authenticate local file access

adds AuthenticatedFileHandler, which extends StaticFileHandler with
a simple authentication check before providing access to files local
to the notebook dir.

IPython/frontend/html/notebook/handlers.py

@@ -107,6 +107,7 b' def authenticate_unless_readonly(f, self, *args, **kwargs):'
     @web.authenticated
     def auth_f(self, *args, **kwargs):
         return f(self, *args, **kwargs)
+
     if self.application.read_only:
         return f(self, *args, **kwargs)
     else:
@@ -174,6 +175,14 b' class AuthenticatedHandler(RequestHandler):'
         return "%s://%s" % (proto, self.request.host)
 
 
+class AuthenticatedFileHandler(AuthenticatedHandler, web.StaticFileHandler):
+    """static files should only be accessible when logged in"""
+
+    @authenticate_unless_readonly
+    def get(self, path):
+        return web.StaticFileHandler.get(self, path)
+
+
 class ProjectDashboardHandler(AuthenticatedHandler):
 
     @authenticate_unless_readonly

IPython/frontend/html/notebook/notebookapp.py

@@ -48,7 +48,8 b' from .kernelmanager import MappingKernelManager'
 from .handlers import (LoginHandler, LogoutHandler,
     ProjectDashboardHandler, NewHandler, NamedNotebookHandler,
     MainKernelHandler, KernelHandler, KernelActionHandler, IOPubHandler,
-    ShellHandler, NotebookRootHandler, NotebookHandler, RSTHandler
+    ShellHandler, NotebookRootHandler, NotebookHandler, RSTHandler,
+    AuthenticatedFileHandler,
 )
 from .notebookmanager import NotebookManager
 
@@ -104,7 +105,7 b' class NotebookWebApplication(web.Application):'
             (r"/notebooks", NotebookRootHandler),
             (r"/notebooks/%s" % _notebook_id_regex, NotebookHandler),
             (r"/rstservice/render", RSTHandler),
-            (r"/local/(.*)", web.StaticFileHandler, {'path' : notebook_manager.notebook_dir}),
+            (r"/local/(.*)", AuthenticatedFileHandler, {'path' : notebook_manager.notebook_dir}),
         ]
         settings = dict(
             template_path=os.path.join(os.path.dirname(__file__), "templates"),