Merge Security Pull Request: google-caja

Adds HTML sanitization.

The basics:

- untrusted HTML is always sanitized, with no warning
  (there is console logging for changes made)
- markdown is always treated as untrusted
- no warnings for simply excluded output (e.g. Javascript)
- CSS tags and attributes are always stripped from untrusted HTML
- never check whether HTML is "safe," only sanitize
- add 'Trust notebook' to File menu

IPython/html/static/base/js/security.js

@@ -0,0 +1,126 b''
+//----------------------------------------------------------------------------
+//  Copyright (C) 2014  The IPython Development Team
+//
+//  Distributed under the terms of the BSD License.  The full license is in
+//  the file COPYING, distributed as part of this software.
+//----------------------------------------------------------------------------
+
+//============================================================================
+// Utilities
+//============================================================================
+IPython.namespace('IPython.security');
+
+IPython.security = (function (IPython) {
+    "use strict";
+
+    var utils = IPython.utils;
+    
+    var noop = function (x) { return x; };
+    
+    var caja;
+    if (window && window.html) {
+        caja = window.html;
+        caja.html4 = window.html4;
+        caja.sanitizeStylesheet = window.sanitizeStylesheet;
+    }
+    
+    var sanitizeAttribs = function (tagName, attribs, opt_naiveUriRewriter, opt_nmTokenPolicy, opt_logger) {
+        // add trusting data-attributes to the default sanitizeAttribs from caja
+        // this function is mostly copied from the caja source
+        var ATTRIBS = caja.html4.ATTRIBS;
+        for (var i = 0; i < attribs.length; i += 2) {
+            var attribName = attribs[i];
+            if (attribName.substr(0,5) == 'data-') {
+                var attribKey = '*::' + attribName;
+                if (!ATTRIBS.hasOwnProperty(attribKey)) {
+                    ATTRIBS[attribKey] = 0;
+                }
+            }
+        }
+        return caja.sanitizeAttribs(tagName, attribs, opt_naiveUriRewriter, opt_nmTokenPolicy, opt_logger);
+    };
+    
+    var sanitize_css = function (css, tagPolicy) {
+        // sanitize CSS
+        // like sanitize_html, but for CSS
+        // called by sanitize_stylesheets
+        return caja.sanitizeStylesheet(
+            window.location.pathname,
+            css,
+            {
+                containerClass: null,
+                idSuffix: '',
+                tagPolicy: tagPolicy,
+                virtualizeAttrName: noop
+            },
+            noop
+        );
+    };
+    
+    var sanitize_stylesheets = function (html, tagPolicy) {
+        // sanitize just the css in style tags in a block of html
+        // called by sanitize_html, if allow_css is true
+        var h = $("<div/>").append(html);
+        var style_tags = h.find("style");
+        if (!style_tags.length) {
+            // no style tags to sanitize
+            return html;
+        }
+        style_tags.each(function(i, style) {
+            style.innerHTML = sanitize_css(style.innerHTML, tagPolicy);
+        });
+        return h.html();
+    };
+    
+    var sanitize_html = function (html, allow_css) {
+        // sanitize HTML
+        // if allow_css is true (default: false), CSS is sanitized as well.
+        // otherwise, CSS elements and attributes are simply removed.
+        var html4 = caja.html4;
+
+        if (allow_css) {
+            // allow sanitization of style tags,
+            // not just scrubbing
+            html4.ELEMENTS.style &= ~html4.eflags.UNSAFE;
+            html4.ATTRIBS.style = html4.atype.STYLE;
+        } else {
+            // scrub all CSS
+            html4.ELEMENTS.style |= html4.eflags.UNSAFE;
+            html4.ATTRIBS.style = html4.atype.SCRIPT;
+        }
+        
+        var record_messages = function (msg, opts) {
+            console.log("HTML Sanitizer", msg, opts);
+        };
+        
+        var policy = function (tagName, attribs) {
+            if (!(html4.ELEMENTS[tagName] & html4.eflags.UNSAFE)) {
+                return {
+                    'attribs': sanitizeAttribs(tagName, attribs,
+                        noop, noop, record_messages)
+                    };
+            } else {
+                record_messages(tagName + " removed", {
+                  change: "removed",
+                  tagName: tagName
+                });
+            }
+        };
+        
+        var sanitized = caja.sanitizeWithPolicy(html, policy);
+        
+        if (allow_css) {
+            // sanitize style tags as stylesheets
+            sanitized = sanitize_stylesheets(result.sanitized, policy);
+        }
+        
+        return sanitized;
+    };
+    
+    return {
+        caja: caja,
+        sanitize_html: sanitize_html
+    };
+
+}(IPython));
+

IPython/html/tests/base/security.js

@@ -0,0 +1,57 b''
+safe_tests = [
+    "<p>Hi there</p>",
+    '<h1 class="foo">Hi There!</h1>',
+    '<a data-cite="foo">citation</a>',
+    '<div><span>Hi There</span></div>',
+];
+
+unsafe_tests = [
+    "<script>alert(999);</script>",
+    '<a onmouseover="alert(999)">999</a>',
+    '<a onmouseover=alert(999)>999</a>',
+    '<IMG """><SCRIPT>alert("XSS")</SCRIPT>">',
+    '<IMG SRC=# onmouseover="alert(999)">',
+    '<<SCRIPT>alert(999);//<</SCRIPT>',
+    '<SCRIPT SRC=http://ha.ckers.org/xss.js?< B >',
+    '<META HTTP-EQUIV="refresh" CONTENT="0;url=data:text/html base64,PHNjcmlwdD5hbGVydCgnWFNTJyk8L3NjcmlwdD4K">',
+    '<META HTTP-EQUIV="refresh" CONTENT="0; URL=http://;URL=javascript:alert(999);">',
+    '<IFRAME SRC="javascript:alert(999);"></IFRAME>',
+    '<IFRAME SRC=# onmouseover="alert(document.cookie)"></IFRAME>',
+    '<EMBED SRC="data:image/svg+xml;base64,PHN2ZyB4bWxuczpzdmc9Imh0dH A6Ly93d3cudzMub3JnLzIwMDAvc3ZnIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv MjAwMC9zdmciIHhtbG5zOnhsaW5rPSJodHRwOi8vd3d3LnczLm9yZy8xOTk5L3hs aW5rIiB2ZXJzaW9uPSIxLjAiIHg9IjAiIHk9IjAiIHdpZHRoPSIxOTQiIGhlaWdodD0iMjAw IiBpZD0ieHNzIj48c2NyaXB0IHR5cGU9InRleHQvZWNtYXNjcmlwdCI+YWxlcnQoIlh TUyIpOzwvc2NyaXB0Pjwvc3ZnPg==" type="image/svg+xml" AllowScriptAccess="always"></EMBED>',
+    // CSS is scrubbed
+    '<style src="http://untrusted/style.css"></style>',
+    '<style>div#notebook { background-color: alert-red; }</style>',
+    '<div style="background-color: alert-red;"></div>',
+];
+
+var truncate = function (s, n) {
+    // truncate a string with an ellipsis
+    if (s.length > n) {
+        return s.substr(0, n-3) + '...';
+    } else {
+        return s;
+    }
+};
+
+casper.notebook_test(function () {
+    this.each(safe_tests, function (self, item) {
+        var sanitized = self.evaluate(function (item) {
+            return IPython.security.sanitize_html(item);
+        }, item);
+        
+        // string equality may be too strict, but it works for now
+        this.test.assertEquals(sanitized, item, "Safe: '" + truncate(item, 32) + "'");
+    });
+    
+    this.each(unsafe_tests, function (self, item) {
+        var sanitized = self.evaluate(function (item) {
+            return IPython.security.sanitize_html(item);
+        }, item);
+        
+        this.test.assertNotEquals(sanitized, item, 
+            "Sanitized: '" + truncate(item, 32) + 
+            "' => '" + truncate(sanitized, 32) + "'"
+        );
+        this.test.assertEquals(sanitized.indexOf("alert"), -1, "alert removed");
+    });
+});
  No newline at end of file

IPython/html/services/notebooks/filenbmanager.py

@@ -1,483 +1,483 b''
 """A notebook manager that uses the local file system for storage.
 
 Authors:
 
 * Brian Granger
 * Zach Sailer
 """
 
 #-----------------------------------------------------------------------------
 #  Copyright (C) 2011  The IPython Development Team
 #
 #  Distributed under the terms of the BSD License.  The full license is in
 #  the file COPYING, distributed as part of this software.
 #-----------------------------------------------------------------------------
 
 #-----------------------------------------------------------------------------
 # Imports
 #-----------------------------------------------------------------------------
 
 import io
 import os
 import glob
 import shutil
 
 from tornado import web
 
 from .nbmanager import NotebookManager
 from IPython.nbformat import current
 from IPython.utils.traitlets import Unicode, Bool, TraitError
 from IPython.utils.py3compat import getcwd
 from IPython.utils import tz
 from IPython.html.utils import is_hidden, to_os_path
 
 def sort_key(item):
     """Case-insensitive sorting."""
     return item['name'].lower()
 
 #-----------------------------------------------------------------------------
 # Classes
 #-----------------------------------------------------------------------------
 
 class FileNotebookManager(NotebookManager):
     
     save_script = Bool(False, config=True,
         help="""Automatically create a Python script when saving the notebook.
         
         For easier use of import, %run and %load across notebooks, a
         <notebook-name>.py script will be created next to any
         <notebook-name>.ipynb on each save.  This can also be set with the
         short `--script` flag.
         """
     )
     notebook_dir = Unicode(getcwd(), config=True)
     
     def _notebook_dir_changed(self, name, old, new):
         """Do a bit of validation of the notebook dir."""
         if not os.path.isabs(new):
             # If we receive a non-absolute path, make it absolute.
             self.notebook_dir = os.path.abspath(new)
             return
         if not os.path.exists(new) or not os.path.isdir(new):
             raise TraitError("notebook dir %r is not a directory" % new)
 
     checkpoint_dir = Unicode(config=True,
         help="""The location in which to keep notebook checkpoints
         
         By default, it is notebook-dir/.ipynb_checkpoints
         """
     )
     def _checkpoint_dir_default(self):
         return os.path.join(self.notebook_dir, '.ipynb_checkpoints')
     
     def _checkpoint_dir_changed(self, name, old, new):
         """do a bit of validation of the checkpoint dir"""
         if not os.path.isabs(new):
             # If we receive a non-absolute path, make it absolute.
             abs_new = os.path.abspath(new)
             self.checkpoint_dir = abs_new
             return
         if os.path.exists(new) and not os.path.isdir(new):
             raise TraitError("checkpoint dir %r is not a directory" % new)
         if not os.path.exists(new):
             self.log.info("Creating checkpoint dir %s", new)
             try:
                 os.mkdir(new)
             except:
                 raise TraitError("Couldn't create checkpoint dir %r" % new)
 
     def get_notebook_names(self, path=''):
         """List all notebook names in the notebook dir and path."""
         path = path.strip('/')
         if not os.path.isdir(self._get_os_path(path=path)):
             raise web.HTTPError(404, 'Directory not found: ' + path)
         names = glob.glob(self._get_os_path('*'+self.filename_ext, path))
         names = [os.path.basename(name)
                  for name in names]
         return names
 
     def path_exists(self, path):
         """Does the API-style path (directory) actually exist?
         
         Parameters
         ----------
         path : string
             The path to check. This is an API path (`/` separated,
             relative to base notebook-dir).
         
         Returns
         -------
         exists : bool
             Whether the path is indeed a directory.
         """
         path = path.strip('/')
         os_path = self._get_os_path(path=path)
         return os.path.isdir(os_path)
 
     def is_hidden(self, path):
         """Does the API style path correspond to a hidden directory or file?
         
         Parameters
         ----------
         path : string
             The path to check. This is an API path (`/` separated,
             relative to base notebook-dir).
         
         Returns
         -------
         exists : bool
             Whether the path is hidden.
         
         """
         path = path.strip('/')
         os_path = self._get_os_path(path=path)
         return is_hidden(os_path, self.notebook_dir)
 
     def _get_os_path(self, name=None, path=''):
         """Given a notebook name and a URL path, return its file system
         path.
 
         Parameters
         ----------
         name : string
             The name of a notebook file with the .ipynb extension
         path : string
             The relative URL path (with '/' as separator) to the named
             notebook.
 
         Returns
         -------
         path : string
             A file system path that combines notebook_dir (location where
             server started), the relative path, and the filename with the
             current operating system's url.
         """
         if name is not None:
             path = path + '/' + name
         return to_os_path(path, self.notebook_dir)
 
     def notebook_exists(self, name, path=''):
         """Returns a True if the notebook exists. Else, returns False.
 
