monkeyking

Commit Graph

Author	SHA1	Message	Date
meeseeksdev[bot]	d20e36f3e7	Backport PR #2959 : set cookie on base_url (#3090 )	8 years ago
Min RK	a8c6b8bab6	Fix some errors caused by raising 403 in get_current_user (#2919 ) get_current_user is called in a few places that really shouldn’t raise move the raising to `get_login_url`, which is called in `@web.authenticated`, where we want to replace redirect logic with 403.	8 years ago
Sam Lau	1c2a256add	Add x-xsrftoken to Access-Control-Allow-Headers When starting a kernel using the Jupyter Notebook Kernel API, web browsers will automatically check for the presence of `x-xsrftoken` in the Access-Control-Allow-Headers during the preflight CORS check ([ref][ref]). [ref]: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Access-Control-Allow-Headers Since we didn't allow this header before, web browsers would fail the preflight check even when the x-xsrftoken header isn't being used by the notebook server. This meant that running a webpage on localhost:8080 that used Javascript to start a kernel on a notebook server running on localhost:8888 would fail. How I tested this commit: 1. Start a notebook server using jupyter notebook --no-browser --NotebookApp.allow_origin="*" --NotebookApp.disable_check_xsrf=True --NotebookApp.token='' 2. Build the [web3](https://github.com/jupyter-widgets/ipywidgets/tree/master/examples/web3) example from ipywidgets. 3. In that directory, run `npm run host`. 4. Verify that visiting http://localhost:8080/ starts a kernel in the notebook server.	8 years ago
Min RK	4467dc9f12	specify version for deprecation	8 years ago
Min RK	962c5ccd80	stop using `@json_handlers`	8 years ago
Min RK	ba353e20f7	use .write_error on APIHandler instead of `@json_errors` for JSON error messages this is the standard tornado way to do it, and catches errors at the `prepare` stage, which method decorators do not	8 years ago
Min RK	92209228f6	raise 403 on APIHandler failed login instead of redirecting to human login page, which can have side effects	8 years ago
Min RK	d6a534ec5b	use RFC5987 encoding for filenames as described in RFC 6266 describing Content-Disposition	9 years ago
Grant Nestor	64ed6e439c	Don't url escape filenames on download	9 years ago
Min RK	0308dc78d9	ensure "default-src 'none'" CSP is added to APIHandlers even if custom Content-Security-Policy header is applied, which was previously setting the same value for both APIHandlers and page handlers	9 years ago
Thomas Kluyver	227704cda5	Merge pull request #2671 from minrk/dont-modify-headers avoid modifying settings['headers'] in add_default_headers	9 years ago
Min RK	f512880fcb	allow overriding csp report uri via tornado settings	9 years ago
Min RK	fb7ee6f348	avoid modifying settings['headers'] in add_default_headers Use a copy to avoid writing content security policy into settings['headers'], which can be a problem because APIHandlers have a stricter CSP than page handlers. If an API request is made before the first page request, pages will fail to load due to CSP violations.	9 years ago
Grant Nestor	5192d72c63	Merge pull request #2656 from agermanidis/master Use StaticFileHandler when files are local	9 years ago
Anastasis Germanidis	95a53b775e	Fixed bug in get_content_type	9 years ago
Anastasis Germanidis	180bbe88f6	Cleaning up AuthenticatedFileHandler.get	9 years ago
Anastasis Germanidis	539c2f7521	Added charset handling on AuthenticatedFileHandler	9 years ago
Anastasis Germanidis	a82a510199	Use static file handler when files are local	9 years ago
Thomas Kluyver	724bdd1570	Remove old websocket draft76 protocol. Support for this older protocol should no longer be needed with Phantom JS 2. Closes gh-2250	9 years ago
Krista	d3b94fa5f4	added robots.txt This commit fixes issue #1387 by adding a file `robots.txt` that makes robots go away. This commit is also similar to `316665e5d7` as it also adds the `favicon.ico`.	9 years ago
Min RK	a49397bf98	expose passthrough for WebSocketHandler.get_compression_options adds `NotebookApp.websocket_compression_options` configurable, with a default of None (no compression)	9 years ago
Thomas Kluyver	a051f24e0d	Don't call sys_info() at import time	9 years ago
