22 Commits (4.2.x)

Author	SHA1	Message	Date
Min RK	4ad7bb3eac	Backport PR #1518: Allow requests to POST in OPTIONS requests ... Commit 65eb248209 introduced a bug by not allowing the POST method in OPTIONS requests (which is wrong since several parts of the API accept POST requests, for example creating a new kernel).	10 years ago
wenjun.swj	c99f859954	Backport PR #1631: scape file names in attachment headers ... encode file name in Content-Disposition when it contains non-ascii characters	10 years ago
Min RK	46b6829839	Backport PR #1325: Fix handling of preflight requests ... Hi, I believe I've found a bug in the way that OPTIONS requests are handled by the notebook server. Pre-flighted OPTIONS requests do not include authentication information, which means that we should not expect these to be authenticated and so should not be using the @web.authenticated decorator. Authentication will be validated when the real PUT/POST etc request is issued after the preflight. FWIW this behaviour is documented by others in different contexts (see for example: http://giix.nl/2015/03/10/cross-origin-resource-sharing-cors-and-kerberos-webserver-auth/). ...	10 years ago
Min RK	e4f5d040d1	Backport PR #931: Add simple iopub message rate limiter ... This is designed to alleviate notebook crashes due to an excess of messages passed to the frontend. This is a small part of a solution to the bigger problem. I mainly opened this PR to help students in @ellisonbg 's class this quarter avoid crashing their notebooks and losing data.	10 years ago
Min RK	8aa4f1e60c	allow zmq check_origin with no args ... terminado may call `self.check_origin()` in which case we should grab origin from the headers.	10 years ago
Steven Silvester	fe03de7471	Avoid error when using a cross-origin websocket	10 years ago
Jeroen Demeyer	17b3643891	Interpret mathjax_url relative to base_url	10 years ago
Min RK	c2c39a7c9d	move common websocket methods to WebSocketMixin ... - origin check - ws ping used by both kernels and terminals	10 years ago
Jonathan Frederic	831b2a523b	Merge pull request #472 from minrk/base-url-always-encoded ... avoid double-encoding base_url	10 years ago
Steven Silvester	65eb248209	Add the method to the correct base class	10 years ago
Min RK	8de725a8de	server-side fixes for double-escaped base_url	10 years ago
Zach Schwartz	2e16713e32	moved check_origin to IPythonHandler	10 years ago
Matthias Bussonnier	2d5d548d79	Revert "Use NPM, node ES5, and browserify."	11 years ago
Jonathan Frederic	81a2998fe0	Dynamically load contents, also browserify contents.	11 years ago
Matthias Bussonnier	d4b1e9aa99	Wrong default. ... Change from True to False after rename from use_bundle to ignore_minified_js	11 years ago
Matthias Bussonnier	f9ad56e206	Add option to not use minified javascript and ease developpement.	11 years ago
Min RK	b001be2c82	check origin of API requests ... protects agains CSRF on POST endpoints via forms.	11 years ago
Min RK	e4cc3a6ea2	FileFindHandler inherits from IPythonHandler ... in order to get default CSP headers	11 years ago
Min RK	5403d2479d	make content_security_policy a property ... and *add* `default-src: 'none'` to API handlers custom CSP applies to all handlers	11 years ago
Min RK	709ed0d04b	Add APIHandler base class ... - ensures all API responses are json - sets CSP to prevent js execution on all API replies	11 years ago
Min RK	1a91f8ce74	remove clusters tab from notebook ... moving to an nbextension in ipyparallel	11 years ago
Min RK	d71a59cc9f	s/jupyter_notebook/notebook	11 years ago