         Parameters
         ----------
         name : string
             The name of the notebook you are checking.
         path : string
             The relative path to the notebook (with '/' as separator)
 
         Returns
         -------
         bool
         """
         path = path.strip('/')
         nbpath = self._get_os_path(name, path=path)
         return os.path.isfile(nbpath)
 
     # TODO: Remove this after we create the contents web service and directories are
     # no longer listed by the notebook web service.
     def list_dirs(self, path):
         """List the directories for a given API style path."""
         path = path.strip('/')
         os_path = self._get_os_path('', path)
         if not os.path.isdir(os_path):
             raise web.HTTPError(404, u'directory does not exist: %r' % os_path)
         elif is_hidden(os_path, self.notebook_dir):
             self.log.info("Refusing to serve hidden directory, via 404 Error")
             raise web.HTTPError(404, u'directory does not exist: %r' % os_path)
         dir_names = os.listdir(os_path)
         dirs = []
         for name in dir_names:
             os_path = self._get_os_path(name, path)
             if os.path.isdir(os_path) and not is_hidden(os_path, self.notebook_dir)\
                     and self.should_list(name):
                 try:
                     model = self.get_dir_model(name, path)
                 except IOError:
                     pass
                 dirs.append(model)
         dirs = sorted(dirs, key=sort_key)
         return dirs
 
     # TODO: Remove this after we create the contents web service and directories are
     # no longer listed by the notebook web service.
     def get_dir_model(self, name, path=''):
         """Get the directory model given a directory name and its API style path"""
         path = path.strip('/')
         os_path = self._get_os_path(name, path)
         if not os.path.isdir(os_path):
             raise IOError('directory does not exist: %r' % os_path)
         info = os.stat(os_path)
         last_modified = tz.utcfromtimestamp(info.st_mtime)
         created = tz.utcfromtimestamp(info.st_ctime)
         # Create the notebook model.
         model ={}
         model['name'] = name
         model['path'] = path
         model['last_modified'] = last_modified
         model['created'] = created
         model['type'] = 'directory'
         return model
 
     def list_notebooks(self, path):
         """Returns a list of dictionaries that are the standard model
         for all notebooks in the relative 'path'.
         
         Parameters
         ----------
         path : str
             the URL path that describes the relative path for the
             listed notebooks
         
         Returns
         -------
         notebooks : list of dicts
             a list of the notebook models without 'content'
         """
         path = path.strip('/')
         notebook_names = self.get_notebook_names(path)
         notebooks = [self.get_notebook(name, path, content=False)
                         for name in notebook_names if self.should_list(name)]
         notebooks = sorted(notebooks, key=sort_key)
         return notebooks
 
     def get_notebook(self, name, path='', content=True):
         """ Takes a path and name for a notebook and returns its model
         
         Parameters
         ----------
         name : str
             the name of the notebook
         path : str
             the URL path that describes the relative path for
             the notebook
             
         Returns
         -------
         model : dict
             the notebook model. If contents=True, returns the 'contents' 
             dict in the model as well.
         """
         path = path.strip('/')
         if not self.notebook_exists(name=name, path=path):
             raise web.HTTPError(404, u'Notebook does not exist: %s' % name)
         os_path = self._get_os_path(name, path)
         info = os.stat(os_path)
         last_modified = tz.utcfromtimestamp(info.st_mtime)
         created = tz.utcfromtimestamp(info.st_ctime)
         # Create the notebook model.
         model ={}
         model['name'] = name
         model['path'] = path
         model['last_modified'] = last_modified
         model['created'] = created
         model['type'] = 'notebook'
         if content:
             with io.open(os_path, 'r', encoding='utf-8') as f:
                 try:
                     nb = current.read(f, u'json')
                 except Exception as e:
                     raise web.HTTPError(400, u"Unreadable Notebook: %s %s" % (os_path, e))
-            self.mark_trusted_cells(nb, path, name)
+            self.mark_trusted_cells(nb, name, path)
             model['content'] = nb
         return model
 
     def save_notebook(self, model, name='', path=''):
         """Save the notebook model and return the model with no content."""
         path = path.strip('/')
 
         if 'content' not in model:
             raise web.HTTPError(400, u'No notebook JSON data provided')
 
         # One checkpoint should always exist
         if self.notebook_exists(name, path) and not self.list_checkpoints(name, path):
             self.create_checkpoint(name, path)
 
         new_path = model.get('path', path).strip('/')
         new_name = model.get('name', name)
 
         if path != new_path or name != new_name:
             self.rename_notebook(name, path, new_name, new_path)
 
         # Save the notebook file
         os_path = self._get_os_path(new_name, new_path)
         nb = current.to_notebook_json(model['content'])
         
-        self.check_and_sign(nb, new_path, new_name)
+        self.check_and_sign(nb, new_name, new_path)
         
         if 'name' in nb['metadata']:
             nb['metadata']['name'] = u''
         try:
             self.log.debug("Autosaving notebook %s", os_path)
             with io.open(os_path, 'w', encoding='utf-8') as f:
                 current.write(nb, f, u'json')
         except Exception as e:
             raise web.HTTPError(400, u'Unexpected error while autosaving notebook: %s %s' % (os_path, e))
 
         # Save .py script as well
         if self.save_script:
             py_path = os.path.splitext(os_path)[0] + '.py'
             self.log.debug("Writing script %s", py_path)
             try:
                 with io.open(py_path, 'w', encoding='utf-8') as f:
                     current.write(nb, f, u'py')
             except Exception as e:
                 raise web.HTTPError(400, u'Unexpected error while saving notebook as script: %s %s' % (py_path, e))
 
         model = self.get_notebook(new_name, new_path, content=False)
         return model
 
     def update_notebook(self, model, name, path=''):
         """Update the notebook's path and/or name"""
         path = path.strip('/')
         new_name = model.get('name', name)
         new_path = model.get('path', path).strip('/')
         if path != new_path or name != new_name:
             self.rename_notebook(name, path, new_name, new_path)
         model = self.get_notebook(new_name, new_path, content=False)
         return model
 
     def delete_notebook(self, name, path=''):
         """Delete notebook by name and path."""
         path = path.strip('/')
         os_path = self._get_os_path(name, path)
         if not os.path.isfile(os_path):
             raise web.HTTPError(404, u'Notebook does not exist: %s' % os_path)
         
         # clear checkpoints
         for checkpoint in self.list_checkpoints(name, path):
             checkpoint_id = checkpoint['id']
             cp_path = self.get_checkpoint_path(checkpoint_id, name, path)
             if os.path.isfile(cp_path):
                 self.log.debug("Unlinking checkpoint %s", cp_path)
                 os.unlink(cp_path)
         
         self.log.debug("Unlinking notebook %s", os_path)
         os.unlink(os_path)
 
     def rename_notebook(self, old_name, old_path, new_name, new_path):
         """Rename a notebook."""
         old_path = old_path.strip('/')
         new_path = new_path.strip('/')
         if new_name == old_name and new_path == old_path:
             return
         
         new_os_path = self._get_os_path(new_name, new_path)
         old_os_path = self._get_os_path(old_name, old_path)
 
         # Should we proceed with the move?
         if os.path.isfile(new_os_path):
             raise web.HTTPError(409, u'Notebook with name already exists: %s' % new_os_path)
         if self.save_script:
             old_py_path = os.path.splitext(old_os_path)[0] + '.py'
             new_py_path = os.path.splitext(new_os_path)[0] + '.py'
             if os.path.isfile(new_py_path):
                 raise web.HTTPError(409, u'Python script with name already exists: %s' % new_py_path)
 
         # Move the notebook file
         try:
             os.rename(old_os_path, new_os_path)
         except Exception as e:
             raise web.HTTPError(500, u'Unknown error renaming notebook: %s %s' % (old_os_path, e))
 
         # Move the checkpoints
         old_checkpoints = self.list_checkpoints(old_name, old_path)
         for cp in old_checkpoints:
             checkpoint_id = cp['id']
             old_cp_path = self.get_checkpoint_path(checkpoint_id, old_name, old_path)
             new_cp_path = self.get_checkpoint_path(checkpoint_id, new_name, new_path)
             if os.path.isfile(old_cp_path):
                 self.log.debug("Renaming checkpoint %s -> %s", old_cp_path, new_cp_path)
                 os.rename(old_cp_path, new_cp_path)
 
         # Move the .py script
         if self.save_script:
             os.rename(old_py_path, new_py_path)
   
     # Checkpoint-related utilities
     
     def get_checkpoint_path(self, checkpoint_id, name, path=''):
         """find the path to a checkpoint"""
         path = path.strip('/')
         basename, _ = os.path.splitext(name)
         filename = u"{name}-{checkpoint_id}{ext}".format(
             name=basename,
             checkpoint_id=checkpoint_id,
             ext=self.filename_ext,
         )
         cp_path = os.path.join(path, self.checkpoint_dir, filename)
         return cp_path
 
     def get_checkpoint_model(self, checkpoint_id, name, path=''):
         """construct the info dict for a given checkpoint"""
         path = path.strip('/')
         cp_path = self.get_checkpoint_path(checkpoint_id, name, path)
         stats = os.stat(cp_path)
         last_modified = tz.utcfromtimestamp(stats.st_mtime)
         info = dict(
             id = checkpoint_id,
             last_modified = last_modified,
         )
         return info
         
     # public checkpoint API
     
     def create_checkpoint(self, name, path=''):
         """Create a checkpoint from the current state of a notebook"""
         path = path.strip('/')
         nb_path = self._get_os_path(name, path)
         # only the one checkpoint ID:
         checkpoint_id = u"checkpoint"
         cp_path = self.get_checkpoint_path(checkpoint_id, name, path)
         self.log.debug("creating checkpoint for notebook %s", name)
         if not os.path.exists(self.checkpoint_dir):
             os.mkdir(self.checkpoint_dir)
         shutil.copy2(nb_path, cp_path)
         
         # return the checkpoint info
         return self.get_checkpoint_model(checkpoint_id, name, path)
     
     def list_checkpoints(self, name, path=''):
         """list the checkpoints for a given notebook
         
         This notebook manager currently only supports one checkpoint per notebook.
         """
         path = path.strip('/')
         checkpoint_id = "checkpoint"
         path = self.get_checkpoint_path(checkpoint_id, name, path)
         if not os.path.exists(path):
             return []
         else:
             return [self.get_checkpoint_model(checkpoint_id, name, path)]
         
     
     def restore_checkpoint(self, checkpoint_id, name, path=''):
         """restore a notebook to a checkpointed state"""
         path = path.strip('/')
         self.log.info("restoring Notebook %s from checkpoint %s", name, checkpoint_id)
         nb_path = self._get_os_path(name, path)
         cp_path = self.get_checkpoint_path(checkpoint_id, name, path)
         if not os.path.isfile(cp_path):
             self.log.debug("checkpoint file does not exist: %s", cp_path)
             raise web.HTTPError(404,
                 u'Notebook checkpoint does not exist: %s-%s' % (name, checkpoint_id)
             )
         # ensure notebook is readable (never restore from an unreadable notebook)
         with io.open(cp_path, 'r', encoding='utf-8') as f:
             current.read(f, u'json')
         shutil.copy2(cp_path, nb_path)
         self.log.debug("copying %s -> %s", cp_path, nb_path)
     
     def delete_checkpoint(self, checkpoint_id, name, path=''):
         """delete a notebook's checkpoint"""
         path = path.strip('/')
         cp_path = self.get_checkpoint_path(checkpoint_id, name, path)
         if not os.path.isfile(cp_path):
             raise web.HTTPError(404,
                 u'Notebook checkpoint does not exist: %s%s-%s' % (path, name, checkpoint_id)
             )
         self.log.debug("unlinking %s", cp_path)
         os.unlink(cp_path)
     
     def info_string(self):
         return "Serving notebooks from local directory: %s" % self.notebook_dir

IPython/html/services/notebooks/handlers.py

@@ -1,290 +1,288 b''
 """Tornado handlers for the notebooks web service.
 
 Authors:
 
 * Brian Granger
 """
 
 #-----------------------------------------------------------------------------
 #  Copyright (C) 2011  The IPython Development Team
 #
 #  Distributed under the terms of the BSD License.  The full license is in
 #  the file COPYING, distributed as part of this software.
 #-----------------------------------------------------------------------------
 
 #-----------------------------------------------------------------------------
 # Imports
 #-----------------------------------------------------------------------------
 
 import json
 
 from tornado import web
 
 from IPython.html.utils import url_path_join, url_escape
 from IPython.utils.jsonutil import date_default
 
 from IPython.html.base.handlers import (IPythonHandler, json_errors,
                                     notebook_path_regex, path_regex,
                                     notebook_name_regex)
 
 #-----------------------------------------------------------------------------
 # Notebook web service handlers
 #-----------------------------------------------------------------------------
 
 
 class NotebookHandler(IPythonHandler):
 
     SUPPORTED_METHODS = (u'GET', u'PUT', u'PATCH', u'POST', u'DELETE')
 
     def notebook_location(self, name, path=''):
         """Return the full URL location of a notebook based.
         
         Parameters
         ----------
         name : unicode
             The base name of the notebook, such as "foo.ipynb".
         path : unicode
             The URL path of the notebook.
         """
         return url_escape(url_path_join(
             self.base_url, 'api', 'notebooks', path, name
         ))
 
     def _finish_model(self, model, location=True):
         """Finish a JSON request with a model, setting relevant headers, etc."""
         if location:
             location = self.notebook_location(model['name'], model['path'])
             self.set_header('Location', location)
         self.set_header('Last-Modified', model['last_modified'])
         self.finish(json.dumps(model, default=date_default))
     
     @web.authenticated
     @json_errors
     def get(self, path='', name=None):
         """Return a Notebook or list of notebooks.
 
         * GET with path and no notebook name lists notebooks in a directory
         * GET with path and notebook name returns notebook JSON
         """
         nbm = self.notebook_manager
         # Check to see if a notebook name was given
         if name is None:
             # TODO: Remove this after we create the contents web service and directories are
             # no longer listed by the notebook web service. This should only handle notebooks
             # and not directories.
             dirs = nbm.list_dirs(path)
             notebooks = []
             index = []
             for nb in nbm.list_notebooks(path):
                 if nb['name'].lower() == 'index.ipynb':
                     index.append(nb)
                 else:
                     notebooks.append(nb)
             notebooks = index + dirs + notebooks
             self.finish(json.dumps(notebooks, default=date_default))
             return
         # get and return notebook representation
         model = nbm.get_notebook(name, path)
         self._finish_model(model, location=False)
 
     @web.authenticated
     @json_errors
     def patch(self, path='', name=None):
         """PATCH renames a notebook without re-uploading content."""
         nbm = self.notebook_manager
         if name is None:
             raise web.HTTPError(400, u'Notebook name missing')
         model = self.get_json_body()
         if model is None:
             raise web.HTTPError(400, u'JSON body missing')
         model = nbm.update_notebook(model, name, path)
         self._finish_model(model)
     
     def _copy_notebook(self, copy_from, path, copy_to=None):
         """Copy a notebook in path, optionally specifying the new name.
         