Min RK	32a353378a	track REST API activity add /api/status endpoint for retrieving current status includes - started: start time of the server - last_activity: latest activity across all endpoints - connections: number of current connections - kernels: number of current kernels	9 years ago
Thomas Kluyver	666ecbf35c	Merge pull request #2011 from minrk/unwebpack unwebpackify	9 years ago
Thomas Kluyver	4917ba4d44	Merge pull request #1991 from minrk/template-log-message remove debug statement about no custom error page template	9 years ago
Min RK	47d4451958	remove webpack shims restore explicit imports of jquery, etc.	9 years ago
Min RK	86c6268f64	prose review	9 years ago
Min RK	d6f091c443	allow disabling xsrf check for deployments that want to grant unfettered access, even from anonymous API requests	9 years ago
Min RK	9478a6b82b	use tornado xsrf token in API - Cookie-authenticated API requests must use set X-XSRFToken header - add utils.ajax for making ajax requests, adding xsrf header from default location	9 years ago
Min RK	70e79a0ad6	add token_authenticated property indicates if a token is used for authentication, in which case xsrf checks should be skipped.	9 years ago
Min RK	4a8af93b5b	enable tornado xsrf cookie	9 years ago
Min RK	3f32d7da00	remove debug statement about no custom error page template We don't need a message when the default error page is used	9 years ago
Min RK	a51efa5acc	add Authorization to allowed CORS headers so that CORS requests can be token-authenticated	9 years ago
Min RK	38060d001e	Merge pull request #1939 from jupyter/static-file-log Add debug log for static file paths	9 years ago
Thomas Kluyver	283042c675	Ensure variable is set if exc_info is falsey Closes gh-1940	9 years ago
Min RK	1e070a50f5	don't check origin on token-authenticated requests adds LoginHandler.should_check_origin classmethod API	9 years ago
Jason Grout	ec13af58d7	Add debug log for static file paths	9 years ago
Min RK	7621fae43e	include PATH in cross-origin blocking log message makes it clearer what's being blocked	9 years ago
Min RK	8d7e430b89	Allow websocket connections from scripts scripts don't set origin on connection we allow these connections on API requests, websockets should match.	9 years ago
Min RK	bf249669e1	call it token login_token is redundant	9 years ago
Min RK	3ba68d8cb7	enable token-authentication by default - add NotebookApp.login_token, used when NotebookApp.password is not set - store login_token, bool(password) in notebook server-info file - `jupyter notebook list` shows pasteable URLs with token General changes: - notebook servers are now authenticated by default - first connect with token sets a cookie - once a user has logged into one server with a token, their browser is logged in to all subsequent servers on the same system+port until cookie_secret changes	9 years ago
Min RK	6c5cca1328	Make login_available method LoginHandler.get_login_available There was a conflict for the .login_available property on LoginHandler itself causing the login form to render incorrectly when login_available should be False	9 years ago
Grant Nestor	fd03c87f43	Merge pull request #1565 from poke1024/mathjaxmml MathJax MML support	10 years ago
wenjun.swj	17a7fe76a9	encode file name in Content-Disposition when it contains non-ascii characters	10 years ago
Bernhard Liebl	ab8f837ce9	switch from MathJax configuration TeX-AMS_HTML-full to TeX-AMS-MML_HTMLorMML-full	10 years ago
Min RK	caca248b6f	Merge pull request #1518 from chultquist/master Allow requests to POST in OPTIONS requests	10 years ago
chultquist	144807bc3c	Allow requests to POST in OPTIONS requests Commit `65eb248209` introduced a bug by not allowing the POST method in OPTIONS requests (which is wrong since several parts of the API accept POST requests, for example creating a new kernel).	10 years ago
Bernhard Liebl	c52e8fdc77	make MathJax config parameter configurable (instead of hard coded)	10 years ago
Carl Hultquist	4a161fea12	Fix handling of preflight requests Pre-flighted OPTIONS requests do not include authentication information, which means that we should not expect these to be authenticated. Authentication will be validated when the real PUT/POST etc request is issued after the preflight.	10 years ago
Matthias Bussonnier	0601fc75ef	Merge pull request #1261 from cc272309126/master fix the bug that notebook websocket response can not compress	10 years ago

1 2

74 Commits (5.2.2)