8737 Commits (efdbef117f17ecdf1b8bbae00aabdcef141d6f02)

 

All Branches   

Search

Author	SHA1	Message	Date
Min RK	efdbef117f	get xsrf from cookie, not body data ... so that it can't be skimmed with a GET of the page	9 years ago
Min RK	c5bb329bf8	use tornado xsrf token in API ... - Cookie-authenticated API requests must use set X-XSRFToken header - add utils.ajax for making ajax requests, adding xsrf header from default location	9 years ago
Min RK	fb8640a072	add token_authenticated property ... indicates if a token is used for authentication, in which case xsrf checks should be skipped.	9 years ago
Min RK	8abc6dff77	enable tornado xsrf cookie	9 years ago
Min RK	18596deffa	Backport PR #2003: Add 4.3.1 to changelog ... Signed-off-by: Min RK <benjaminrk@gmail.com>	9 years ago
Min RK	8e3cc4eab4	traitlets api backport ... 4.x doesn't use traitlets 4.2 API	9 years ago
Grant Nestor	8b77f0002e	Backport PR #1994: Further highlight token info in log output	9 years ago
Min RK	dd8bf2b91b	Backport PR #1985: Ignore resize events that bubbled up and didn't come from window. ... See https://bugs.jquery.com/ticket/9841 - we were having a major slowdown in interact widgets because the output areas were triggering a 'resize' event, which was bubbling up to the window object and running a function which required a DOM read. Signed-off-by: Min RK <benjaminrk@gmail.com>	9 years ago
Min RK	6ada253bd9	Backport PR #1975: add Authorization to allowed CORS headers ... so that CORS requests can use token authentication in the Authorization header by default. cf https://github.com/jupyterlab/jupyterlab/pull/1416 Signed-off-by: Min RK <benjaminrk@gmail.com>	9 years ago
Thomas Kluyver	f50aa57dab	Merge pull request #1983 from minrk/fixCR ... fix carriage return handling [backport]	9 years ago
Min RK	a77d5c3133	fix carriage return handling ... The only real fix is an errant `+` on the final replacement, which would end up skipping sequential replacements. - leaves trailing `\r` on the text, if there is one - use groups to avoid unnecessary replace calls (no change) - includes test	9 years ago
Thomas Kluyver	ad5c1a2c2e	Backport PR #1972: better docs for token auth ... - clearer description of defaults in help output for token - show how to get the token on the login page - add details about token auth to the security doc closes 1944 Signed-off-by: Min RK <benjaminrk@gmail.com>	9 years ago
Min RK	7cb285d813	Backport PR #1956: Make the font size more robust against fickle browser values. ... Also change the line-height multiplier to 1.3, which is closer to what the CSS is (I think it is 1.21 something.) Thanks to williamstein and haraldschilly for bringing this to our attention: https://github.com/sagemathinc/smc/issues/1262 We also re-enable auto scrolling for Firefox, since this might have been the issue. Signed-off-by: Min RK <benjaminrk@gmail.com>	9 years ago
Grant Nestor	a53a2152dc	release 4.3	9 years ago
Kyle Kelley	700495993c	Backport PR #1949: Fixed typo in 1st line of Browser Compatibility section ... Signed-off-by: Min RK <benjaminrk@gmail.com>	9 years ago
Thomas Kluyver	9e50aef668	Backport PR #1955: Add 4.3 to changelog ... takluyver Can you have a look?: https://github.com/gnestor/notebook/blob/4.3/docs/source/changelog.rst Signed-off-by: Min RK <benjaminrk@gmail.com>	9 years ago
Kyle Kelley	8f85f90b59	Backport PR #1947: Ensure variable is set if exc_info is falsey ... Closes gh-1940 Signed-off-by: Min RK <benjaminrk@gmail.com>	9 years ago
Min RK	5c5c45fc5d	Backport PR #1939: Add debug log for static file paths ... Too often I'm trying to track down an errant extra static file path (like some javascript installed in some obscure place). This makes it easy to see exactly what is being served. Signed-off-by: Min RK <benjaminrk@gmail.com>	9 years ago
Kyle Kelley	ab791441b2	Backport PR #1938: don't check origin on token-authenticated requests ... adds LoginHandler.should_check_origin classmethod API While testing, I noticed that we were checking origin and authentication on CSP violation reports, but browsers are sending CSP reports with no Origin, meaning that no CSP report will ever be accepted. That doesn't make sense to me, so I disabled both - a CSP report can now be made from *anywhere* (no auth, no check). rgbkrk does that sound right to you? Or should it be authenticated but no origin check? Signed-off-by: Min RK <benjaminrk@gmail.com>	9 years ago