         Only support copying within the same directory.
         """
         self.log.info(u"Copying notebook from %s/%s to %s/%s",
             path, copy_from,
             path, copy_to or '',
         )
         model = self.notebook_manager.copy_notebook(copy_from, copy_to, path)
         self.set_status(201)
         self._finish_model(model)
     
     def _upload_notebook(self, model, path, name=None):
         """Upload a notebook
         
         If name specified, create it in path/name.
         """
         self.log.info(u"Uploading notebook to %s/%s", path, name or '')
         if name:
             model['name'] = name
         
         model = self.notebook_manager.create_notebook(model, path)
         self.set_status(201)
         self._finish_model(model)
     
     def _create_empty_notebook(self, path, name=None):
         """Create an empty notebook in path
         
         If name specified, create it in path/name.
         """
         self.log.info(u"Creating new notebook in %s/%s", path, name or '')
         model = {}
         if name:
             model['name'] = name
         model = self.notebook_manager.create_notebook(model, path=path)
         self.set_status(201)
         self._finish_model(model)
     
     def _save_notebook(self, model, path, name):
         """Save an existing notebook."""
         self.log.info(u"Saving notebook at %s/%s", path, name)
         model = self.notebook_manager.save_notebook(model, name, path)
         if model['path'] != path.strip('/') or model['name'] != name:
             # a rename happened, set Location header
             location = True
         else:
             location = False
         self._finish_model(model, location)
     
     @web.authenticated
     @json_errors
     def post(self, path='', name=None):
         """Create a new notebook in the specified path.
         
         POST creates new notebooks. The server always decides on the notebook name.
         
         POST /api/notebooks/path
           New untitled notebook in path. If content specified, upload a
           notebook, otherwise start empty.
         POST /api/notebooks/path?copy=OtherNotebook.ipynb
           New copy of OtherNotebook in path
         """
         
         if name is not None:
             raise web.HTTPError(400, "Only POST to directories. Use PUT for full names.")
         
         model = self.get_json_body()
         
         if model is not None:
             copy_from = model.get('copy_from')
             if copy_from:
                 if model.get('content'):
                     raise web.HTTPError(400, "Can't upload and copy at the same time.")
                 self._copy_notebook(copy_from, path)
             else:
                 self._upload_notebook(model, path)
         else:
             self._create_empty_notebook(path)
 
     @web.authenticated
     @json_errors
     def put(self, path='', name=None):
         """Saves the notebook in the location specified by name and path.
         
         PUT is very similar to POST, but the requester specifies the name,
         whereas with POST, the server picks the name.
         
         PUT /api/notebooks/path/Name.ipynb
           Save notebook at ``path/Name.ipynb``. Notebook structure is specified
           in `content` key of JSON request body. If content is not specified,
           create a new empty notebook.
         PUT /api/notebooks/path/Name.ipynb?copy=OtherNotebook.ipynb
           Copy OtherNotebook to Name
         """
         if name is None:
             raise web.HTTPError(400, "Only PUT to full names. Use POST for directories.")
         
         model = self.get_json_body()
         if model:
             copy_from = model.get('copy_from')
             if copy_from:
                 if model.get('content'):
                     raise web.HTTPError(400, "Can't upload and copy at the same time.")
                 self._copy_notebook(copy_from, path, name)
             elif self.notebook_manager.notebook_exists(name, path):
                 self._save_notebook(model, path, name)
             else:
                 self._upload_notebook(model, path, name)
         else:
             self._create_empty_notebook(path, name)
 
     @web.authenticated
     @json_errors
     def delete(self, path='', name=None):
         """delete the notebook in the given notebook path"""
         nbm = self.notebook_manager
         nbm.delete_notebook(name, path)
         self.set_status(204)
         self.finish()
 
 
 class NotebookCheckpointsHandler(IPythonHandler):
     
     SUPPORTED_METHODS = ('GET', 'POST')
     
     @web.authenticated
     @json_errors
     def get(self, path='', name=None):
         """get lists checkpoints for a notebook"""
         nbm = self.notebook_manager
         checkpoints = nbm.list_checkpoints(name, path)
         data = json.dumps(checkpoints, default=date_default)
         self.finish(data)
     
     @web.authenticated
     @json_errors
     def post(self, path='', name=None):
         """post creates a new checkpoint"""
         nbm = self.notebook_manager
         checkpoint = nbm.create_checkpoint(name, path)
         data = json.dumps(checkpoint, default=date_default)
         location = url_path_join(self.base_url, 'api/notebooks',
             path, name, 'checkpoints', checkpoint['id'])
         self.set_header('Location', url_escape(location))
         self.set_status(201)
         self.finish(data)
 
 
 class ModifyNotebookCheckpointsHandler(IPythonHandler):
     
     SUPPORTED_METHODS = ('POST', 'DELETE')
     
     @web.authenticated
     @json_errors
     def post(self, path, name, checkpoint_id):
         """post restores a notebook from a checkpoint"""
         nbm = self.notebook_manager
         nbm.restore_checkpoint(checkpoint_id, name, path)
         self.set_status(204)
         self.finish()
     
     @web.authenticated
     @json_errors
     def delete(self, path, name, checkpoint_id):
         """delete clears a checkpoint for a given notebook"""
         nbm = self.notebook_manager
         nbm.delete_checkpoint(checkpoint_id, name, path)
         self.set_status(204)
         self.finish()
         
 #-----------------------------------------------------------------------------
 # URL to handler mappings
 #-----------------------------------------------------------------------------
 
 
 _checkpoint_id_regex = r"(?P<checkpoint_id>[\w-]+)"
 
 default_handlers = [
     (r"/api/notebooks%s/checkpoints" % notebook_path_regex, NotebookCheckpointsHandler),
     (r"/api/notebooks%s/checkpoints/%s" % (notebook_path_regex, _checkpoint_id_regex),
         ModifyNotebookCheckpointsHandler),
     (r"/api/notebooks%s" % notebook_path_regex, NotebookHandler),
     (r"/api/notebooks%s" % path_regex, NotebookHandler),
 ]
 
-
-

IPython/html/services/notebooks/nbmanager.py

@@ -1,251 +1,283 b''
 """A base class notebook manager.
 
 Authors:
 
 * Brian Granger
 * Zach Sailer
 """
 
 #-----------------------------------------------------------------------------
 #  Copyright (C) 2011  The IPython Development Team
 #
 #  Distributed under the terms of the BSD License.  The full license is in
 #  the file COPYING, distributed as part of this software.
 #-----------------------------------------------------------------------------
 
 #-----------------------------------------------------------------------------
 # Imports
 #-----------------------------------------------------------------------------
 
 from fnmatch import fnmatch
 import itertools
 import os
 
 from IPython.config.configurable import LoggingConfigurable
 from IPython.nbformat import current, sign
 from IPython.utils.traitlets import Instance, Unicode, List
 
 #-----------------------------------------------------------------------------
 # Classes
 #-----------------------------------------------------------------------------
 
 class NotebookManager(LoggingConfigurable):
 
     filename_ext = Unicode(u'.ipynb')
     
     notary = Instance(sign.NotebookNotary)
     def _notary_default(self):
         return sign.NotebookNotary(parent=self)
     
     hide_globs = List(Unicode, [u'__pycache__'], config=True, help="""
         Glob patterns to hide in file and directory listings.
     """)
 
     # NotebookManager API part 1: methods that must be
     # implemented in subclasses.
 
     def path_exists(self, path):
         """Does the API-style path (directory) actually exist?
         
         Override this method in subclasses.
         
         Parameters
         ----------
         path : string
-            The 
+            The path to check
         
         Returns
         -------
         exists : bool
             Whether the path does indeed exist.
         """
         raise NotImplementedError
 
     def is_hidden(self, path):
         """Does the API style path correspond to a hidden directory or file?
         
         Parameters
         ----------
         path : string
             The path to check. This is an API path (`/` separated,
             relative to base notebook-dir).
         
         Returns
         -------
         exists : bool
             Whether the path is hidden.
         
         """
         raise NotImplementedError
 
     def notebook_exists(self, name, path=''):
         """Returns a True if the notebook exists. Else, returns False.
 
         Parameters
         ----------
         name : string
             The name of the notebook you are checking.
         path : string
             The relative path to the notebook (with '/' as separator)
 
         Returns
         -------
         bool
         """
         raise NotImplementedError('must be implemented in a subclass')
 
     # TODO: Remove this after we create the contents web service and directories are
     # no longer listed by the notebook web service.
     def list_dirs(self, path):
         """List the directory models for a given API style path."""
         raise NotImplementedError('must be implemented in a subclass')
 
     # TODO: Remove this after we create the contents web service and directories are
     # no longer listed by the notebook web service.
     def get_dir_model(self, name, path=''):
         """Get the directory model given a directory name and its API style path.
         
         The keys in the model should be:
         * name
         * path
         * last_modified
         * created
         * type='directory'
         """
         raise NotImplementedError('must be implemented in a subclass')
 
     def list_notebooks(self, path=''):
         """Return a list of notebook dicts without content.
 
         This returns a list of dicts, each of the form::
 
             dict(notebook_id=notebook,name=name)
 
         This list of dicts should be sorted by name::
 
             data = sorted(data, key=lambda item: item['name'])
         """
         raise NotImplementedError('must be implemented in a subclass')
 
     def get_notebook(self, name, path='', content=True):
         """Get the notebook model with or without content."""
         raise NotImplementedError('must be implemented in a subclass')
 
     def save_notebook(self, model, name, path=''):
         """Save the notebook and return the model with no content."""
         raise NotImplementedError('must be implemented in a subclass')
 
     def update_notebook(self, model, name, path=''):
         """Update the notebook and return the model with no content."""
         raise NotImplementedError('must be implemented in a subclass')
 
     def delete_notebook(self, name, path=''):
         """Delete notebook by name and path."""
         raise NotImplementedError('must be implemented in a subclass')
 
     def create_checkpoint(self, name, path=''):
         """Create a checkpoint of the current state of a notebook
         
         Returns a checkpoint_id for the new checkpoint.
         """
         raise NotImplementedError("must be implemented in a subclass")
     
     def list_checkpoints(self, name, path=''):
         """Return a list of checkpoints for a given notebook"""
         return []
     
     def restore_checkpoint(self, checkpoint_id, name, path=''):
         """Restore a notebook from one of its checkpoints"""
         raise NotImplementedError("must be implemented in a subclass")
 
     def delete_checkpoint(self, checkpoint_id, name, path=''):
         """delete a checkpoint for a notebook"""
         raise NotImplementedError("must be implemented in a subclass")
     
     def info_string(self):
         return "Serving notebooks"
 
     # NotebookManager API part 2: methods that have useable default
     # implementations, but can be overridden in subclasses.
 
     def increment_filename(self, basename, path=''):
         """Increment a notebook filename without the .ipynb to make it unique.
         
         Parameters
         ----------
         basename : unicode
             The name of a notebook without the ``.ipynb`` file extension.
         path : unicode
             The URL path of the notebooks directory
 
         Returns
         -------
         name : unicode
             A notebook name (with the .ipynb extension) that starts
             with basename and does not refer to any existing notebook.
         """
         path = path.strip('/')
         for i in itertools.count():
             name = u'{basename}{i}{ext}'.format(basename=basename, i=i,
                                                 ext=self.filename_ext)
             if not self.notebook_exists(name, path):
                 break
         return name
 
     def create_notebook(self, model=None, path=''):
         """Create a new notebook and return its model with no content."""
         path = path.strip('/')
         if model is None:
             model = {}
         if 'content' not in model:
             metadata = current.new_metadata(name=u'')
             model['content'] = current.new_notebook(metadata=metadata)
         if 'name' not in model:
             model['name'] = self.increment_filename('Untitled', path)
             
         model['path'] = path
         model = self.save_notebook(model, model['name'], model['path'])
         return model
 
     def copy_notebook(self, from_name, to_name=None, path=''):
         """Copy an existing notebook and return its new model.
         
         If to_name not specified, increment `from_name-Copy#.ipynb`.
         """
         path = path.strip('/')
         model = self.get_notebook(from_name, path)
         if not to_name:
             base = os.path.splitext(from_name)[0] + '-Copy'
             to_name = self.increment_filename(base, path)
         model['name'] = to_name
         model = self.save_notebook(model, to_name, path)
         return model
     
     def log_info(self):
         self.log.info(self.info_string())
 
-    # NotebookManager methods provided for use in subclasses.
-
-    def check_and_sign(self, nb, path, name):
+    def trust_notebook(self, name, path=''):
+        """Explicitly trust a notebook
+        
+        Parameters
+        ----------
+        name : string
+            The filename of the notebook
+        path : string
+            The notebook's directory
+        """
+        model = self.get_notebook(name, path)
+        nb = model['content']
+        self.log.warn("Trusting notebook %s/%s", path, name)
+        self.notary.mark_cells(nb, True)
+        self.save_notebook(model, name, path)
+    
+    def check_and_sign(self, nb, name, path=''):
         """Check for trusted cells, and sign the notebook.
         
