Fixed order of notebook loading and kernel starting.

For security reasons, the kernel should not be started until
after the notebook content is completely loaded and on the page.
This prevents people from creating notebooks that run nasty code
on the users machine at load time.

In order to implement this, we had to create a CodeCell.set_kernel
method that allows the kernel attribute of a CodeCell to be set
at a later time.  This also fixes some error messages we were
seeing related to the kernel's channels not being setup properly
when a send was attempted.

IPython/frontend/html/notebook/static/js/codecell.js

@@ -16,7 +16,9 b' var IPython = (function (IPython) {'
     var key   = IPython.utils.keycodes;
 
     var CodeCell = function (kernel) {
-        this.kernel = kernel;
+        // The kernel doesn't have to be set at creation time, in that case
+        // it will be null and set_kernel has to be called later.
+        this.kernel = kernel || null;
         this.code_mirror = null;
         this.input_prompt_number = null;
         this.tooltip_on_tab = true;
@@ -48,7 +50,7 b' var IPython = (function (IPython) {'
 
         // construct a completer only if class exist
         // otherwise no print view
-        if (IPython.Completer != undefined )
+        if (IPython.Completer !== undefined)
         {
             this.completer = new IPython.Completer(this);
         }
@@ -140,8 +142,14 b' var IPython = (function (IPython) {'
         return false;
     };
 
+
     // Kernel related calls.
 
+    CodeCell.prototype.set_kernel = function (kernel) {
+        this.kernel = kernel;
+    }
+
+
     CodeCell.prototype.execute = function () {
         this.output_area.clear_output(true, true, true);
         this.set_input_prompt('*');

IPython/frontend/html/notebook/static/js/notebook.js

@@ -888,6 +888,14 b' var IPython = (function (IPython) {'
         var base_url = $('body').data('baseKernelUrl') + "kernels";
         this.kernel = new IPython.Kernel(base_url);
         this.kernel.start(this.notebook_id);
+        // Now that the kernel has been created, tell the CodeCells about it.
+        var ncells = this.ncells();
+        for (var i=0; i<ncells; i++) {
+            var cell = this.get_cell(i);
+            if (cell instanceof IPython.CodeCell) {
+                cell.set_kernel(this.kernel)
+            };
+        };
     };
 
 
@@ -1076,10 +1084,6 b' var IPython = (function (IPython) {'
 
 
     Notebook.prototype.load_notebook_success = function (data, status, xhr) {
-        // Create the kernel before creating cells as they need to be passed it.
-        if (! this.read_only) {
-            this.start_kernel();
-        }
         this.fromJSON(data);
         if (this.ncells() === 0) {
             this.insert_cell_below('code');
@@ -1111,6 +1115,11 b' var IPython = (function (IPython) {'
                 width: 400
             });
         }
+        // Create the kernel after the notebook is completely loaded to prevent
+        // code execution upon loading, which is a security risk.
+        if (! this.read_only) {
+            this.start_kernel();
+        }
         $([IPython.events]).trigger('notebook_loaded.Notebook');
     };