Commit Graph

7240 Commits

Author SHA1 Message Date
David King
57cd593cc1 Add a simple profiling decorator for convenience
I've been using this and it's handy in a pinch
2016-02-18 15:34:59 -08:00
David King
8937ae2d3a Switch default Atom <content> type from XHTML to HTML
This is to resolve the problem that we can generate markdown with named entities
like `&nbsp;`. These are valid in XHTML's DTD but because entities aren't
namespaced they aren't valid in Atom documents, even within the XHTML namespace.
The fix is to switch to the RSS style double-escaped HTML type for `<content>`
blocks

Another approach would be to used numeric entities instead, but since we allow
users to type HTML entities we'd have to replace them too. That's a pretty large
change for such a small problem.

As a side effect of this approach, this means we also have to get rid of the
"[23 comments]" label on Link's feed items because the double-escaping breaks
the StringTemplate replacement
2016-02-18 15:34:55 -08:00
David King
5ec85af73b Fix absolute logo references in Atom feeds
Before:

    <icon>//www.reddit.com/static/icon.png</icon>

After:

    <icon>https://www.reddit.com/static/icon.png</icon>
2016-02-18 15:34:51 -08:00
David King
e87de77b1a Convert RSS feeds to Atom
[Atom](https://tools.ietf.org/html/rfc4287#section-4.1.2) is a format similar to RSS with [wide client support](https://en.wikipedia.org/wiki/Comparison_of_feed_aggregators#Web_feed_and_protocol_support) that fixes many of the warts in RSS. In particular, it has proper support for HTML without content sniffing, which will allow us to avoid XSS issues

![Up And Atom!](https://i.imgur.com/nbHbHg0.gif)
2016-02-18 15:34:42 -08:00
David King
8076ed13f1 Security fix: double escape more stuff in RSS feeds
We have our Mako filters set to escape HTML by default. Unfortunately RSS
requires double escaping in some places and not in others, so there isn't a
reasonable default. Here I have done a pass through the `.xml` templates to find
user data that's ending up single-escaped and added double escaping to them.

This requirement is because RSS grew HTML support organically in a way that
clients can't tell if a field actually contains HTML or not. Sometimes it's
double escaped, sometimes it's not. Clients have to take a guess by sniffing for
`&gt;` characters and hoping they get it right. This also means that it's
impossible for servers to reliably tell the clients which data this field
contains.

This is a bit of a ticking time bomb. Users may find ways to sneak in HTML in
the date field, or we may add new templates that forget to do double escaping on
little-used fields. I recommend that we switch these to use Atom which always
indicates whether the fields contain HTML or not. Work has started on this
conversion in another branch.

* ref https://www.reddit.com/r/AskNetsec/comments/41larg/titleheadbody_idmsgfeedsummarybodyimg/
* ref https://reddit.atlassian.net/browse/INFRA-721
* ref https://bugzilla.mozilla.org/show_bug.cgi?id=1240603
2016-02-18 15:33:59 -08:00
David King
6e71efa726 Fix a bug in compute_time_listings that would allow simultaneous runs
The cause of the bug is that if we fail to start because someone else has already started, we still delete their files.

From job-02 right now:

    write_permacache() # comment ("day", "week+
    write_permacache() # link ("day","week")
    write_permacache() # link ("day","week")
    write_permacache() # comment ("day", "week+
    write_permacache() # link ("month","year")
    write_permacache() # comment ("month", "ye+
2016-02-18 15:33:01 -08:00
David King
c5f26d235b Speed up mr_top permacache writes by about 30%
* Make them lockless, because mr_top is the only one that ever writes to it.
  This avoids a lot of memcached round trips
* Don't set them to permacache_memcaches. Delete from it instead.
  This keeps us from blowing out that whole cache with listings that will never
  be read out of every time mr_top runs.
* Fix a performance bug in _mr_tools.mr_reduce_max_per_key
2016-02-18 15:32:56 -08:00
Matt Lee
0935579316 Archived Posts: Don't show reply link on archived posts 2016-02-18 12:33:05 -05:00
Matt Lee
5f2ce4705b Cleanup: Remove old unvotable message
Conflicts:
	r2/r2/templates/link.html
2016-02-18 12:32:42 -05:00
Matt Lee
c65a25b97a Archived Posts: Add popup
Adds a popup in the same style as the one used for timeouts and locked
posts to archived posts.
2016-02-18 12:31:23 -05:00
Matt Lee
cb7fd862fb Archived Posts: Update infobar design
Conflicts:
	r2/r2/public/static/css/components/infobar.less
2016-02-18 12:31:04 -05:00
Matt Lee
e70b133f26 Cleanup: Pull out shared popup code
timeouts.js and locked.js have pretty much the same code for managing
their popups.  Pull this out into a file to reduce duplicate code, and
also make it easier to manage more of the same type of popup
2016-02-18 12:29:01 -05:00
Matt Lee
92fd7f967a Add timeouts and locked post templates consistently 2016-02-18 12:28:55 -05:00
Matt Lee
a9684fb125 CachedResults: Check data length in _insert_tuples
If the cached query doesn't exist yet, "data" will be an empty list.
If we try to insert >= 1000 items, the chunk of code under the
"would_truncate" condition will run and raise "IndexError: list index
out of range"
2016-02-18 12:28:23 -05:00
Matt Lee
4e7ff6bb2d SubredditRules: Fix new rule button bug 2016-02-18 12:28:17 -05:00
Matt Lee
f89142a799 Subreddit Rules: Mark strings for translation 2016-02-18 12:28:10 -05:00
Matt Lee
daddd8bbf7 Subreddit Rules: Update titles 2016-02-18 12:28:03 -05:00
Matt Lee
f763eea5f6 cleanup: Remove debugger statement 2016-02-18 12:27:28 -05:00
Matt Lee
e9f956080c Subreddit Rules: Preserve whitespace in rule titles 2016-02-18 12:27:21 -05:00
Matt Lee
d4eaef679b Reports: Add default text color to report form
This should make it harder for subreddit css to accidentally make
the report form unreadable, particularly in subreddits with dark themes.
2016-02-18 12:27:14 -05:00
Matt Lee
06ebd786a2 install-reddit: Add reddit-serve helper script
Runs the app in the terminal so you can see logs and use pdb.
2016-02-18 12:27:03 -05:00
Matt Lee
f900cf0e7b Embeds: Add missing window.r object 2016-02-18 12:26:29 -05:00
Matt Lee
67ff3e3f34 Timeouts: Filter user info exposed through API.
Some account information for users in permanent suspension, such as karma, are
still accessible through the api. This info is hidden on the site, so it should
be treated similarly in the API response.
2016-02-18 12:25:54 -05:00
Matt Lee
49a94a2d86 Fix timeout modal on report link. 2016-02-18 12:25:47 -05:00
Matt Lee
80e0212956 Timeouts: Disable email sharing in UI. 2016-02-18 12:25:37 -05:00
Matt Lee
c4ea9b1442 Remove link to reddit.tv in footer 2016-02-18 12:25:26 -05:00
Matt Lee
ef5ba6e33b Timeouts: Remove feature flags. 2016-02-18 12:25:13 -05:00
Matt Lee
f7d7167042 Add missing gold config to example.ini
The gold plugin is throwing an error on a fresh install without this.
2016-02-14 12:39:22 -08:00
Chad Birch
7099b63f5e Spam filter "all" setting: call admintools.spam()
This needs to be called on posts being removed by the "all" filter
setting to update some info on them and put them into the correct cached
queries so that they show up in pages where the mods expect them.
2016-02-12 13:00:35 -07:00
Chris Slowe
4d8bebd6bd Testing: fix broken eventcollector_test.py and link_test.py 2016-02-11 15:03:43 -08:00
Brian Simpson
c6c2f09427 vagrant: Ensure host's code path is set correctly
You can run `vagrant up` from any directory within a project--vagrant
will look for a Vagrantfile in the current directory and if it doesn't
find one walk up one directory, and repeat until it finds a Vagrantfile.
Previously the `code_share_host_path` was set assuming that `vagrant up`
would always be run from the root reddit directory. Now it is set from the
fixed known location of the Vagrantfile.
2016-02-11 10:36:39 -08:00
Chad Birch
9dd31e5c10 POST_selectflair: call format_html() correctly 2016-02-10 15:54:31 -07:00
Chris Slowe
d786830434 Events: add link rank (if available) to vote events 2016-02-10 13:52:04 -08:00
Chad Birch
3b39d7ba1a Handle "all" spam-filter level at time of posting
This was previously being done in the spam-filter itself, so if there
are site issues causing the filter to fall behind, subreddits that use
the "all" setting to initially remove all posts would have it stop
working until the filter was able to catch up.