         Called as a part of saving notebooks.
+        
+        Parameters
+        ----------
+        nb : dict
+            The notebook structure
+        name : string
+            The filename of the notebook
+        path : string
+            The notebook's directory
         """
         if self.notary.check_cells(nb):
             self.notary.sign(nb)
         else:
             self.log.warn("Saving untrusted notebook %s/%s", path, name)
     
-    def mark_trusted_cells(self, nb, path, name):
+    def mark_trusted_cells(self, nb, name, path=''):
         """Mark cells as trusted if the notebook signature matches.
         
         Called as a part of loading notebooks.
+        
+        Parameters
+        ----------
+        nb : dict
+            The notebook structure
+        name : string
+            The filename of the notebook
+        path : string
+            The notebook's directory
         """
         trusted = self.notary.check_signature(nb)
         if not trusted:
             self.log.warn("Notebook %s/%s is not trusted", path, name)
         self.notary.mark_cells(nb, trusted)
 
     def should_list(self, name):
         """Should this file/directory name be displayed in a listing?"""
         return not any(fnmatch(name, glob) for glob in self.hide_globs)

IPython/html/services/notebooks/tests/test_nbmanager.py

@@ -1,245 +1,306 b''
 # coding: utf-8
 """Tests for the notebook manager."""
 from __future__ import print_function
 
+import logging
 import os
 
 from tornado.web import HTTPError
 from unittest import TestCase
 from tempfile import NamedTemporaryFile
 
+from IPython.nbformat import current
+
 from IPython.utils.tempdir import TemporaryDirectory
 from IPython.utils.traitlets import TraitError
 from IPython.html.utils import url_path_join
 
 from ..filenbmanager import FileNotebookManager
 from ..nbmanager import NotebookManager
 
 
 class TestFileNotebookManager(TestCase):
 
     def test_nb_dir(self):
         with TemporaryDirectory() as td:
             fm = FileNotebookManager(notebook_dir=td)
             self.assertEqual(fm.notebook_dir, td)
 
     def test_missing_nb_dir(self):
         with TemporaryDirectory() as td:
             nbdir = os.path.join(td, 'notebook', 'dir', 'is', 'missing')
             self.assertRaises(TraitError, FileNotebookManager, notebook_dir=nbdir)
 
     def test_invalid_nb_dir(self):
         with NamedTemporaryFile() as tf:
             self.assertRaises(TraitError, FileNotebookManager, notebook_dir=tf.name)
 
     def test_get_os_path(self):
         # full filesystem path should be returned with correct operating system
         # separators.
         with TemporaryDirectory() as td:
             nbdir = td
             fm = FileNotebookManager(notebook_dir=nbdir)
             path = fm._get_os_path('test.ipynb', '/path/to/notebook/')
             rel_path_list =  '/path/to/notebook/test.ipynb'.split('/')
             fs_path = os.path.join(fm.notebook_dir, *rel_path_list)
             self.assertEqual(path, fs_path)
 
             fm = FileNotebookManager(notebook_dir=nbdir)
             path = fm._get_os_path('test.ipynb')
             fs_path = os.path.join(fm.notebook_dir, 'test.ipynb')
             self.assertEqual(path, fs_path)
 
             fm = FileNotebookManager(notebook_dir=nbdir)
             path = fm._get_os_path('test.ipynb', '////')
             fs_path = os.path.join(fm.notebook_dir, 'test.ipynb')
             self.assertEqual(path, fs_path)
 
 class TestNotebookManager(TestCase):
     
+    def setUp(self):
+        self._temp_dir = TemporaryDirectory()
+        self.td = self._temp_dir.name
+        self.notebook_manager = FileNotebookManager(
+            notebook_dir=self.td,
+            log=logging.getLogger()
+        )
+    
+    def tearDown(self):
+        self._temp_dir.cleanup()
+    
     def make_dir(self, abs_path, rel_path):
         """make subdirectory, rel_path is the relative path
         to that directory from the location where the server started"""
         os_path = os.path.join(abs_path, rel_path)
         try:
             os.makedirs(os_path)
         except OSError:
             print("Directory already exists: %r" % os_path)
-
+    
+    def add_code_cell(self, nb):
+        output = current.new_output("display_data", output_javascript="alert('hi');")
+        cell = current.new_code_cell("print('hi')", outputs=[output])
+        if not nb.worksheets:
+            nb.worksheets.append(current.new_worksheet())
+        nb.worksheets[0].cells.append(cell)
+    
+    def new_notebook(self):
+        nbm = self.notebook_manager
+        model = nbm.create_notebook()
+        name = model['name']
+        path = model['path']
+        
+        full_model = nbm.get_notebook(name, path)
+        nb = full_model['content']
+        self.add_code_cell(nb)
+        
+        nbm.save_notebook(full_model, name, path)
+        return nb, name, path
+    
     def test_create_notebook(self):
-        with TemporaryDirectory() as td:
-            # Test in root directory
-            nm = FileNotebookManager(notebook_dir=td)
-            model = nm.create_notebook()
-            assert isinstance(model, dict)
-            self.assertIn('name', model)
-            self.assertIn('path', model)
-            self.assertEqual(model['name'], 'Untitled0.ipynb')
-            self.assertEqual(model['path'], '')
-
-            # Test in sub-directory
-            sub_dir = '/foo/'
-            self.make_dir(nm.notebook_dir, 'foo')
-            model = nm.create_notebook(None, sub_dir)
-            assert isinstance(model, dict)
-            self.assertIn('name', model)
-            self.assertIn('path', model)
-            self.assertEqual(model['name'], 'Untitled0.ipynb')
-            self.assertEqual(model['path'], sub_dir.strip('/'))
+        nm = self.notebook_manager
+        # Test in root directory
+        model = nm.create_notebook()
+        assert isinstance(model, dict)
+        self.assertIn('name', model)
+        self.assertIn('path', model)
+        self.assertEqual(model['name'], 'Untitled0.ipynb')
+        self.assertEqual(model['path'], '')
+
+        # Test in sub-directory
+        sub_dir = '/foo/'
+        self.make_dir(nm.notebook_dir, 'foo')
+        model = nm.create_notebook(None, sub_dir)
+        assert isinstance(model, dict)
+        self.assertIn('name', model)
+        self.assertIn('path', model)
+        self.assertEqual(model['name'], 'Untitled0.ipynb')
+        self.assertEqual(model['path'], sub_dir.strip('/'))
 
     def test_get_notebook(self):
-        with TemporaryDirectory() as td:
-            # Test in root directory
-            # Create a notebook
-            nm = FileNotebookManager(notebook_dir=td)
-            model = nm.create_notebook()
-            name = model['name']
-            path = model['path']
-
-            # Check that we 'get' on the notebook we just created
-            model2 = nm.get_notebook(name, path)
-            assert isinstance(model2, dict)
-            self.assertIn('name', model2)
-            self.assertIn('path', model2)
-            self.assertEqual(model['name'], name)
-            self.assertEqual(model['path'], path)
-
-            # Test in sub-directory
-            sub_dir = '/foo/'
-            self.make_dir(nm.notebook_dir, 'foo')
-            model = nm.create_notebook(None, sub_dir)
-            model2 = nm.get_notebook(name, sub_dir)
-            assert isinstance(model2, dict)
-            self.assertIn('name', model2)
-            self.assertIn('path', model2)
-            self.assertIn('content', model2)
-            self.assertEqual(model2['name'], 'Untitled0.ipynb')
-            self.assertEqual(model2['path'], sub_dir.strip('/'))
+        nm = self.notebook_manager
+        # Create a notebook
+        model = nm.create_notebook()
+        name = model['name']
+        path = model['path']
+
+        # Check that we 'get' on the notebook we just created
+        model2 = nm.get_notebook(name, path)
+        assert isinstance(model2, dict)
+        self.assertIn('name', model2)
+        self.assertIn('path', model2)
+        self.assertEqual(model['name'], name)
+        self.assertEqual(model['path'], path)
+
+        # Test in sub-directory
+        sub_dir = '/foo/'
+        self.make_dir(nm.notebook_dir, 'foo')
+        model = nm.create_notebook(None, sub_dir)
+        model2 = nm.get_notebook(name, sub_dir)
+        assert isinstance(model2, dict)
+        self.assertIn('name', model2)
+        self.assertIn('path', model2)
+        self.assertIn('content', model2)
+        self.assertEqual(model2['name'], 'Untitled0.ipynb')
+        self.assertEqual(model2['path'], sub_dir.strip('/'))
             
     def test_update_notebook(self):
-        with TemporaryDirectory() as td:
-            # Test in root directory
-            # Create a notebook
-            nm = FileNotebookManager(notebook_dir=td)
-            model = nm.create_notebook()
-            name = model['name']
-            path = model['path']
-
-            # Change the name in the model for rename
-            model['name'] = 'test.ipynb'
-            model = nm.update_notebook(model, name, path)
-            assert isinstance(model, dict)
-            self.assertIn('name', model)
-            self.assertIn('path', model)
-            self.assertEqual(model['name'], 'test.ipynb')
-
-            # Make sure the old name is gone
-            self.assertRaises(HTTPError, nm.get_notebook, name, path)
-
-            # Test in sub-directory
-            # Create a directory and notebook in that directory
-            sub_dir = '/foo/'
-            self.make_dir(nm.notebook_dir, 'foo')
-            model = nm.create_notebook(None, sub_dir)
-            name = model['name']
-            path = model['path']
-            
-            # Change the name in the model for rename
-            model['name'] = 'test_in_sub.ipynb'
-            model = nm.update_notebook(model, name, path)
-            assert isinstance(model, dict)
-            self.assertIn('name', model)
-            self.assertIn('path', model)
-            self.assertEqual(model['name'], 'test_in_sub.ipynb')
-            self.assertEqual(model['path'], sub_dir.strip('/'))
-            
-            # Make sure the old name is gone
-            self.assertRaises(HTTPError, nm.get_notebook, name, path)
+        nm = self.notebook_manager
+        # Create a notebook
+        model = nm.create_notebook()
+        name = model['name']
+        path = model['path']
+
+        # Change the name in the model for rename
+        model['name'] = 'test.ipynb'
+        model = nm.update_notebook(model, name, path)
+        assert isinstance(model, dict)
+        self.assertIn('name', model)
+        self.assertIn('path', model)
+        self.assertEqual(model['name'], 'test.ipynb')
+
+        # Make sure the old name is gone
+        self.assertRaises(HTTPError, nm.get_notebook, name, path)
+
+        # Test in sub-directory
+        # Create a directory and notebook in that directory
+        sub_dir = '/foo/'
+        self.make_dir(nm.notebook_dir, 'foo')
+        model = nm.create_notebook(None, sub_dir)
+        name = model['name']
+        path = model['path']
+        
+        # Change the name in the model for rename
+        model['name'] = 'test_in_sub.ipynb'
+        model = nm.update_notebook(model, name, path)
+        assert isinstance(model, dict)
+        self.assertIn('name', model)
+        self.assertIn('path', model)
+        self.assertEqual(model['name'], 'test_in_sub.ipynb')
+        self.assertEqual(model['path'], sub_dir.strip('/'))
+        
+        # Make sure the old name is gone
+        self.assertRaises(HTTPError, nm.get_notebook, name, path)
 
     def test_save_notebook(self):
-        with TemporaryDirectory() as td:
-            # Test in the root directory
-            # Create a notebook
-            nm = FileNotebookManager(notebook_dir=td)
-            model = nm.create_notebook()
-            name = model['name']
-            path = model['path']
-
-            # Get the model with 'content'
-            full_model = nm.get_notebook(name, path)
-
-            # Save the notebook
-            model = nm.save_notebook(full_model, name, path)
-            assert isinstance(model, dict)
-            self.assertIn('name', model)
-            self.assertIn('path', model)
-            self.assertEqual(model['name'], name)
-            self.assertEqual(model['path'], path)
-
-            # Test in sub-directory
-            # Create a directory and notebook in that directory
-            sub_dir = '/foo/'
-            self.make_dir(nm.notebook_dir, 'foo')
-            model = nm.create_notebook(None, sub_dir)
-            name = model['name']
-            path = model['path']
-            model = nm.get_notebook(name, path)
-
-            # Change the name in the model for rename
-            model = nm.save_notebook(model, name, path)
-            assert isinstance(model, dict)
-            self.assertIn('name', model)
-            self.assertIn('path', model)
-            self.assertEqual(model['name'], 'Untitled0.ipynb')
-            self.assertEqual(model['path'], sub_dir.strip('/'))
+        nm = self.notebook_manager
+        # Create a notebook
+        model = nm.create_notebook()
+        name = model['name']
+        path = model['path']
+
+        # Get the model with 'content'
+        full_model = nm.get_notebook(name, path)
+
+        # Save the notebook
+        model = nm.save_notebook(full_model, name, path)
+        assert isinstance(model, dict)
+        self.assertIn('name', model)
+        self.assertIn('path', model)
+        self.assertEqual(model['name'], name)
+        self.assertEqual(model['path'], path)
+
+        # Test in sub-directory
+        # Create a directory and notebook in that directory
+        sub_dir = '/foo/'
+        self.make_dir(nm.notebook_dir, 'foo')
+        model = nm.create_notebook(None, sub_dir)
+        name = model['name']
+        path = model['path']
+        model = nm.get_notebook(name, path)
+
+        # Change the name in the model for rename
+        model = nm.save_notebook(model, name, path)
+        assert isinstance(model, dict)
+        self.assertIn('name', model)
+        self.assertIn('path', model)
+        self.assertEqual(model['name'], 'Untitled0.ipynb')
+        self.assertEqual(model['path'], sub_dir.strip('/'))
 
     def test_save_notebook_with_script(self):
-        with TemporaryDirectory() as td:
-            # Create a notebook
-            nm = FileNotebookManager(notebook_dir=td)
-            nm.save_script = True
-            model = nm.create_notebook()
-            name = model['name']
-            path = model['path']
+        nm = self.notebook_manager
+        # Create a notebook
+        model = nm.create_notebook()
+        nm.save_script = True
+        model = nm.create_notebook()
+        name = model['name']
+        path = model['path']
 
