hazza/jupyterhub
1
0
Fork 0
mirror of https://github.com/jupyterhub/jupyterhub.git synced 2025-10-11 03:52:59 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #3679 from minrk/forward-1.5

Browse Source 
Forward-port fixes from 1.5.0 security release
This commit is contained in:
Erik Sundell
2021-11-04 15:30:04 +01:00
committed by GitHub
parent f06902aa8f 3e185022c8
commit d076c55cca
3 changed files with 51 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

38
docs/source/changelog.md
View File

File diff suppressed because one or more lines are too long

4
jupyterhub/services/auth.py
View File

@@ -1023,8 +1023,8 @@ class HubAuthenticated:
self._hub_auth_user_cache = None self._hub_auth_user_cache = None
raise raise
# store tokens passed via url or header in a cookie for future requests # store ?token=... tokens passed via url in a cookie for future requests
url_token = self.hub_auth.get_token(self) url_token = self.get_argument('token', '')
if ( if (
user_model user_model
and url_token and url_token

12
jupyterhub/singleuser/mixins.py
View File

@@ -715,6 +715,18 @@ class SingleUserNotebookAppMixin(Configurable):
orig_loader = env.loader orig_loader = env.loader
env.loader = ChoiceLoader([FunctionLoader(get_page), orig_loader]) env.loader = ChoiceLoader([FunctionLoader(get_page), orig_loader])
def load_server_extensions(self):
# Loading LabApp sets $JUPYTERHUB_API_TOKEN on load, which is incorrect
r = super().load_server_extensions()
# clear the token in PageConfig at this step
# so that cookie auth is used
# FIXME: in the future,
# it would probably make sense to set page_config.token to the token
# from the current request.
if 'page_config_data' in self.web_app.settings:
self.web_app.settings['page_config_data']['token'] = ''
return r
def detect_base_package(App): def detect_base_package(App):
"""Detect the base package for an App class """Detect the base package for an App class