: ensure "standard" value is a string
Previously would cause silent crashes when trying to save if they
attempted to use an unhashable type (generally a list) as the value for
standard, such as: "standard: [one, two]".
2015-04-09 02:53:49 +09:00
Chad Birch
7c4ed2d7b9 AutoModerator: error if search check fails regex
Previously, an invalid search check key like
"body+title (includes)#name" would fail the regex, and throw an error by
trying to proceed in parse_match_fields_key() with the match object
being None. This caused the wiki validation to simply fail to save with
no error displayed at all.
2015-04-09 02:53:43 +09:00
Keith Mitchell
92cc540e16 OAuth2: OPTIONS pre-flights - don't check auth
Avoid checking client authentication during pre-flight requests, since the
browser won't be sending it.
2015-04-08 09:56:49 -07:00
Keith Mitchell
b6fc5e3773 OAuth: Create OAuth2OnlyController
This controller wraps up common functionality for controllers
that only serve endpoints that require OAuth to access. This includes
appropriate pagecaching (or lack thereof) and forced authentication
methods.
2015-04-08 09:56:39 -07:00
Keith Mitchell
2371f05922 Allow OPTIONS requests to private Subreddits 2015-04-08 09:56:30 -07:00
Matt Lee
5f7526bc59 Use more accurate labels on TimeMenu. 2015-04-06 14:47:00 -07:00
Matt Lee
29642658fa Drop 'previous' from search input label. 2015-04-06 14:47:00 -07:00
Matt Lee
06c531127e ads: Catch potential js error if no ad is found. 2015-04-06 14:47:00 -07:00
Matt Lee
afd081840e ads: Don't load new ad on focus if page loaded in background. 2015-04-06 14:47:00 -07:00
Matt Lee
a959cd6153 Cleanup spotlight.js. 2015-04-06 14:47:00 -07:00
Matt Lee
29fd7aee2d Remove old files. 2015-04-06 14:47:00 -07:00
Matt Lee
a74636e196 ads: Fix broken event listener for visibilitychange.
I mistakenly assigned the event listener to the window, but the event fires on
the document. :(
2015-04-06 14:46:44 -07:00
Matt Lee
a6ee26f489 ads: Use visibilitychange event if supported.
For loading new ads, use visibilitychange event if supported (it generally is). This means that, in theory, a new ad should load in one of the following cases:

1. Active tab changes.
2. Browser is minimized then maximized.
3. Browser window is covered up then uncovered.
4. OS goes to sleep/is locked then woken up/unlocked.

This makes a lot more sense than the current trigger, which is just focus.
Unfortunately support for cases 2-4 is spotty, but almost all browsers support
case 1.
2015-04-06 14:46:20 -07:00
Matt Lee
977e0f1d25 ads: Force redraw when new ad is loaded. 2015-04-06 14:46:20 -07:00
Matt Lee
48fb42368f ads: Load new sponsored link when refocusing the window.
Loads a new ad when user re-focuses the window, under the following conditions:

1. Ad must be the active item in the spotlight box.
2. Ad must be visible (in the viewport and not hidden).
3. More than 1.5 seconds must have elapsed since the last ad was loaded.
2015-04-06 14:46:20 -07:00
Chris Stephens
f18f92e3f6 Tracking: Ensure logged out id doesnt get appended when logged in 2015-04-06 14:08:42 -07:00
Brian Simpson
03c2100823 Don't error when someone tries to save a Subreddit. 2015-04-06 14:29:15 -04:00
xiongchiamiov
406ee35ccc Widget: load secure images
As reported in reddit/reddit#1291, we've been loading some images in our embed
widgets (the old ones, not the new comment embeds) over http.  This causes
warnings in most browsers when the embedding page is loaded over https, since
we dropping down to insecure elements.