-            # Get the model with 'content'
-            full_model = nm.get_notebook(name, path)
+        # Get the model with 'content'
+        full_model = nm.get_notebook(name, path)
 
-            # Save the notebook
-            model = nm.save_notebook(full_model, name, path)
+        # Save the notebook
+        model = nm.save_notebook(full_model, name, path)
 
-            # Check that the script was created
-            py_path = os.path.join(td, os.path.splitext(name)[0]+'.py')
-            assert os.path.exists(py_path), py_path
+        # Check that the script was created
+        py_path = os.path.join(nm.notebook_dir, os.path.splitext(name)[0]+'.py')
+        assert os.path.exists(py_path), py_path
 
     def test_delete_notebook(self):
-        with TemporaryDirectory() as td:
-            # Test in the root directory
-            # Create a notebook
-            nm = FileNotebookManager(notebook_dir=td)
-            model = nm.create_notebook()
-            name = model['name']
-            path = model['path']
-            
-            # Delete the notebook
-            nm.delete_notebook(name, path)
-            
-            # Check that a 'get' on the deleted notebook raises and error
-            self.assertRaises(HTTPError, nm.get_notebook, name, path)
+        nm = self.notebook_manager
+        # Create a notebook
+        nb, name, path = self.new_notebook()
+        
+        # Delete the notebook
+        nm.delete_notebook(name, path)
+        
+        # Check that a 'get' on the deleted notebook raises and error
+        self.assertRaises(HTTPError, nm.get_notebook, name, path)
     
     def test_copy_notebook(self):
-        with TemporaryDirectory() as td:
-            # Test in the root directory
-            # Create a notebook
-            nm = FileNotebookManager(notebook_dir=td)
-            path = u'å b'
-            name = u'nb √.ipynb'
-            os.mkdir(os.path.join(td, path))
-            orig = nm.create_notebook({'name' : name}, path=path)
-            
-            # copy with unspecified name
-            copy = nm.copy_notebook(name, path=path)
-            self.assertEqual(copy['name'], orig['name'].replace('.ipynb', '-Copy0.ipynb'))
-            
-            # copy with specified name
-            copy2 = nm.copy_notebook(name, u'copy 2.ipynb', path=path)
-            self.assertEqual(copy2['name'], u'copy 2.ipynb')
+        nm = self.notebook_manager
+        path = u'å b'
+        name = u'nb √.ipynb'
+        os.mkdir(os.path.join(nm.notebook_dir, path))
+        orig = nm.create_notebook({'name' : name}, path=path)
+        
+        # copy with unspecified name
+        copy = nm.copy_notebook(name, path=path)
+        self.assertEqual(copy['name'], orig['name'].replace('.ipynb', '-Copy0.ipynb'))
+        
+        # copy with specified name
+        copy2 = nm.copy_notebook(name, u'copy 2.ipynb', path=path)
+        self.assertEqual(copy2['name'], u'copy 2.ipynb')
     
+    def test_trust_notebook(self):
+        nbm = self.notebook_manager
+        nb, name, path = self.new_notebook()
+        
+        untrusted = nbm.get_notebook(name, path)['content']
+        assert not nbm.notary.check_cells(untrusted)
+        
+        # print(untrusted)
+        nbm.trust_notebook(name, path)
+        trusted = nbm.get_notebook(name, path)['content']
+        # print(trusted)
+        assert nbm.notary.check_cells(trusted)
+    
+    def test_mark_trusted_cells(self):
+        nbm = self.notebook_manager
+        nb, name, path = self.new_notebook()
+        
+        nbm.mark_trusted_cells(nb, name, path)
+        for cell in nb.worksheets[0].cells:
+            if cell.cell_type == 'code':
+                assert not cell.trusted
+        
+        nbm.trust_notebook(name, path)
+        nb = nbm.get_notebook(name, path)['content']
+        for cell in nb.worksheets[0].cells:
+            if cell.cell_type == 'code':
+                assert cell.trusted
+
+    def test_check_and_sign(self):
+        nbm = self.notebook_manager
+        nb, name, path = self.new_notebook()
+        
+        nbm.mark_trusted_cells(nb, name, path)
+        nbm.check_and_sign(nb, name, path)
+        assert not nbm.notary.check_signature(nb)
+        
+        nbm.trust_notebook(name, path)
+        nb = nbm.get_notebook(name, path)['content']
+        nbm.mark_trusted_cells(nb, name, path)
+        nbm.check_and_sign(nb, name, path)
+        assert nbm.notary.check_signature(nb)

IPython/html/static/base/js/utils.js

@@ -1,514 +1,513 b''
 //----------------------------------------------------------------------------
 //  Copyright (C) 2008-2012  The IPython Development Team
 //
 //  Distributed under the terms of the BSD License.  The full license is in
 //  the file COPYING, distributed as part of this software.
 //----------------------------------------------------------------------------
 
 //============================================================================
 // Utilities
 //============================================================================
 IPython.namespace('IPython.utils');
 
 IPython.utils = (function (IPython) {
     "use strict";
     
     IPython.load_extensions = function () {
         // load one or more IPython notebook extensions with requirejs
         
         var extensions = [];
         var extension_names = arguments;
         for (var i = 0; i < extension_names.length; i++) {
             extensions.push("nbextensions/" + arguments[i]);
         }
         
         require(extensions,
             function () {
                 for (var i = 0; i < arguments.length; i++) {
                     var ext = arguments[i];
                     var ext_name = extension_names[i];
                     // success callback
                     console.log("Loaded extension: " + ext_name);
                     if (ext && ext.load_ipython_extension !== undefined) {
                         ext.load_ipython_extension();
                     }
                 }
             },
             function (err) {
                 // failure callback
                 console.log("Failed to load extension(s):", err.requireModules, err);
             }
         );
     };
 
     //============================================================================
     // Cross-browser RegEx Split
     //============================================================================
 
     // This code has been MODIFIED from the code licensed below to not replace the
     // default browser split.  The license is reproduced here.
 
     // see http://blog.stevenlevithan.com/archives/cross-browser-split for more info:
     /*!
      * Cross-Browser Split 1.1.1
      * Copyright 2007-2012 Steven Levithan <stevenlevithan.com>
      * Available under the MIT License
      * ECMAScript compliant, uniform cross-browser split method
      */
 
     /**
      * Splits a string into an array of strings using a regex or string
      * separator. Matches of the separator are not included in the result array.
      * However, if `separator` is a regex that contains capturing groups,
      * backreferences are spliced into the result each time `separator` is
      * matched. Fixes browser bugs compared to the native
      * `String.prototype.split` and can be used reliably cross-browser.
      * @param {String} str String to split.
      * @param {RegExp|String} separator Regex or string to use for separating
      *     the string.
      * @param {Number} [limit] Maximum number of items to include in the result
      *     array.
      * @returns {Array} Array of substrings.
      * @example
      *
      * // Basic use
      * regex_split('a b c d', ' ');
      * // -> ['a', 'b', 'c', 'd']
      *
      * // With limit
      * regex_split('a b c d', ' ', 2);
      * // -> ['a', 'b']
      *
      * // Backreferences in result array
      * regex_split('..word1 word2..', /([a-z]+)(\d+)/i);
      * // -> ['..', 'word', '1', ' ', 'word', '2', '..']
      */
     var regex_split = function (str, separator, limit) {
         // If `separator` is not a regex, use `split`
         if (Object.prototype.toString.call(separator) !== "[object RegExp]") {
             return split.call(str, separator, limit);
         }
         var output = [],
             flags = (separator.ignoreCase ? "i" : "") +
                     (separator.multiline  ? "m" : "") +
                     (separator.extended   ? "x" : "") + // Proposed for ES6
                     (separator.sticky     ? "y" : ""), // Firefox 3+
             lastLastIndex = 0,
             // Make `global` and avoid `lastIndex` issues by working with a copy
             separator = new RegExp(separator.source, flags + "g"),
             separator2, match, lastIndex, lastLength;
         str += ""; // Type-convert
 
         var compliantExecNpcg = typeof(/()??/.exec("")[1]) === "undefined";
         if (!compliantExecNpcg) {
             // Doesn't need flags gy, but they don't hurt
             separator2 = new RegExp("^" + separator.source + "$(?!\\s)", flags);
         }
         /* Values for `limit`, per the spec:
          * If undefined: 4294967295 // Math.pow(2, 32) - 1
          * If 0, Infinity, or NaN: 0
          * If positive number: limit = Math.floor(limit); if (limit > 4294967295) limit -= 4294967296;
          * If negative number: 4294967296 - Math.floor(Math.abs(limit))
          * If other: Type-convert, then use the above rules
          */
         limit = typeof(limit) === "undefined" ?
             -1 >>> 0 : // Math.pow(2, 32) - 1
             limit >>> 0; // ToUint32(limit)
         while (match = separator.exec(str)) {
             // `separator.lastIndex` is not reliable cross-browser
             lastIndex = match.index + match[0].length;
             if (lastIndex > lastLastIndex) {
                 output.push(str.slice(lastLastIndex, match.index));
                 // Fix browsers whose `exec` methods don't consistently return `undefined` for
                 // nonparticipating capturing groups
                 if (!compliantExecNpcg && match.length > 1) {
                     match[0].replace(separator2, function () {
                         for (var i = 1; i < arguments.length - 2; i++) {
                             if (typeof(arguments[i]) === "undefined") {
                                 match[i] = undefined;
                             }
                         }
                     });
                 }
                 if (match.length > 1 && match.index < str.length) {
                     Array.prototype.push.apply(output, match.slice(1));
                 }
                 lastLength = match[0].length;
                 lastLastIndex = lastIndex;
                 if (output.length >= limit) {
                     break;
                 }
             }
             if (separator.lastIndex === match.index) {
                 separator.lastIndex++; // Avoid an infinite loop
             }
         }
         if (lastLastIndex === str.length) {
             if (lastLength || !separator.test("")) {
                 output.push("");
             }
         } else {
             output.push(str.slice(lastLastIndex));
         }
         return output.length > limit ? output.slice(0, limit) : output;
     };
 
     //============================================================================
     // End contributed Cross-browser RegEx Split
     //============================================================================
 
 
     var uuid = function () {
         // http://www.ietf.org/rfc/rfc4122.txt
         var s = [];
         var hexDigits = "0123456789ABCDEF";
         for (var i = 0; i < 32; i++) {
             s[i] = hexDigits.substr(Math.floor(Math.random() * 0x10), 1);
         }
         s[12] = "4";  // bits 12-15 of the time_hi_and_version field to 0010
         s[16] = hexDigits.substr((s[16] & 0x3) | 0x8, 1);  // bits 6-7 of the clock_seq_hi_and_reserved to 01
 
         var uuid = s.join("");
         return uuid;
     };
 
 
     //Fix raw text to parse correctly in crazy XML
     function xmlencode(string) {
         return string.replace(/\&/g,'&'+'amp;')
             .replace(/</g,'&'+'lt;')
             .replace(/>/g,'&'+'gt;')
             .replace(/\'/g,'&'+'apos;')
             .replace(/\"/g,'&'+'quot;')
             .replace(/`/g,'&'+'#96;');
     }
 
 
     //Map from terminal commands to CSS classes
     var ansi_colormap = {
         "01":"ansibold",
         
         "30":"ansiblack",
         "31":"ansired",
         "32":"ansigreen",
         "33":"ansiyellow",
         "34":"ansiblue",
         "35":"ansipurple",
         "36":"ansicyan",
         "37":"ansigray",
         
         "40":"ansibgblack",
         "41":"ansibgred",
         "42":"ansibggreen",
         "43":"ansibgyellow",
         "44":"ansibgblue",
         "45":"ansibgpurple",
         "46":"ansibgcyan",
         "47":"ansibggray"
     };
     
     function _process_numbers(attrs, numbers) {
         // process ansi escapes
         var n = numbers.shift();
         if (ansi_colormap[n]) {
             if ( ! attrs["class"] ) {
                 attrs["class"] = ansi_colormap[n];
             } else {
                 attrs["class"] += " " + ansi_colormap[n];
             }
         } else if (n == "38" || n == "48") {
             // VT100 256 color or 24 bit RGB
             if (numbers.length < 2) {
                 console.log("Not enough fields for VT100 color", numbers);
                 return;
             }
             
             var index_or_rgb = numbers.shift();
             var r,g,b;
             if (index_or_rgb == "5") {
                 // 256 color
                 var idx = parseInt(numbers.shift());
                 if (idx < 16) {
                     // indexed ANSI
                     // ignore bright / non-bright distinction
                     idx = idx % 8;
                     var ansiclass = ansi_colormap[n[0] + (idx % 8).toString()];
                     if ( ! attrs["class"] ) {
                         attrs["class"] = ansiclass;
                     } else {
                         attrs["class"] += " " + ansiclass;
                     }
                     return;
                 } else if (idx < 232) {
                     // 216 color 6x6x6 RGB
                     idx = idx - 16;
                     b = idx % 6;
                     g = Math.floor(idx / 6) % 6;
                     r = Math.floor(idx / 36) % 6;
                     // convert to rgb
                     r = (r * 51);
                     g = (g * 51);
                     b = (b * 51);
                 } else {
                     // grayscale
                     idx = idx - 231;
                     // it's 1-24 and should *not* include black or white,
                     // so a 26 point scale
                     r = g = b = Math.floor(idx * 256 / 26);
                 }
             } else if (index_or_rgb == "2") {
                 // Simple 24 bit RGB
                 if (numbers.length > 3) {
                     console.log("Not enough fields for RGB", numbers);
                     return;
                 }
                 r = numbers.shift();
                 g = numbers.shift();
                 b = numbers.shift();
             } else {
                 console.log("unrecognized control", numbers);
                 return;
             }
             if (r !== undefined) {
                 // apply the rgb color
                 var line;
                 if (n == "38") {
                     line = "color: ";
                 } else {
                     line = "background-color: ";
                 }
                 line = line + "rgb(" + r + "," + g + "," + b + ");"
                 if ( !attrs["style"] ) {
                     attrs["style"] = line;
                 } else {
                     attrs["style"] += " " + line;
                 }
             }
         }
     }
 
     function ansispan(str) {
         // ansispan function adapted from github.com/mmalecki/ansispan (MIT License)
         // regular ansi escapes (using the table above)
         return str.replace(/\033\[(0?[01]|22|39)?([;\d]+)?m/g, function(match, prefix, pattern) {
             if (!pattern) {
                 // [(01|22|39|)m close spans
                 return "</span>";
             }
             // consume sequence of color escapes
             var numbers = pattern.match(/\d+/g);
             var attrs = {};
             while (numbers.length > 0) {
                 _process_numbers(attrs, numbers);
             }
             
             var span = "<span ";
             for (var attr in attrs) {
                 var value = attrs[attr];
                 span = span + " " + attr + '="' + attrs[attr] + '"';
             }
             return span + ">";
         });
     };
     
