Commit Graph

5755 Commits

Author SHA1 Message Date
Brian Simpson
84e609ee3b ModAction: if target is an Account, set target_author to target.
This will include the author name in json views of add/remove for
ban/contributor/mod/etc.
2015-04-06 13:43:41 -04:00
Jordan Milne
0ac2a06404 Don't let non-mods access the POST_subreddit_stylesheet endpoint
Thanks to a report by @lamiejang. Non-mods were able to modify the
`/config/stylesheet` wiki page, as well as nullify the stylesheet.
2015-04-06 09:23:41 -07:00
Jordan Milne
7ec1bfa057 Add scary comment about g.debug to the default development.update
It's not obvious that `g.debug = True` is bad to do in prod unless you've
read `example.ini` as well.
2015-04-06 09:23:16 -07:00
Florence Yeun
fc58af5cc1 Comment embeds: Set iframe width/height using style attribute
This helps prevent the iframe width and height from unintentionally
being set by user stylesheets.
2015-04-02 13:25:01 -07:00
Neil Williams
eff0a20da3 example.ini: Remove gzipper middleware from pipeline.
It is causing issues with local static files in development mode and
we'll probably be replacing it in the near future.
2015-04-02 11:54:30 -07:00
Chris Stephens
063bcf70ac Add logged out user tracking library and append to tracking pixel 2015-04-01 13:33:29 -07:00
Chris Stephens
22625aceda Api: Add another 'where' to user/where end point 2015-04-01 13:32:53 -07:00
Chad Birch
86ae3690bf WikiPage.revise(): handle content being None 2015-03-31 16:51:25 -06:00
xiongchiamiov
c1e2796da7 Force default og:image to https
If we can't figure out a good image to hint as a thumbnail for a page via
`og:image`, we set it to the reddit snoo icon.  However, we have been making
this a protocol-relative url.  This doesn't appear to be against [the spec][0],
but it does create problems for some scrapers.

Now we force it to be an https url, which should resolve some of those issues.

[0]: http://opengraphprotocol.org/#url
2015-03-31 14:50:54 -07:00
Chad Birch
0fbea80d45 Integrate AutoModerator into the site 2015-03-31 14:56:19 -06:00
Chad Birch
26d9ac4d7f WikiPage: touch LastModified on edit 2015-03-31 14:55:07 -06:00
Chad Birch
f0869100a4 Add new_media_embed amqp message 2015-03-31 14:55:01 -06:00
Chad Birch
1089c951b3 Add new_report amqp message 2015-03-31 14:54:54 -06:00
Florence Yeun
f4109ba70f Comment embeds: Increase click area for read more link 2015-03-31 10:24:20 -07:00
Chad Birch
fa2f128c3f automatic_reddits: only force to front page
Previously, automatic_reddits had two effects: they were added to the
list of default subscriptions, and also always forced to the front page
as long as the user hadn't unsubscribed. This change makes it so that
they are no longer added to the list of defaults, so that we can force
/r/modnews to the front page for mods without also effectively
subscribing every user to it by default.
2015-03-30 13:55:42 -06:00
Chad Birch
908203811b pref_creddit_autorenew: default off for non-gold 2015-03-27 15:53:24 -06:00
Chad Birch
4b9aee9266 Fix mods without gold disabling comment highlight 2015-03-27 15:52:19 -06:00
Chad Birch
85d11840a3 Fix blocking from username mentions 2015-03-27 15:50:08 -06:00
Jordan Milne
e77007c993 Add filter for safely inlining JSON in <script> tags 2015-03-27 12:57:29 -07:00
Jordan Milne
e591b16eb9 Replace VUser() overload with VVerifyPassword()
The VUser way made it too easy to make a mistake. Something like

    VUser('password')

wouldn't even check the password unless the `default` kwarg was set!
2015-03-27 12:41:51 -07:00
umbrae
ad4554f2db Spacing fix in suggested sorts 2015-03-26 20:46:39 -07:00
umbrae
e0f361127f Strip embed tokens - a manual revert of c0fcb63 2015-03-26 20:46:34 -07:00
umbrae
c846d26bcd Trending: only add to stack if not None 2015-03-26 20:46:28 -07:00
umbrae
ceaeddb1f1 Add c-hidden helper component css class 2015-03-26 20:46:07 -07:00
umbrae
69a129b5eb Add hook to hot display pane and home sidebox. 2015-03-26 20:45:57 -07:00
Keith Mitchell
86a3d262f2 random_reddits requires a LIST of sr_ids 2015-03-26 15:39:12 -07:00
Keith Mitchell
619e37d1f1 Pass sr_ids, not subreddits, to random_reddits 2015-03-26 15:39:05 -07:00
xiongchiamiov
a6a0e51fdf Comment threads: remove hot sort
Hot doesn't make much sense for comments because it was designed for threads.
There are very *very* few people who use it in comments, and we suspect most of
those are on accident - we don't provide good descriptions of what the sorts
are, so it's not obvious which of 'hot', 'best', and 'top' you should choose
when looking at a comment thread (particularly when 'hot' is the default for
submission listings).
2015-03-26 11:31:10 -07:00
xiongchiamiov
25764c8efb Contest mode: allow mods to sort however
Contest mode originally forced the sort to `top` for mods to assist in choosing
winners.  However, /u/timotab [pointed out][0] that the ability to use `new` as well
would be useful for moderation.

