From f384662df4465b4dba881304059843c3f5072390 Mon Sep 17 00:00:00 2001
From: Thomas Kluyver <thomas@kluyver.me.uk>
Date: Mon, 20 Feb 2017 13:28:06 +0000
Subject: [PATCH] Fix viewing HTML in sandboxed iframe

See gh-2203

The URL calculation was going wrong, so it was using a URL starting with
//files. This uses url_path_join() to get the separators right.
---
 notebook/templates/view.html | 2 +-
 notebook/view/handlers.py    | 5 +++--
 2 files changed, 4 insertions(+), 3 deletions(-)

diff --git a/notebook/templates/view.html b/notebook/templates/view.html
index 3e2dd54f2..935b397ce 100644
--- a/notebook/templates/view.html
+++ b/notebook/templates/view.html
@@ -23,7 +23,7 @@
     }
   </style>
   <div id="container">
-    <iframe id="iframe" sandbox="allow-scripts" src="{{base_url}}/files/{{file_path}}"></iframe>
+    <iframe id="iframe" sandbox="allow-scripts" src="{{file_url}}"></iframe>
   </div>
 </body>
 
diff --git a/notebook/view/handlers.py b/notebook/view/handlers.py
index 4d7e97844..4496a5294 100644
--- a/notebook/view/handlers.py
+++ b/notebook/view/handlers.py
@@ -6,7 +6,7 @@
 
 from tornado import web
 from ..base.handlers import IPythonHandler, path_regex
-from ..utils import url_escape
+from ..utils import url_escape, url_path_join
 
 class ViewHandler(IPythonHandler):
     """Render HTML files within an iframe."""
@@ -17,8 +17,9 @@ class ViewHandler(IPythonHandler):
             raise web.HTTPError(404, u'File does not exist: %s' % path)
 
         basename = path.rsplit('/', 1)[-1]
+        file_url = url_path_join(self.base_url, 'files', path)
         self.write(
-            self.render_template('view.html', file_path=url_escape(path), page_title=basename)
+            self.render_template('view.html', file_url=file_url, page_title=basename)
         )
 
 default_handlers = [