     // Transform ANSI color escape codes into HTML <span> tags with css
     // classes listed in the above ansi_colormap object. The actual color used
     // are set in the css file.
     function fixConsole(txt) {
         txt = xmlencode(txt);
         var re = /\033\[([\dA-Fa-f;]*?)m/;
         var opened = false;
         var cmds = [];
         var opener = "";
         var closer = "";
 
         // Strip all ANSI codes that are not color related.  Matches
         // all ANSI codes that do not end with "m".
         var ignored_re = /(?=(\033\[[\d;=]*[a-ln-zA-Z]{1}))\1(?!m)/g;
         txt = txt.replace(ignored_re, "");
         
         // color ansi codes
         txt = ansispan(txt);
         return txt;
     }
 
     // Remove chunks that should be overridden by the effect of
     // carriage return characters
     function fixCarriageReturn(txt) {
         var tmp = txt;
         do {
             txt = tmp;
             tmp = txt.replace(/\r+\n/gm, '\n'); // \r followed by \n --> newline
             tmp = tmp.replace(/^.*\r+/gm, '');  // Other \r --> clear line
         } while (tmp.length < txt.length);
         return txt;
     }
 
     // Locate any URLs and convert them to a anchor tag
     function autoLinkUrls(txt) {
         return txt.replace(/(^|\s)(https?|ftp)(:[^'">\s]+)/gi,
             "$1<a target=\"_blank\" href=\"$2$3\">$2$3</a>");
     }
 
     var points_to_pixels = function (points) {
         // A reasonably good way of converting between points and pixels.
         var test = $('<div style="display: none; width: 10000pt; padding:0; border:0;"></div>');
         $(body).append(test);
         var pixel_per_point = test.width()/10000;
         test.remove();
         return Math.floor(points*pixel_per_point);
     };
     
     var always_new = function (constructor) {
         // wrapper around contructor to avoid requiring `var a = new constructor()`
         // useful for passing constructors as callbacks,
         // not for programmer laziness.
         // from http://programmers.stackexchange.com/questions/118798
         return function () {
             var obj = Object.create(constructor.prototype);
             constructor.apply(obj, arguments);
             return obj;
         };
     };
 
     var url_path_join = function () {
         // join a sequence of url components with '/'
         var url = '';
         for (var i = 0; i < arguments.length; i++) {
             if (arguments[i] === '') {
                 continue;
             }
             if (url.length > 0 && url[url.length-1] != '/') {
                 url = url + '/' + arguments[i];
             } else {
                 url = url + arguments[i];
             }
         }
         url = url.replace(/\/\/+/, '/');
         return url;
     };
     
     var parse_url = function (url) {
         // an `a` element with an href allows attr-access to the parsed segments of a URL
         // a = parse_url("http://localhost:8888/path/name#hash")
         // a.protocol = "http:"
         // a.host     = "localhost:8888"
         // a.hostname = "localhost"
         // a.port     = 8888
         // a.pathname = "/path/name"
         // a.hash     = "#hash"
         var a = document.createElement("a");
         a.href = url;
         return a;
     };
     
     var encode_uri_components = function (uri) {
         // encode just the components of a multi-segment uri,
         // leaving '/' separators
         return uri.split('/').map(encodeURIComponent).join('/');
     };
     
     var url_join_encode = function () {
         // join a sequence of url components with '/',
         // encoding each component with encodeURIComponent
         return encode_uri_components(url_path_join.apply(null, arguments));
     };
 
 
     var splitext = function (filename) {
         // mimic Python os.path.splitext
         // Returns ['base', '.ext']
         var idx = filename.lastIndexOf('.');
         if (idx > 0) {
             return [filename.slice(0, idx), filename.slice(idx)];
         } else {
             return [filename, ''];
         }
     };
 
 
     var escape_html = function (text) {
         // escape text to HTML
         return $("<div/>").text(text).html();
     }
 
 
     var get_body_data = function(key) {
         // get a url-encoded item from body.data and decode it
         // we should never have any encoded URLs anywhere else in code
         // until we are building an actual request
         return decodeURIComponent($('body').data(key));
     };
 
 
     // http://stackoverflow.com/questions/2400935/browser-detection-in-javascript
     var browser = (function() {
         if (typeof navigator === 'undefined') {
             // navigator undefined in node
             return 'None';
         }
         var N= navigator.appName, ua= navigator.userAgent, tem;
         var M= ua.match(/(opera|chrome|safari|firefox|msie)\/?\s*(\.?\d+(\.\d+)*)/i);
         if (M && (tem= ua.match(/version\/([\.\d]+)/i))!= null) M[2]= tem[1];
         M= M? [M[1], M[2]]: [N, navigator.appVersion,'-?'];
         return M;
     })();
 
     // http://stackoverflow.com/questions/11219582/how-to-detect-my-browser-version-and-operating-system-using-javascript
     var platform = (function () {
         if (typeof navigator === 'undefined') {
             // navigator undefined in node
             return 'None';
         }
         var OSName="None";
         if (navigator.appVersion.indexOf("Win")!=-1) OSName="Windows";
         if (navigator.appVersion.indexOf("Mac")!=-1) OSName="MacOS";
         if (navigator.appVersion.indexOf("X11")!=-1) OSName="UNIX";
         if (navigator.appVersion.indexOf("Linux")!=-1) OSName="Linux";
         return OSName
     })();
 
     var is_or_has = function (a, b) {
         // Is b a child of a or a itself?
         return a.has(b).length !==0 || a.is(b);
     }
 
     var is_focused = function (e) {
         // Is element e, or one of its children focused?
         e = $(e);
         var target = $(document.activeElement);
         if (target.length > 0) {
             if (is_or_has(e, target)) {
                 return true;
             } else {
                 return false;
             }
         } else {
             return false;
         }
     }
 
-
     return {
         regex_split : regex_split,
         uuid : uuid,
         fixConsole : fixConsole,
         fixCarriageReturn : fixCarriageReturn,
         autoLinkUrls : autoLinkUrls,
         points_to_pixels : points_to_pixels,
         get_body_data : get_body_data,
         parse_url : parse_url,
         url_path_join : url_path_join,
         url_join_encode : url_join_encode,
         encode_uri_components : encode_uri_components,
         splitext : splitext,
         escape_html : escape_html,
         always_new : always_new,
         browser : browser,
         platform: platform,
         is_or_has : is_or_has,
         is_focused : is_focused
     };
 
 }(IPython));
 

IPython/html/static/components

@@ -1,1 +1,1 b''
-Subproject commit 2f8958788c7e0416e5c44f532e9630a658df11fd
+Subproject commit 7a9ba818b3e13123621cb5ff336c002d49470f55

IPython/html/static/notebook/js/menubar.js

@@ -1,318 +1,332 b''
 //----------------------------------------------------------------------------
 //  Copyright (C) 2008-2011  The IPython Development Team
 //
 //  Distributed under the terms of the BSD License.  The full license is in
 //  the file COPYING, distributed as part of this software.
 //----------------------------------------------------------------------------
 
 //============================================================================
 // MenuBar
 //============================================================================
 
 /**
  * @module IPython
  * @namespace IPython
  * @submodule MenuBar
  */
 
 
 var IPython = (function (IPython) {
     "use strict";
     
     var utils = IPython.utils;
 
     /**
      * A MenuBar Class to generate the menubar of IPython notebook
      * @Class MenuBar
      *
      * @constructor
      *
      *
      * @param selector {string} selector for the menubar element in DOM
      * @param {object} [options]
      *      @param [options.base_url] {String} String to use for the
      *      base project url. Default is to inspect
      *      $('body').data('baseUrl');
      *      does not support change for now is set through this option
      */
     var MenuBar = function (selector, options) {
         options = options || {};
         this.base_url = options.base_url || IPython.utils.get_body_data("baseUrl");
         this.selector = selector;
         if (this.selector !== undefined) {
             this.element = $(selector);
             this.style();
             this.bind_events();
         }
     };
 
     MenuBar.prototype.style = function () {
         this.element.addClass('border-box-sizing');
         this.element.find("li").click(function (event, ui) {
                 // The selected cell loses focus when the menu is entered, so we
                 // re-select it upon selection.
                 var i = IPython.notebook.get_selected_index();
                 IPython.notebook.select(i);
             }
         );
     };
 
     MenuBar.prototype._nbconvert = function (format, download) {
         download = download || false;
         var notebook_path = IPython.notebook.notebook_path;
         var notebook_name = IPython.notebook.notebook_name;
         if (IPython.notebook.dirty) {
             IPython.notebook.save_notebook({async : false});
         }
         var url = utils.url_join_encode(
             this.base_url,
             'nbconvert',
             format,
             notebook_path,
             notebook_name
         ) + "?download=" + download.toString();
 
         window.open(url);
     };
 
     MenuBar.prototype.bind_events = function () {
         //  File
         var that = this;
         this.element.find('#new_notebook').click(function () {
             IPython.notebook.new_notebook();
         });
         this.element.find('#open_notebook').click(function () {
             window.open(utils.url_join_encode(
                 IPython.notebook.base_url,
                 'tree',
                 IPython.notebook.notebook_path
             ));
         });
         this.element.find('#copy_notebook').click(function () {
             IPython.notebook.copy_notebook();
             return false;
         });
         this.element.find('#download_ipynb').click(function () {
             var base_url = IPython.notebook.base_url;
             var notebook_path = IPython.notebook.notebook_path;
             var notebook_name = IPython.notebook.notebook_name;
             if (IPython.notebook.dirty) {
                 IPython.notebook.save_notebook({async : false});
             }
             
             var url = utils.url_join_encode(
                 base_url,
                 'files',
                 notebook_path,
                 notebook_name
             );
             window.location.assign(url);
         });
         
         this.element.find('#print_preview').click(function () {
             that._nbconvert('html', false);
         });
 
         this.element.find('#download_py').click(function () {
             that._nbconvert('python', true);
         });
 
         this.element.find('#download_html').click(function () {
             that._nbconvert('html', true);
         });
 
         this.element.find('#download_rst').click(function () {
             that._nbconvert('rst', true);
         });
 
         this.element.find('#rename_notebook').click(function () {
             IPython.save_widget.rename_notebook();
         });
         this.element.find('#save_checkpoint').click(function () {
             IPython.notebook.save_checkpoint();
         });
         this.element.find('#restore_checkpoint').click(function () {
         });
+        this.element.find('#trust_notebook').click(function () {
+            IPython.notebook.trust_notebook();
+        });
+        $([IPython.events]).on('trust_changed.Notebook', function (event, trusted) {
+            if (trusted) {
+                that.element.find('#trust_notebook')
+                    .addClass("disabled")
+                    .find("a").text("Trusted Notebook");
+            } else {
+                that.element.find('#trust_notebook')
+                    .removeClass("disabled")
+                    .find("a").text("Trust Notebook");
+            }
+        });
         this.element.find('#kill_and_exit').click(function () {
             IPython.notebook.session.delete();
             setTimeout(function(){
                 // allow closing of new tabs in Chromium, impossible in FF
                 window.open('', '_self', '');
                 window.close();
             }, 500);
         });
         // Edit
         this.element.find('#cut_cell').click(function () {
             IPython.notebook.cut_cell();
         });
         this.element.find('#copy_cell').click(function () {
             IPython.notebook.copy_cell();
         });
         this.element.find('#delete_cell').click(function () {
             IPython.notebook.delete_cell();
         });
         this.element.find('#undelete_cell').click(function () {
             IPython.notebook.undelete_cell();
         });
         this.element.find('#split_cell').click(function () {
             IPython.notebook.split_cell();
         });
         this.element.find('#merge_cell_above').click(function () {
             IPython.notebook.merge_cell_above();
         });
         this.element.find('#merge_cell_below').click(function () {
             IPython.notebook.merge_cell_below();
         });
         this.element.find('#move_cell_up').click(function () {
             IPython.notebook.move_cell_up();
         });
         this.element.find('#move_cell_down').click(function () {
             IPython.notebook.move_cell_down();
         });
         this.element.find('#edit_nb_metadata').click(function () {
             IPython.notebook.edit_metadata();
         });
         
