monkeyking

Commit Graph

Author	SHA1	Message	Date
Thomas Kluyver	74fbc5b578	Merge pull request #3008 from Carreau/autopawd When login-in via token, let a chance for user to set the password	8 years ago
Matthias Bussonnier	a8971410c1	Add option disabled changing password at login. Document the changing of password.	8 years ago
Min RK	1deb0aec16	tornado 5: PeriodicCallback loop arg will be removed (#3034 ) * tornado 5: PeriodicCallback loop arg will be removed PCs are always run with the current eventloop, which is what the explicitly passed loop always is for us already * Don't double-close socket & stream closing stream closes the socket * remove now-inaccurate comment	8 years ago
Thomas Kluyver	9a5c2c06ad	Merge pull request #2958 from kevin-bates/fix-2957-add-reason-to-json-errors Add 'reason' field to JSON error responses	8 years ago
Thomas Kluyver	e7f69cc2d7	Work on loading UI translations (#2969 ) * Load translations for Javascript in page template * Normalise language codes to gettext format with underscores * .mo files need to be under LC_MESSAGES as well * remove unused JS code * Normalise result in test * Fix for opening files on Py 2 * Fix location of I18N directory * Add translation files to package_data	8 years ago
Kevin Bates	ed3b0e4594	Set reason on HTTP errors, None otherwise.	8 years ago
Thomas Kluyver	55aa80e10f	Merge pull request #2920 from minrk/allow-origin-token allow token-authenticated requests cross-origin by default	8 years ago
Min RK	fea2ef258f	set cookie on base_url avoids clobbering cookies when multiple notebook servers are run on one host. Users can override `cookie_options.path = ‘/‘` if they want cookies to be shared across notebooks on one host.	8 years ago
Kevin Bates	b24aa5e023	Add 'reason' field to JSON error responses During the deprecation/removal of the `@json_errors` decorator, the `reason` field was not carried forward into the compatible replacement method `APIHandler.write_error`. This broke some client (tests) that relied on that field's presence. Fixes #2957.	8 years ago
Min RK	08f7189cba	only allow CORS exception when auth is enabled	8 years ago
Min RK	9acf6a80f4	allow token-authenticated requests cross-origin by default we already apply this logic in our server-side checks, but browsers check `Access-Control-Allow-Origin` headers themselves as well, meaning that token-authenticated requests can’t be made cross-origin without CORS headers from browsers, only scripts. This makes default browser and server-side origin checks consistent	8 years ago
Min RK	a8c6b8bab6	Fix some errors caused by raising 403 in get_current_user (#2919 ) get_current_user is called in a few places that really shouldn’t raise move the raising to `get_login_url`, which is called in `@web.authenticated`, where we want to replace redirect logic with 403.	8 years ago
Sam Lau	1c2a256add	Add x-xsrftoken to Access-Control-Allow-Headers When starting a kernel using the Jupyter Notebook Kernel API, web browsers will automatically check for the presence of `x-xsrftoken` in the Access-Control-Allow-Headers during the preflight CORS check ([ref][ref]). [ref]: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Access-Control-Allow-Headers Since we didn't allow this header before, web browsers would fail the preflight check even when the x-xsrftoken header isn't being used by the notebook server. This meant that running a webpage on localhost:8080 that used Javascript to start a kernel on a notebook server running on localhost:8888 would fail. How I tested this commit: 1. Start a notebook server using jupyter notebook --no-browser --NotebookApp.allow_origin="*" --NotebookApp.disable_check_xsrf=True --NotebookApp.token='' 2. Build the [web3](https://github.com/jupyter-widgets/ipywidgets/tree/master/examples/web3) example from ipywidgets. 3. In that directory, run `npm run host`. 4. Verify that visiting http://localhost:8080/ starts a kernel in the notebook server.	9 years ago
Min RK	4467dc9f12	specify version for deprecation	9 years ago
Min RK	962c5ccd80	stop using `@json_handlers`	9 years ago
Min RK	ba353e20f7	use .write_error on APIHandler instead of `@json_errors` for JSON error messages this is the standard tornado way to do it, and catches errors at the `prepare` stage, which method decorators do not	9 years ago
Min RK	92209228f6	raise 403 on APIHandler failed login instead of redirecting to human login page, which can have side effects	9 years ago