Now we're always loading them over https.  Alternatively, we could use
protocol-relative urls, but I figure there's no harm in always using https, and
it's simpler and causes fewer weird issues with browsers.
2015-04-06 11:08:08 -07:00
Brian Simpson
84e609ee3b ModAction: if target is an Account, set target_author to target.
This will include the author name in json views of add/remove for
ban/contributor/mod/etc.
2015-04-06 13:43:41 -04:00
Jordan Milne
0ac2a06404 Don't let non-mods access the POST_subreddit_stylesheet endpoint
Thanks to a report by @lamiejang. Non-mods were able to modify the
`/config/stylesheet` wiki page, as well as nullify the stylesheet.
2015-04-06 09:23:41 -07:00
Jordan Milne
7ec1bfa057 Add scary comment about g.debug to the default development.update
It's not obvious that `g.debug = True` is bad to do in prod unless you've
read `example.ini` as well.
2015-04-06 09:23:16 -07:00
Florence Yeun
fc58af5cc1 Comment embeds: Set iframe width/height using style attribute
This helps prevent the iframe width and height from unintentionally
being set by user stylesheets.
2015-04-02 13:25:01 -07:00
Neil Williams
eff0a20da3 example.ini: Remove gzipper middleware from pipeline.
It is causing issues with local static files in development mode and
we'll probably be replacing it in the near future.
2015-04-02 11:54:30 -07:00
Chris Stephens
063bcf70ac Add logged out user tracking library and append to tracking pixel 2015-04-01 13:33:29 -07:00
Chris Stephens
22625aceda Api: Add another 'where' to user/where end point 2015-04-01 13:32:53 -07:00
Chad Birch
86ae3690bf WikiPage.revise(): handle content being None 2015-03-31 16:51:25 -06:00
xiongchiamiov
c1e2796da7 Force default og:image to https
If we can't figure out a good image to hint as a thumbnail for a page via
`og:image`, we set it to the reddit snoo icon.  However, we have been making
this a protocol-relative url.  This doesn't appear to be against [the spec][0],
but it does create problems for some scrapers.

Now we force it to be an https url, which should resolve some of those issues.

[0]: http://opengraphprotocol.org/#url
2015-03-31 14:50:54 -07:00
Chad Birch
0fbea80d45 Integrate AutoModerator into the site 2015-03-31 14:56:19 -06:00
Chad Birch
26d9ac4d7f WikiPage: touch LastModified on edit 2015-03-31 14:55:07 -06:00
Chad Birch
f0869100a4 Add new_media_embed amqp message 2015-03-31 14:55:01 -06:00
Chad Birch
1089c951b3 Add new_report amqp message 2015-03-31 14:54:54 -06:00
Florence Yeun
f4109ba70f Comment embeds: Increase click area for read more link 2015-03-31 10:24:20 -07:00
Chad Birch
fa2f128c3f automatic_reddits: only force to front page
Previously, automatic_reddits had two effects: they were added to the
list of default subscriptions, and also always forced to the front page
as long as the user hadn't unsubscribed. This change makes it so that
they are no longer added to the list of defaults, so that we can force
/r/modnews to the front page for mods without also effectively
subscribing every user to it by default.
2015-03-30 13:55:42 -06:00
Chad Birch
908203811b pref_creddit_autorenew: default off for non-gold 2015-03-27 15:53:24 -06:00
Chad Birch
4b9aee9266 Fix mods without gold disabling comment highlight 2015-03-27 15:52:19 -06:00
Chad Birch
85d11840a3 Fix blocking from username mentions 2015-03-27 15:50:08 -06:00
Jordan Milne
e77007c993 Add filter for safely inlining JSON in <script> tags 2015-03-27 12:57:29 -07:00
Jordan Milne
e591b16eb9 Replace VUser() overload with VVerifyPassword()
The VUser way made it too easy to make a mistake. Something like

    VUser('password')

wouldn't even check the password unless the `default` kwarg was set!
2015-03-27 12:41:51 -07:00
umbrae
ad4554f2db Spacing fix in suggested sorts 2015-03-26 20:46:39 -07:00
umbrae
e0f361127f Strip embed tokens - a manual revert of c0fcb63 2015-03-26 20:46:34 -07:00
umbrae
c846d26bcd Trending: only add to stack if not None 2015-03-26 20:46:28 -07:00
umbrae
ceaeddb1f1 Add c-hidden helper component css class 2015-03-26 20:46:07 -07:00
umbrae
69a129b5eb Add hook to hot display pane and home sidebox. 2015-03-26 20:45:57 -07:00
Keith Mitchell
86a3d262f2 random_reddits requires a LIST of sr_ids 2015-03-26 15:39:12 -07:00
Keith Mitchell
619e37d1f1 Pass sr_ids, not subreddits, to random_reddits 2015-03-26 15:39:05 -07:00