         // View
         this.element.find('#toggle_header').click(function () {
             $('div#header').toggle();
             IPython.layout_manager.do_resize();
         });
         this.element.find('#toggle_toolbar').click(function () {
             $('div#maintoolbar').toggle();
             IPython.layout_manager.do_resize();
         });
         // Insert
         this.element.find('#insert_cell_above').click(function () {
             IPython.notebook.insert_cell_above('code');
             IPython.notebook.select_prev();
         });
         this.element.find('#insert_cell_below').click(function () {
             IPython.notebook.insert_cell_below('code');
             IPython.notebook.select_next();
         });
         // Cell
         this.element.find('#run_cell').click(function () {
             IPython.notebook.execute_cell();
         });
         this.element.find('#run_cell_select_below').click(function () {
             IPython.notebook.execute_cell_and_select_below();
         });
         this.element.find('#run_cell_insert_below').click(function () {
             IPython.notebook.execute_cell_and_insert_below();
         });
         this.element.find('#run_all_cells').click(function () {
             IPython.notebook.execute_all_cells();
         });
         this.element.find('#run_all_cells_above').click(function () {
             IPython.notebook.execute_cells_above();
         });
         this.element.find('#run_all_cells_below').click(function () {
             IPython.notebook.execute_cells_below();
         });
         this.element.find('#to_code').click(function () {
             IPython.notebook.to_code();
         });
         this.element.find('#to_markdown').click(function () {
             IPython.notebook.to_markdown();
         });
         this.element.find('#to_raw').click(function () {
             IPython.notebook.to_raw();
         });
         this.element.find('#to_heading1').click(function () {
             IPython.notebook.to_heading(undefined, 1);
         });
         this.element.find('#to_heading2').click(function () {
             IPython.notebook.to_heading(undefined, 2);
         });
         this.element.find('#to_heading3').click(function () {
             IPython.notebook.to_heading(undefined, 3);
         });
         this.element.find('#to_heading4').click(function () {
             IPython.notebook.to_heading(undefined, 4);
         });
         this.element.find('#to_heading5').click(function () {
             IPython.notebook.to_heading(undefined, 5);
         });
         this.element.find('#to_heading6').click(function () {
             IPython.notebook.to_heading(undefined, 6);
         });
         
         this.element.find('#toggle_current_output').click(function () {
             IPython.notebook.toggle_output();
         });
         this.element.find('#toggle_current_output_scroll').click(function () {
             IPython.notebook.toggle_output_scroll();
         });
         this.element.find('#clear_current_output').click(function () {
             IPython.notebook.clear_output();
         });
         
         this.element.find('#toggle_all_output').click(function () {
             IPython.notebook.toggle_all_output();
         });
         this.element.find('#toggle_all_output_scroll').click(function () {
             IPython.notebook.toggle_all_output_scroll();
         });
         this.element.find('#clear_all_output').click(function () {
             IPython.notebook.clear_all_output();
         });
         
         // Kernel
         this.element.find('#int_kernel').click(function () {
             IPython.notebook.session.interrupt_kernel();
         });
         this.element.find('#restart_kernel').click(function () {
             IPython.notebook.restart_kernel();
         });
         // Help
         this.element.find('#keyboard_shortcuts').click(function () {
             IPython.quick_help.show_keyboard_shortcuts();
         });
         
         this.update_restore_checkpoint(null);
         
         $([IPython.events]).on('checkpoints_listed.Notebook', function (event, data) {
             that.update_restore_checkpoint(IPython.notebook.checkpoints);
         });
         
         $([IPython.events]).on('checkpoint_created.Notebook', function (event, data) {
             that.update_restore_checkpoint(IPython.notebook.checkpoints);
         });
     };
 
     MenuBar.prototype.update_restore_checkpoint = function(checkpoints) {
         var ul = this.element.find("#restore_checkpoint").find("ul");
         ul.empty();
         if (!checkpoints || checkpoints.length === 0) {
             ul.append(
                 $("<li/>")
                 .addClass("disabled")
                 .append(
                     $("<a/>")
                     .text("No checkpoints")
                 )
             );
             return;
         }
         
         checkpoints.map(function (checkpoint) {
             var d = new Date(checkpoint.last_modified);
             ul.append(
                 $("<li/>").append(
                     $("<a/>")
                     .attr("href", "#")
                     .text(d.format("mmm dd HH:MM:ss"))
                     .click(function () {
                         IPython.notebook.restore_checkpoint_dialog(checkpoint);
                     })
                 )
             );
         });
     };
 
     IPython.MenuBar = MenuBar;
 
     return IPython;
 
 }(IPython));

IPython/html/static/notebook/js/notebook.js

@@ -1,2332 +1,2401 b''
 //----------------------------------------------------------------------------
 //  Copyright (C) 2011  The IPython Development Team
 //
 //  Distributed under the terms of the BSD License.  The full license is in
 //  the file COPYING, distributed as part of this software.
 //----------------------------------------------------------------------------
 
 //============================================================================
 // Notebook
 //============================================================================
 
 var IPython = (function (IPython) {
     "use strict";
 
     var utils = IPython.utils;
 
     /**
      * A notebook contains and manages cells.
      * 
      * @class Notebook
      * @constructor
      * @param {String} selector A jQuery selector for the notebook's DOM element
      * @param {Object} [options] A config object
      */
     var Notebook = function (selector, options) {
         this.options = options = options || {};
         this.base_url = options.base_url;
         this.notebook_path = options.notebook_path;
         this.notebook_name = options.notebook_name;
         this.element = $(selector);
         this.element.scroll();
         this.element.data("notebook", this);
         this.next_prompt_number = 1;
         this.session = null;
         this.kernel = null;
         this.clipboard = null;
         this.undelete_backup = null;
         this.undelete_index = null;
         this.undelete_below = false;
         this.paste_enabled = false;
         // It is important to start out in command mode to match the intial mode
         // of the KeyboardManager.
         this.mode = 'command';
         this.set_dirty(false);
         this.metadata = {};
         this._checkpoint_after_save = false;
         this.last_checkpoint = null;
         this.checkpoints = [];
         this.autosave_interval = 0;
         this.autosave_timer = null;
         // autosave *at most* every two minutes
         this.minimum_autosave_interval = 120000;
         // single worksheet for now
         this.worksheet_metadata = {};
         this.notebook_name_blacklist_re = /[\/\\:]/;
         this.nbformat = 3; // Increment this when changing the nbformat
         this.nbformat_minor = 0; // Increment this when changing the nbformat
         this.style();
         this.create_elements();
         this.bind_events();
     };
 
     /**
      * Tweak the notebook's CSS style.
      * 
      * @method style
      */
     Notebook.prototype.style = function () {
         $('div#notebook').addClass('border-box-sizing');
     };
 
     /**
      * Create an HTML and CSS representation of the notebook.
      * 
      * @method create_elements
      */
     Notebook.prototype.create_elements = function () {
         var that = this;
         this.element.attr('tabindex','-1');
         this.container = $("<div/>").addClass("container").attr("id", "notebook-container");
         // We add this end_space div to the end of the notebook div to:
         // i) provide a margin between the last cell and the end of the notebook
         // ii) to prevent the div from scrolling up when the last cell is being
         // edited, but is too low on the page, which browsers will do automatically.
         var end_space = $('<div/>').addClass('end_space');
         end_space.dblclick(function (e) {
             var ncells = that.ncells();
             that.insert_cell_below('code',ncells-1);
         });
         this.element.append(this.container);
         this.container.append(end_space);
     };
 
     /**
      * Bind JavaScript events: key presses and custom IPython events.
      * 
      * @method bind_events
      */
     Notebook.prototype.bind_events = function () {
         var that = this;
 
         $([IPython.events]).on('set_next_input.Notebook', function (event, data) {
             var index = that.find_cell_index(data.cell);
             var new_cell = that.insert_cell_below('code',index);
             new_cell.set_text(data.text);
             that.dirty = true;
         });
 
         $([IPython.events]).on('set_dirty.Notebook', function (event, data) {
             that.dirty = data.value;
         });
 
+        $([IPython.events]).on('trust_changed.Notebook', function (event, data) {
+            that.trusted = data.value;
+        });
+
         $([IPython.events]).on('select.Cell', function (event, data) {
             var index = that.find_cell_index(data.cell);
             that.select(index);
         });
 
         $([IPython.events]).on('edit_mode.Cell', function (event, data) {
             that.handle_edit_mode(that.find_cell_index(data.cell));
         });
 
         $([IPython.events]).on('command_mode.Cell', function (event, data) {
             that.command_mode();
         });
 
         $([IPython.events]).on('status_autorestarting.Kernel', function () {
             IPython.dialog.modal({
                 title: "Kernel Restarting",
                 body: "The kernel appears to have died. It will restart automatically.",
                 buttons: {
                     OK : {
                         class : "btn-primary"
                     }
                 }
             });
         });
 
         var collapse_time = function (time) {
             var app_height = $('#ipython-main-app').height(); // content height
             var splitter_height = $('div#pager_splitter').outerHeight(true);
             var new_height = app_height - splitter_height;
             that.element.animate({height : new_height + 'px'}, time);
         };
 
         this.element.bind('collapse_pager', function (event, extrap) {
             var time = (extrap !== undefined) ? ((extrap.duration !== undefined ) ? extrap.duration : 'fast') : 'fast';
             collapse_time(time);
         });
 
         var expand_time = function (time) {
             var app_height = $('#ipython-main-app').height(); // content height
             var splitter_height = $('div#pager_splitter').outerHeight(true);
             var pager_height = $('div#pager').outerHeight(true);
             var new_height = app_height - pager_height - splitter_height;
             that.element.animate({height : new_height + 'px'}, time);
         };
 
         this.element.bind('expand_pager', function (event, extrap) {
             var time = (extrap !== undefined) ? ((extrap.duration !== undefined ) ? extrap.duration : 'fast') : 'fast';
             expand_time(time);
         });
         
         // Firefox 22 broke $(window).on("beforeunload")
         // I'm not sure why or how.
         window.onbeforeunload = function (e) {
             // TODO: Make killing the kernel configurable.
             var kill_kernel = false;
             if (kill_kernel) {
                 that.session.kill_kernel();
             }
             // if we are autosaving, trigger an autosave on nav-away.
             // still warn, because if we don't the autosave may fail.
             if (that.dirty) {
                 if ( that.autosave_interval ) {
                     // schedule autosave in a timeout
                     // this gives you a chance to forcefully discard changes
                     // by reloading the page if you *really* want to.
                     // the timer doesn't start until you *dismiss* the dialog.
                     setTimeout(function () {
                         if (that.dirty) {
                             that.save_notebook();
                         }
                     }, 1000);
                     return "Autosave in progress, latest changes may be lost.";
                 } else {
                     return "Unsaved changes will be lost.";
                 }
             }
             // Null is the *only* return value that will make the browser not
             // pop up the "don't leave" dialog.
             return null;
         };
     };
 
     /**
      * Set the dirty flag, and trigger the set_dirty.Notebook event
      * 
      * @method set_dirty
      */
     Notebook.prototype.set_dirty = function (value) {
         if (value === undefined) {
             value = true;
         }
         if (this.dirty == value) {
             return;
         }
         $([IPython.events]).trigger('set_dirty.Notebook', {value: value});
     };
 
     /**
      * Scroll the top of the page to a given cell.
      * 
      * @method scroll_to_cell
      * @param {Number} cell_number An index of the cell to view
      * @param {Number} time Animation time in milliseconds
      * @return {Number} Pixel offset from the top of the container
      */
     Notebook.prototype.scroll_to_cell = function (cell_number, time) {
         var cells = this.get_cells();
         time = time || 0;
         cell_number = Math.min(cells.length-1,cell_number);
         cell_number = Math.max(0             ,cell_number);
         var scroll_value = cells[cell_number].element.position().top-cells[0].element.position().top ;
         this.element.animate({scrollTop:scroll_value}, time);
         return scroll_value;
     };
 
     /**
      * Scroll to the bottom of the page.
      * 
      * @method scroll_to_bottom
      */
     Notebook.prototype.scroll_to_bottom = function () {
         this.element.animate({scrollTop:this.element.get(0).scrollHeight}, 0);
     };
 
     /**
      * Scroll to the top of the page.
      * 
      * @method scroll_to_top
      */
     Notebook.prototype.scroll_to_top = function () {
         this.element.animate({scrollTop:0}, 0);
     };
 
     // Edit Notebook metadata
 
     Notebook.prototype.edit_metadata = function () {
         var that = this;
         IPython.dialog.edit_metadata(this.metadata, function (md) {
             that.metadata = md;
         }, 'Notebook');
     };
 
     // Cell indexing, retrieval, etc.
 
