historical code from reddit.com

Removing the counter was a terrible decision and I think most of us can agree on that!

So, lets start re-displaying the counter and forget it ever happened :smile:

The hot algorithm applies the "sign" of a post's score weirdly. This has been noticed before.

The time-based value is a large value that grows over time, so applying the sign to that yields weird results for posts with negative score. Not only do posts with a negative score rank lower than all positive posts, but older negative posts actually rank higher than newer negative posts, all else being equal.

Here's what I mean:

_hot(1, 0, 1262304000) #=> 2850.0
_hot(0, 1, 1262304000) #=> -2851.0
_hot(0, 1, 1353107345) #=> -4869.0

With this patch, it returns much more expected values:

_hot(1, 0, 1262304000) #=> 2850.0
_hot(0, 1, 1262304000) #=> 2850.0
_hot(0, 1, 1353107345) #=> 4868.0

I probably check this box 90% of the time I do a search on a subreddit page. The last time I checked (heh), RES checked this box by default as well. Thoughts?

a common use case, for example, is right click / open in incognito. it's not good to add links to history when that's the user's intent, so this function shouldn't be run on right clicks.

confession: this is a blind-ish PR I whipped up real fast without testing because my VM is dead. If someone with a running VM could test this, I'd appreciate it. Otherwise, I'll try to get it running again soon.

I do think it should work though. Pretty simple change.

TL;DR: Minor frontend bug / annoyance with HTML5 Youtube links in expando. HTML5 Youtube embeds are missing the fullscreen button. I added an attribute "allowfullscreen" to the iframe, and now it works! Yay!

To reproduce:

1. Go to http://www.youtube.com/html5, enable html5 videos
2. Click expando on any youtube video on reddit
3. Note the missing fullscreen button in the embedded player

In order to allow embedded html5 youtube videos to have a fullscreen option in expando, the containing iframe needs to have attribute "allowfullscreen".

See W3C Fullscreen Specifications, Section 7: Security and Privacy Considerations:

To prevent embedded content from going fullscreen only embedded content specifically allowed via the allowfullscreen attribute of the HTML iframe element will be able to go fullscreen. This prevents untrusted content from going fullscreen.

Proof that this fix works: http://imgur.com/a/pM13I

Also removed mailto from valid_schemes, because mailto: scheme would never get accepted as it could not pass the checks further in the function (according to urlparse, it does not contain a hostname).

This pull request updates submission page's subreddit auto-completion dropdown to not show over18 subreddits if user's over18 pref is false, which mirrors the behavior of subreddit topic recommender bar at http://www.reddit.com/subreddit (See: https://github.com/reddit/reddit/blob/master/r2/r2/controllers/api.py#L3179).

Steps to reproduce:

1. login to reddit
2. uncheck the over18 pref checkbox
3. go to the submission page and type "pics" into the subreddit input text field

Expected result:

The auto-completion dropdown box shows a list of non-over18 subreddits that have "pics" as their prefix.

Actual result:

The auto-completion dropdown shows the following subreddits:

• pics
• picsofmenwiththings
• picsofharlequincats
• PicsOfHorseDicks [over18]
• PicsOfCanineVaginas [over18]
• Picsofryanrunning
• picsofnathancowley
• picsofporn [over18]
• picsofdannyjsleeping
• PicsOfStonedMexicans

The proposed update makes it so that those subreddits only show up if they have set their account's over18 pref to true.

Lastly, it does so without breaking existing API clients by preserving the previous behavior as the default option for POST_search_reddit_names.

1. Make IPs trusted for evaluating X-Forwarded-For configurable with new INI keyword trusted_proxy_ranges, a comma-separated list of CIDR specs (or bare IPs). Move hard-coded trusted IPs 127.0.0.1 or 10.0.0.0/8 into example.ini.
2. Bug fixes in X-Forwarded-For processing:
   • remove whitespace around extracted IP which causes the memcached exception 'bad key' (see [1] for an example stacktrace)
   • extract correct IP when multiple IPs are present. The de facto spec[2] says that each proxy appends its peer's IP, which means the original requestor is the first IP, not the last.

[1] http://pastebin.com/1QQiRsgs

In this instance, the request is https terminated by nginx and then routed to Reddit via Varnish cache (instead of HAProxy) which automatically appends the remote IP per the de facto spec[2] for the X-Forwarded-For header.

Because there are effectively two proxies involved, the XFF header contains two IP addresses separated by a comma and a space. Having instrumented lib/cache.py:634, argument keys contained (note the leading whitespace) [' 127.0.0.1']. See the stack trace for the original contents of the XFF header.

[2] X-Forwarded-For is an uncodifed, de facto standard (now replaced by RFC 7239), however there are a number of reputable resources that show how it is supposed to work, for example:

http://docs.aws.amazon.com/ElasticLoadBalancing/latest/DeveloperGuide/x-forwarded-headers.html#x-forwarded-for https://www.citrix.com/blogs/2012/09/27/multiple-xff-ips/

Resolves this. This allows for posts that have nsfw in the title to determine the over_18 attribute, once, at creation, instead of forcing posts to be nsfw via the over_18 attribute "or" the fact that it has the phrase "nsfw" in some form. Because of the fact that it only does this at creation, the over_18 attribute can be changed successfully, and the previous or statement takes no effect (and as such is removed).

Edit: Just realized the logic is ever so slightly off, so don't merge yet. As it is, any currently made nsfw post that doesn't have nsfw in the title may be auto unnsfwd, due to me adding the dummy check and that check is added, and then when the check needs to run the first time it will determine over_18 only based on the property. A check for if not self.over_18 before setting over_18 should correct it though, or you can do some server side magic to get all current nsfw submissions and set their over_18 value to True after implementing.

The only way to test travis is to deploy to master with a .travis.yml file and wait for travis-ci to pick up the change. To do some pre-testing here, the Vagrantfile has been split into two distinct machines:

• default is, as before, the full reddit build (we have an opportunity to rename this)
• travis is a minimal install with only the packages and services required to run nosetests against the codebase. It tries to mimic what will happen when we try to build this on travis-ci's workers.

As part of this addition, I've moved install-reddit.sh to install/reddit.sh and populated that install folder with common scripts used for both default and travis builds.

Ensures sidebar/description validate with the correct vmarkdown, monospaces/codes stylesheet, renders sidebar/description using regular markdown.

Fixes #754