Now mods are able to use whichever sort method they wish when browsing a thread
in contest mode.

[0]: https://www.reddit.com/r/modnews/comments/2z913o/moderators_new_features_for_testing_before/cpgyzm7
2015-03-26 10:37:52 -07:00
Brian Simpson
d87bc9573c Comment.add_props: cleanly handle missing parents. 2015-03-26 13:27:59 -04:00
Keith Mitchell
e6c508167b Lowercase query-param'ed LabeledMulti IDs
LabeledMultis are case sensitive and always lowercase in Cassandra.
2015-03-25 14:47:41 -07:00
MelissaCole
48979b5337 Prefs page: fix bad merge resolution
This fixes an unexpected keyword argument error that was introduced in
reddit/reddit@f3147ee. error_style_override and generic_error have not been
specified in the code yet.
2015-03-25 11:28:13 -07:00
Neil Williams
3704a48da5 js.py: Collect localized_appendices in nested LocalizedModules.
Previously, localized_appendices would be ignored in nested
LocalizedModules because the Module.build() step would just call
get_source() on the nested module.  This caused the plural forms
expression to not be properly appended to the reddit-init and
reddit-init-legacy modules since they nest the reddit-init-base module.
2015-03-25 09:53:32 -07:00
Jordan Milne
9d455d0235 Fix escaping of comment embed code inside the <textarea>
Thanks to a report by Tim McCormack (/u/phyzome). This fixes an issue
where someone embedding comments on their site could XSS themselves on
*their own* site if the parent post of the comment had HTML in the title.
2015-03-24 13:30:53 -07:00
MelissaCole
082ddb7e63 Support utf-8 in gilding giftmessage 2015-03-24 13:25:12 -07:00
Neil Williams
9313263c00 i18n: Add NP_ to babel extraction keywords.
The strings in timetext.js weren't being extracted. This fixes that and
will allow, after a translation cycle, live timestamps to be properly
translated.
2015-03-24 11:15:19 -07:00
David Wick
afca9c746f Force https when validating sensitive information 2015-03-24 09:32:35 -07:00
Brian Simpson
f060da53c3 cache stats: Don't count localcache hits. 2015-03-23 18:08:20 -04:00
xiongchiamiov
12a8eec564 Q&A sort: condense menu text
It looked weird with spaces in it.
2015-03-23 13:18:14 -07:00
Brian Simpson
0e147fc276 MultiReddit.get_all_comments: don't lookup Subreddits. 2015-03-23 03:09:49 -04:00
Brian Simpson
7d8334db34 DefaultSR.get_all_comments: don't lookup Subreddits. 2015-03-23 03:09:49 -04:00
Brian Simpson
650f77f0f9 subreddit.get_links_sr_ids: don't lookup Subreddits. 2015-03-23 03:09:49 -04:00
Brian Simpson
9d93c78b50 pages: Force stale Subreddit lookups. 2015-03-23 03:09:48 -04:00
Brian Simpson
d16d8880f3 Subreddit: do stale lookups in default_subreddits() and user_subreddits(). 2015-03-23 03:09:48 -04:00
Brian Simpson
e233fb1626 Subreddit.random_reddits: use stale lookup of automatic reddits. 2015-03-23 03:09:48 -04:00
Brian Simpson
2216f5eae5 LabeledMulti: Allow stale Subreddits. 2015-03-23 03:09:42 -04:00
Brian Simpson
3eee11fd80 Don't load LabeledMultis' subreddits when they're not needed. 2015-03-23 03:09:37 -04:00
xiongchiamiov
8c3504a2c6 Q&A sort: don't collapse comments on permalink pages
The comment-hiding behavior of Q&A sort has been confusing when viewing a
comment permalink, since it is fairly likely all the comments would be hidden.
This is particularly problematic when the user hasn't explicitly set the sort
for that page, eg by having it set as their default through the sticky sort
behavior or due to a subreddit- or thread-default sort.

Now we don't do any hiding of comments due to Q&A sort on permalink pages.
2015-03-20 13:18:15 -07:00
Florence Yeun
a292d3615f Comment embeds: Fix embed code selection
Fix bug where embed code was not always selected when clicking to
focus on the textarea.
2015-03-20 11:31:16 -07:00
Florence Yeun
00b64d239b Comment embeds: Increase spacing between checkboxes 2015-03-20 11:31:16 -07:00