Grant Nestor	45503a8c87	Backport PR #1952: Set mimerender index in `OutputArea.display_order`	9 years ago
Thomas Kluyver	19eac71065	Backport PR #1941: Catch and log handler exceptions in events.trigger ... rather than throwing handler errors in the call to `.trigger()`, which I think we don't expect to happen (at least our code suggest we don't). Extensions can register buggy event handlers. These should not be able to cause failures in the event-triggering code paths. This should fix several avenues by which extensions (or other bugs) could prevent a notebook from loading. This closes #1602 in that the bug doesn't prevent notebook loading, but it doesn't fix the original error _parente is seeing. I don't fully understand the cause there, because notebook loading doesn't start before the page has finished loading.	9 years ago
Kyle Kelley	0b4e999b15	Backport PR #1921: CodeMirror 5.21 ... Signed-off-by: Min RK <benjaminrk@gmail.com>	9 years ago
Kyle Kelley	1292d8bcc9	Backport PR #1919: remove leftover print statement ... from 1895 Signed-off-by: Min RK <benjaminrk@gmail.com>	9 years ago
Matthias Bussonnier	17c551e92c	Backport PR #1871: Allow None for post_save_hook ... See gh-1868 We're also discussing changes to traitlets that might avoid the need for this, in ipython/traitlets 342. But this is the simple fix. Signed-off-by: Min RK <benjaminrk@gmail.com>	9 years ago
Thomas Kluyver	8d3c7fc58c	Backport PR #1861: fix notebook mime-type on download links ... notebooks are not `application/json`, they are `application/x-ipynb+json`. This fixes Safari adding the `.json` extension to notebooks on download. Signed-off-by: Min RK <benjaminrk@gmail.com>	9 years ago
Thomas Kluyver	87c8b1af3c	Backport PR #1822: Convert readthedocs links for their .org -> .io migration for hosted projects ... As per [their blog post of the 27th April](https://blog.readthedocs.com/securing-subdomains/) ‘Securing subdomains’: > Starting today, Read the Docs will start hosting projects from subdomains on the domain readthedocs.io, instead of on readthedocs.org. This change addresses some security concerns around site cookies while hosting user generated data on the same domain as our dashboard. Test Plan: Manually visited all the links I’ve modified. Signed-off-by: Min RK <benjaminrk@gmail.com>	9 years ago
Matthias Bussonnier	8ea91b94d9	Backport PR #1792: Updated Jupyter Logos to Fit New Guidelines ... I have updated all the main Jupyter logos to fit the new Brand Guidelines. Signed-off-by: Min RK <benjaminrk@gmail.com>	9 years ago
Grant Nestor	97a2de59f3	Backport PR #1753: docs: Update dead links ... Hi, I tried to find corresponding articles in the new jupyter documentation Cheers Signed-off-by: Min RK <benjaminrk@gmail.com>	9 years ago
Min RK	1ab053447a	Backport PR #1736: Attempted to correct a URL that was a dead link. ... I was going through a tutorial in the documentation and found a dead (404) link. I inserted my best guess to the updated version. modified: docs/source/examples/Notebook/JavaScript Notebook Extensions.ipynb Signed-off-by: Min RK <benjaminrk@gmail.com>	9 years ago
Carol Willing	49fc47e2bb	Backport PR #1713: Add note on JupyterHub to docs ... Checked that it looks fine once built, wasn't sure if it was an appropriate use of an important block. addresses 1712 Signed-off-by: Min RK <benjaminrk@gmail.com>	9 years ago
Matthias Bussonnier	9d44ea2182	Backport PR #1669: If kernel is broken, start a new session ... Fixes https://github.com/jupyter/notebook/issues/1454 Signed-off-by: Min RK <benjaminrk@gmail.com>	9 years ago
Thomas Kluyver	3008da041b	Backport PR #1912: Fix highlighting of Python code blocks ... The configuration on RTD doesn't default to Python highlighting, it seems. http://jupyter-notebook.readthedocs.io/en/latest/comms.html Signed-off-by: Min RK <benjaminrk@gmail.com>	9 years ago
Matthias Bussonnier	930823b22a	Backport PR #1908: Improve `Notebook.render_cell_output` ... Continuation of https://github.com/jupyter/notebook/pull/1907 Signed-off-by: Min RK <benjaminrk@gmail.com>	9 years ago
Matthias Bussonnier	8eb55fd6ce	Backport PR #1907: Add `Notebook.render_cell_output` method ... Continuation of https://github.com/jupyter/notebook/pull/1866 and https://github.com/gnestor/notebook_json/pull/5 depends on this. Since extensions are _usually_ loaded after the notebook has loaded and outputs have been rendered, a mime type renderer extension requires an API method for re-rendering the output of a cell after the extension has loaded and registered its mime type using `OutputArea.register_mime_type`. This method allows extensions to do that by replacing a cell with itself which will trigger a re-render.	9 years ago