Min RK	d6a534ec5b	use RFC5987 encoding for filenames as described in RFC 6266 describing Content-Disposition	9 years ago
Grant Nestor	64ed6e439c	Don't url escape filenames on download	9 years ago
Min RK	0308dc78d9	ensure "default-src 'none'" CSP is added to APIHandlers even if custom Content-Security-Policy header is applied, which was previously setting the same value for both APIHandlers and page handlers	9 years ago
Thomas Kluyver	227704cda5	Merge pull request #2671 from minrk/dont-modify-headers avoid modifying settings['headers'] in add_default_headers	9 years ago
Min RK	f512880fcb	allow overriding csp report uri via tornado settings	9 years ago
Min RK	fb7ee6f348	avoid modifying settings['headers'] in add_default_headers Use a copy to avoid writing content security policy into settings['headers'], which can be a problem because APIHandlers have a stricter CSP than page handlers. If an API request is made before the first page request, pages will fail to load due to CSP violations.	9 years ago
Grant Nestor	5192d72c63	Merge pull request #2656 from agermanidis/master Use StaticFileHandler when files are local	9 years ago
Anastasis Germanidis	95a53b775e	Fixed bug in get_content_type	9 years ago
Anastasis Germanidis	180bbe88f6	Cleaning up AuthenticatedFileHandler.get	9 years ago
Anastasis Germanidis	539c2f7521	Added charset handling on AuthenticatedFileHandler	9 years ago
Anastasis Germanidis	a82a510199	Use static file handler when files are local	9 years ago
Thomas Kluyver	724bdd1570	Remove old websocket draft76 protocol. Support for this older protocol should no longer be needed with Phantom JS 2. Closes gh-2250	9 years ago
Krista	d3b94fa5f4	added robots.txt This commit fixes issue #1387 by adding a file `robots.txt` that makes robots go away. This commit is also similar to `316665e5d7` as it also adds the `favicon.ico`.	9 years ago
Min RK	a49397bf98	expose passthrough for WebSocketHandler.get_compression_options adds `NotebookApp.websocket_compression_options` configurable, with a default of None (no compression)	9 years ago
Thomas Kluyver	a051f24e0d	Don't call sys_info() at import time	9 years ago
Min RK	32a353378a	track REST API activity add /api/status endpoint for retrieving current status includes - started: start time of the server - last_activity: latest activity across all endpoints - connections: number of current connections - kernels: number of current kernels	9 years ago
Thomas Kluyver	666ecbf35c	Merge pull request #2011 from minrk/unwebpack unwebpackify	9 years ago
Thomas Kluyver	4917ba4d44	Merge pull request #1991 from minrk/template-log-message remove debug statement about no custom error page template	9 years ago
Min RK	47d4451958	remove webpack shims restore explicit imports of jquery, etc.	9 years ago
Min RK	86c6268f64	prose review	9 years ago
Min RK	d6f091c443	allow disabling xsrf check for deployments that want to grant unfettered access, even from anonymous API requests	9 years ago
Min RK	9478a6b82b	use tornado xsrf token in API - Cookie-authenticated API requests must use set X-XSRFToken header - add utils.ajax for making ajax requests, adding xsrf header from default location	9 years ago
Min RK	70e79a0ad6	add token_authenticated property indicates if a token is used for authentication, in which case xsrf checks should be skipped.	9 years ago
Min RK	4a8af93b5b	enable tornado xsrf cookie	9 years ago
Min RK	3f32d7da00	remove debug statement about no custom error page template We don't need a message when the default error page is used	9 years ago
Min RK	a51efa5acc	add Authorization to allowed CORS headers so that CORS requests can be token-authenticated	9 years ago
Min RK	38060d001e	Merge pull request #1939 from jupyter/static-file-log Add debug log for static file paths	9 years ago
Thomas Kluyver	283042c675	Ensure variable is set if exc_info is falsey Closes gh-1940	9 years ago
Min RK	1e070a50f5	don't check origin on token-authenticated requests adds LoginHandler.should_check_origin classmethod API	9 years ago
Jason Grout	ec13af58d7	Add debug log for static file paths	9 years ago
Min RK	7621fae43e	include PATH in cross-origin blocking log message makes it clearer what's being blocked	9 years ago
Min RK	8d7e430b89	Allow websocket connections from scripts scripts don't set origin on connection we allow these connections on API requests, websockets should match.	9 years ago
Min RK	bf249669e1	call it token login_token is redundant	9 years ago

1 2

84 Commits (081dcd577461112ab06e8e82a430ed8f66f95fca)