This moves the check into the actual posting process so that it isn't
dependent on the filter at all (and will also make this setting function
on open-source installs where the spam-filter code isn't available).
2016-02-10 14:38:56 -07:00
Chris Slowe
107ddbd1b2 Testing: remove inapplicable url_flags test 2016-02-10 13:35:54 -08:00
MelissaCole
b601b510f9 Move report event process_notes logic 2016-02-10 13:25:49 -08:00
MelissaCole
d0e24626e8 Support new and old sitewide rules in report events 2016-02-10 13:15:44 -08:00
MelissaCole
310849093e Support subreddit rules in report events 2016-02-10 13:15:23 -08:00
Chris Slowe
81315c9829 Anti-Evil: Only update the global reports list when the user reports spam 2016-02-10 12:25:53 -08:00
Chris Slowe
fa06747bc3 Events: add target_age_seconds and target_title (for links) to applicable events on the event pipeline
For events with a notion of a `target`, this stores:

  * `target._age` as `target_age_seconds` in seconds.  This is derivable from the event timestamp and the `target_created_ts` but simpler to query if it's denormalized
  * For `Link`s, store the `target.title` as `target_title`.  The primary goal here is to add more context around reports in Interana.

Also add a test for the report event and fixup the existing tests.
2016-02-10 12:24:42 -08:00
Chris Slowe
be5106d4b9 Testing: fixup mocking in feature_test.py and eventcollector_tests.py 2016-02-10 12:23:42 -08:00
Chris Slowe
20f061eab3 Anti-Evil: add listing to drive /r/all/about/reports 2016-02-10 12:10:18 -08:00
13steinj
528cfcf867 Don't translate messages for gold gifts.
Sending a translated message is confusing for the recipient and can theoretically void an anonymous sender's privacy.
2016-02-10 12:02:40 -08:00
MelissaCole
cd8103a3d0 Clear up flat list buttons for deleted posts
Don't allow sharing, saving, or hiding a deleted post. A user can unsave and
unhide a deleted post so that it's not stuck in the user's saved/hidden lists.
2016-02-10 12:02:37 -08:00
Matt Lee
fc8c9a75a4 Sharing: Disable on links with comments disabled.
The share feature is currently broken on promoted links that have comments
disabled. Since the share feature relies on links having a comments thread,
hide it for any link with comments disabled.
2016-02-10 12:02:33 -08:00
Brian Simpson
6145561143 Set attributes on Wrapped search result 2016-02-10 11:58:11 -08:00
Tiffany Dohzen
6d2ce40fea Mod tools: Rename 'links' to 'posts' in menus 2016-02-10 10:54:34 -08:00
Tiffany Dohzen
3dbcba8bf8 Change reddiquette link to content policy on comment/PM compose box 2016-02-10 10:54:26 -08:00
Chad Birch
8031d388cb tdb_cassandra: remove obsolete report functions
These functions are no longer used for anything (and don't even work).
2016-02-09 13:58:36 -07:00
Chad Birch
ec2368a17a Thing/tdb_sql: remove unused get_cols/extra_props
Neither of these are used at all, so this code can be simplified a bit
by dropping them. get_cols was being specifically set to False in the
code so everything related to it being True was completely dead code.
2016-02-09 13:56:31 -07:00