Thomas Kluyver	bffc23b704	Backport PR #1904: json_errors should be outermost decorator on API handlers ... in order to apply to 403 raised by web.authenticated	9 years ago
Min RK	c93bbb3dc9	Backport PR #1903: Allow websocket connections from scripts ... scripts don't set origin on connection we allow these on API requests, websockets should match. cc rgbkrk: is there a reason we block 'missing origin' websockets when we allow the same for API requests? Is it possible for a request from a sensible browser to be missing Host and/or Origin?	9 years ago
Kyle Kelley	b66a495073	Backport PR #1896: Accept JSON output data with mime type "application/*+json" ... Currently, output data must be a string unless the mime type equals “application/json”. This doesn’t allow JSON output data to be rendered by mime types such as “application/vnd.plotly.v1+json” or “application/vnd.vega+json”. This change simply allows JSON output data to be rendered by a custom mime renderer if the mime type includes “application/“ and “json”.	9 years ago
Kyle Kelley	e389144301	Backport PR #1895: Allow kernelspecs to have spaces in them for backward compat ... Fixes 1859	9 years ago
Kyle Kelley	f1b73dcb8c	Merge pull request #1917 from minrk/typeahead.min ... load minified typeahead.min.js	9 years ago
Thomas Kluyver	5fdc14df42	Backport PR #1887: Fix bug when attempting to remove old nbserver info files ... When list_running_servers find an old nbserver-xxxx.json info file, it attempts to delete it. It needs to use the full path rather than the filename. An exception was being raised, but the error was suppressed silently. This fixes issue 1886	9 years ago
Thomas Kluyver	d42825d4dc	Backport PR #1851: Update security docs to reflect new signature system ... Closes https://github.com/jupyter/notebook/issues/1848	9 years ago
Safia Abdalla	b3f7bc4a73	Backport PR #1503: remove discussion of IPython profiles from notebook signatures docs ... closes 1499	9 years ago
Min RK	35998b6baa	load minified typeahead	9 years ago
Thomas Kluyver	8489faa4cf	Backport PR #1838: terminal: Bump xterm.js to 2.0.1 ... Primary fix is better copy / paste support Release notes in https://github.com/sourcelair/xterm.js/releases/tag/2.0.1 Doesn't seem to break any styling, unlike the last update I made :)	9 years ago
Yuvi Panda	5d05b7d8d3	Backport PR #1759: Fix terminal styles bug ... Fixes https://github.com/jupyter/notebook/issues/1758 Before:  After: 	9 years ago
Kyle Kelley	754f397e9e	Backport PR #1831: enable token-authentication by default ... - add `NotebookApp.login_token`, used when `NotebookApp.password` is not set - store login_token, bool(password) in notebook server-info file - token is passed in the URL as `?token=long-token` - `jupyter notebook list` shows pasteable URLs with token Practical effects: - notebook servers are now authenticated by default - first connect with token sets a cookie - once a user has logged into one server with a token, their browser is logged in to all subsequent servers on the same system+port until cookie_secret changes. - users can no longer type the simple host:port into their browser to connect, until after the first successful login via token(simple URLs are fine if password is enabled). Truly public servers, such as tmpnb, will need to set `NotebookApp.token=''` to fully disable auth. cc Carreau, ellisonbg, rgbkrk, parente	9 years ago
Matthias Bussonnier	38c19214e4	Backport PR #1798: Add base aliases for nbextensions apps ... Includes `--log-level` alias that was missing from install/enable applications	9 years ago
Min RK	93be35d9f2	Backport PR #1764: Upgrade Codemirror to 5.18 ... Implements https://github.com/jupyter/notebook/issues/1686	9 years ago
Thomas Kluyver	543d07c21a	Backport PR #1763: Include `@` operator in Codemirror ipython mode ... Implements https://github.com/jupyter/notebook/issues/1689 issuecomment-241050962	9 years ago
Thomas Kluyver	3fbf5bbb5c	Backport PR #1650: Load extension in predictable order. ... Not doing this can lead to subtle incomprehensible issues when 2 extensions (eg, jupyterlab and jupyterlab_extensions) both register the same handlers, that will randomly at each start get a different extension take precedence.	9 years ago