From 8aa4f1e60c5a0b11f5c600819673d50f3300b715 Mon Sep 17 00:00:00 2001 From: Min RK Date: Thu, 31 Dec 2015 10:43:31 +0100 Subject: [PATCH] allow zmq check_origin with no args terminado may call `self.check_origin()` in which case we should grab origin from the headers. --- notebook/base/zmqhandlers.py | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/notebook/base/zmqhandlers.py b/notebook/base/zmqhandlers.py index 542e8ca2a..6a7b5bdcb 100644 --- a/notebook/base/zmqhandlers.py +++ b/notebook/base/zmqhandlers.py @@ -121,7 +121,7 @@ class WebSocketMixin(object): max(3 * self.ping_interval, WS_PING_INTERVAL) ) - def check_origin(self, origin): + def check_origin(self, origin=None): """Check Origin == Host or Access-Control-Allow-Origin. Tornado >= 4 calls this method automatically, raising 403 if it returns False. @@ -130,7 +130,9 @@ class WebSocketMixin(object): return True host = self.request.headers.get("Host") - + if origin is None: + origin = self.get_origin() + # If no header is provided, assume we can't verify origin if origin is None: self.log.warn("Missing Origin header, rejecting WebSocket connection.")