     /**
      * Get all cell elements in the notebook.
      * 
      * @method get_cell_elements
      * @return {jQuery} A selector of all cell elements
      */
     Notebook.prototype.get_cell_elements = function () {
         return this.container.children("div.cell");
     };
 
     /**
      * Get a particular cell element.
      * 
      * @method get_cell_element
      * @param {Number} index An index of a cell to select
      * @return {jQuery} A selector of the given cell.
      */
     Notebook.prototype.get_cell_element = function (index) {
         var result = null;
         var e = this.get_cell_elements().eq(index);
         if (e.length !== 0) {
             result = e;
         }
         return result;
     };
 
     /**
      * Try to get a particular cell by msg_id.
      * 
      * @method get_msg_cell
      * @param {String} msg_id A message UUID
      * @return {Cell} Cell or null if no cell was found.
      */
     Notebook.prototype.get_msg_cell = function (msg_id) {
         return IPython.CodeCell.msg_cells[msg_id] || null;
     };
 
     /**
      * Count the cells in this notebook.
      * 
      * @method ncells
      * @return {Number} The number of cells in this notebook
      */
     Notebook.prototype.ncells = function () {
         return this.get_cell_elements().length;
     };
 
     /**
      * Get all Cell objects in this notebook.
      * 
      * @method get_cells
      * @return {Array} This notebook's Cell objects
      */
     // TODO: we are often calling cells as cells()[i], which we should optimize
     // to cells(i) or a new method.
     Notebook.prototype.get_cells = function () {
         return this.get_cell_elements().toArray().map(function (e) {
             return $(e).data("cell");
         });
     };
 
     /**
      * Get a Cell object from this notebook.
      * 
      * @method get_cell
      * @param {Number} index An index of a cell to retrieve
      * @return {Cell} A particular cell
      */
     Notebook.prototype.get_cell = function (index) {
         var result = null;
         var ce = this.get_cell_element(index);
         if (ce !== null) {
             result = ce.data('cell');
         }
         return result;
     };
 
     /**
      * Get the cell below a given cell.
      * 
      * @method get_next_cell
      * @param {Cell} cell The provided cell
      * @return {Cell} The next cell
      */
     Notebook.prototype.get_next_cell = function (cell) {
         var result = null;
         var index = this.find_cell_index(cell);
         if (this.is_valid_cell_index(index+1)) {
             result = this.get_cell(index+1);
         }
         return result;
     };
 
     /**
      * Get the cell above a given cell.
      * 
      * @method get_prev_cell
      * @param {Cell} cell The provided cell
      * @return {Cell} The previous cell
      */
     Notebook.prototype.get_prev_cell = function (cell) {
         // TODO: off-by-one
         // nb.get_prev_cell(nb.get_cell(1)) is null
         var result = null;
         var index = this.find_cell_index(cell);
         if (index !== null && index > 1) {
             result = this.get_cell(index-1);
         }
         return result;
     };
     
     /**
      * Get the numeric index of a given cell.
      * 
      * @method find_cell_index
      * @param {Cell} cell The provided cell
      * @return {Number} The cell's numeric index
      */
     Notebook.prototype.find_cell_index = function (cell) {
         var result = null;
         this.get_cell_elements().filter(function (index) {
             if ($(this).data("cell") === cell) {
                 result = index;
             }
         });
         return result;
     };
 
     /**
      * Get a given index , or the selected index if none is provided.
      * 
      * @method index_or_selected
      * @param {Number} index A cell's index
      * @return {Number} The given index, or selected index if none is provided.
      */
     Notebook.prototype.index_or_selected = function (index) {
         var i;
         if (index === undefined || index === null) {
             i = this.get_selected_index();
             if (i === null) {
                 i = 0;
             }
         } else {
             i = index;
         }
         return i;
     };
 
     /**
      * Get the currently selected cell.
      * @method get_selected_cell
      * @return {Cell} The selected cell
      */
     Notebook.prototype.get_selected_cell = function () {
         var index = this.get_selected_index();
         return this.get_cell(index);
     };
 
     /**
      * Check whether a cell index is valid.
      * 
      * @method is_valid_cell_index
      * @param {Number} index A cell index
      * @return True if the index is valid, false otherwise
      */
     Notebook.prototype.is_valid_cell_index = function (index) {
         if (index !== null && index >= 0 && index < this.ncells()) {
             return true;
         } else {
             return false;
         }
     };
 
     /**
      * Get the index of the currently selected cell.
      
      * @method get_selected_index
      * @return {Number} The selected cell's numeric index
      */
     Notebook.prototype.get_selected_index = function () {
         var result = null;
         this.get_cell_elements().filter(function (index) {
             if ($(this).data("cell").selected === true) {
                 result = index;
             }
         });
         return result;
     };
 
 
     // Cell selection.
 
     /**
      * Programmatically select a cell.
      * 
      * @method select
      * @param {Number} index A cell's index
      * @return {Notebook} This notebook
      */
     Notebook.prototype.select = function (index) {
         if (this.is_valid_cell_index(index)) {
             var sindex = this.get_selected_index();
             if (sindex !== null && index !== sindex) {
                 this.get_cell(sindex).unselect();
             }
             var cell = this.get_cell(index);
             cell.select();
             if (cell.cell_type === 'heading') {
                 $([IPython.events]).trigger('selected_cell_type_changed.Notebook',
                     {'cell_type':cell.cell_type,level:cell.level}
                 );
             } else {
                 $([IPython.events]).trigger('selected_cell_type_changed.Notebook',
                     {'cell_type':cell.cell_type}
                 );
             }
         }
         return this;
     };
 
     /**
      * Programmatically select the next cell.
      *
      * @method select_next
      * @return {Notebook} This notebook
      */
     Notebook.prototype.select_next = function () {
         var index = this.get_selected_index();
         this.select(index+1);
         return this;
     };
 
     /**
      * Programmatically select the previous cell.
      *
      * @method select_prev
      * @return {Notebook} This notebook
      */
     Notebook.prototype.select_prev = function () {
         var index = this.get_selected_index();
         this.select(index-1);
         return this;
     };
 
 
     // Edit/Command mode
 
     /**
      * Gets the index of the cell that is in edit mode.
      *
      * @method get_edit_index
      *
      * @return index {int}
      **/
     Notebook.prototype.get_edit_index = function () {
         var result = null;
         this.get_cell_elements().filter(function (index) {
             if ($(this).data("cell").mode === 'edit') {
                 result = index;
             }
         });
         return result;
     };
 
     /**
      * Make the notebook enter command mode.
      *
      * @method command_mode
      **/
     Notebook.prototype.command_mode = function () {
         // Make sure there isn't an edit mode cell lingering around.
         var cell = this.get_cell(this.get_edit_index());
         if (cell) {
             cell.command_mode();
         }
 
         // Notify the keyboard manager if this is a change of mode for the 
         // notebook as a whole.
         if (this.mode !== 'command') {
             this.mode = 'command';
             $([IPython.events]).trigger('command_mode.Notebook');
             IPython.keyboard_manager.command_mode();
         }
     };
 
     /**
      * Handle when a cell fires it's edit_mode event.
      *
      * @method handle_edit_mode
      * @param [index] {int} Cell index to select.  If no index is provided, 
      *  the current selected cell is used.
      **/
     Notebook.prototype.handle_edit_mode = function (index) {
         // Make sure the cell exists.
         var cell = this.get_cell(index);
         if (cell === null) { return; }
 
         // Set the cell to edit mode and notify the keyboard manager if this
         // is a change of mode for the notebook as a whole.
         if (this.mode !== 'edit') {
             cell.edit_mode();
             this.mode = 'edit';
             $([IPython.events]).trigger('edit_mode.Notebook');
             IPython.keyboard_manager.edit_mode();
         }
     };
 
     /**
      * Make a cell enter edit mode.
      *
      * @method edit_mode
      * @param [index] {int} Cell index to select.  If no index is provided, 
      *  the current selected cell is used.
      **/
     Notebook.prototype.edit_mode = function (index) {
         if (index===undefined) {
             index = this.get_selected_index();
         }
         // Make sure the cell exists.
         var cell = this.get_cell(index);
         if (cell === null) { return; }
         if (cell.mode != 'edit') {
             cell.unrender();
             cell.focus_editor();
         }
     };
 
     /**
      * Focus the currently selected cell.
      *
      * @method focus_cell
      **/
     Notebook.prototype.focus_cell = function () {
         var cell = this.get_selected_cell();
         if (cell === null) {return;}  // No cell is selected
         cell.focus_cell();
     };
 
     // Cell movement
 
     /**
      * Move given (or selected) cell up and select it.
      * 
      * @method move_cell_up
      * @param [index] {integer} cell index
      * @return {Notebook} This notebook
      **/
     Notebook.prototype.move_cell_up = function (index) {
         var i = this.index_or_selected(index);
         if (this.is_valid_cell_index(i) && i > 0) {
             var pivot = this.get_cell_element(i-1);
             var tomove = this.get_cell_element(i);
             if (pivot !== null && tomove !== null) {
                 tomove.detach();
                 pivot.before(tomove);
                 this.select(i-1);
                 var cell = this.get_selected_cell();
                 cell.focus_cell();
             }
             this.set_dirty(true);
         }
         return this;
     };
 
 
     /**
      * Move given (or selected) cell down and select it
      * 
      * @method move_cell_down
      * @param [index] {integer} cell index
      * @return {Notebook} This notebook
      **/
     Notebook.prototype.move_cell_down = function (index) {
         var i = this.index_or_selected(index);
         if (this.is_valid_cell_index(i) && this.is_valid_cell_index(i+1)) {
             var pivot = this.get_cell_element(i+1);
             var tomove = this.get_cell_element(i);
             if (pivot !== null && tomove !== null) {
                 tomove.detach();
                 pivot.after(tomove);
                 this.select(i+1);
                 var cell = this.get_selected_cell();
                 cell.focus_cell();
             }
         }
         this.set_dirty();
         return this;
     };
 
 
     // Insertion, deletion.
 
     /**
      * Delete a cell from the notebook.
      * 
      * @method delete_cell
      * @param [index] A cell's numeric index
      * @return {Notebook} This notebook
      */
     Notebook.prototype.delete_cell = function (index) {
         var i = this.index_or_selected(index);
         var cell = this.get_selected_cell();
         this.undelete_backup = cell.toJSON();
         $('#undelete_cell').removeClass('disabled');
         if (this.is_valid_cell_index(i)) {
             var old_ncells = this.ncells();
             var ce = this.get_cell_element(i);
             ce.remove();
             if (i === 0) {
                 // Always make sure we have at least one cell.
                 if (old_ncells === 1) {
                     this.insert_cell_below('code');
                 }
                 this.select(0);
                 this.undelete_index = 0;
                 this.undelete_below = false;
             } else if (i === old_ncells-1 && i !== 0) {
                 this.select(i-1);
                 this.undelete_index = i - 1;
                 this.undelete_below = true;
             } else {
                 this.select(i);
                 this.undelete_index = i;
                 this.undelete_below = false;
             }
             $([IPython.events]).trigger('delete.Cell', {'cell': cell, 'index': i});
             this.set_dirty(true);
         }
         return this;
     };
 
     /**
      * Restore the most recently deleted cell.
      * 
      * @method undelete
      */
     Notebook.prototype.undelete_cell = function() {
         if (this.undelete_backup !== null && this.undelete_index !== null) {
             var current_index = this.get_selected_index();
             if (this.undelete_index < current_index) {
                 current_index = current_index + 1;
             }
             if (this.undelete_index >= this.ncells()) {
                 this.select(this.ncells() - 1);
             }
             else {
                 this.select(this.undelete_index);
             }
             var cell_data = this.undelete_backup;
             var new_cell = null;
             if (this.undelete_below) {
                 new_cell = this.insert_cell_below(cell_data.cell_type);
             } else {
                 new_cell = this.insert_cell_above(cell_data.cell_type);
             }
             new_cell.fromJSON(cell_data);
             if (this.undelete_below) {
                 this.select(current_index+1);
             } else {
                 this.select(current_index);
             }
             this.undelete_backup = null;
             this.undelete_index = null;
         }
         $('#undelete_cell').addClass('disabled');
     };
 
     /**
      * Insert a cell so that after insertion the cell is at given index.
      *
      * Similar to insert_above, but index parameter is mandatory
      *
      * Index will be brought back into the accissible range [0,n]
      *
      * @method insert_cell_at_index
      * @param type {string} in ['code','markdown','heading']
      * @param [index] {int} a valid index where to inser cell
      *
      * @return cell {cell|null} created cell or null
      **/
     Notebook.prototype.insert_cell_at_index = function(type, index){
 
         var ncells = this.ncells();
         index = Math.min(index,ncells);
         index = Math.max(index,0);
         var cell = null;
 
         if (ncells === 0 || this.is_valid_cell_index(index) || index === ncells) {
             if (type === 'code') {
                 cell = new IPython.CodeCell(this.kernel);
                 cell.set_input_prompt();
             } else if (type === 'markdown') {
                 cell = new IPython.MarkdownCell();
             } else if (type === 'raw') {
                 cell = new IPython.RawCell();
             } else if (type === 'heading') {
                 cell = new IPython.HeadingCell();
             }
 
             if(this._insert_element_at_index(cell.element,index)) {
                 cell.render();
                 $([IPython.events]).trigger('create.Cell', {'cell': cell, 'index': index});
                 cell.refresh();
                 // We used to select the cell after we refresh it, but there
                 // are now cases were this method is called where select is
                 // not appropriate. The selection logic should be handled by the
                 // caller of the the top level insert_cell methods.
                 this.set_dirty(true);
             }
         }
         return cell;
 
     };
 
     /**
      * Insert an element at given cell index.
      *
      * @method _insert_element_at_index
      * @param element {dom element} a cell element
      * @param [index] {int} a valid index where to inser cell
      * @private
      *
      * return true if everything whent fine.
      **/
     Notebook.prototype._insert_element_at_index = function(element, index){
         if (element === undefined){
             return false;
         }
 
         var ncells = this.ncells();
 
         if (ncells === 0) {
             // special case append if empty
             this.element.find('div.end_space').before(element);
         } else if ( ncells === index ) {
             // special case append it the end, but not empty
             this.get_cell_element(index-1).after(element);
         } else if (this.is_valid_cell_index(index)) {
             // otherwise always somewhere to append to
             this.get_cell_element(index).before(element);
         } else {
             return false;
         }
 
         if (this.undelete_index !== null && index <= this.undelete_index) {
             this.undelete_index = this.undelete_index + 1;
             this.set_dirty(true);
         }
         return true;
     };
 
     /**
      * Insert a cell of given type above given index, or at top
      * of notebook if index smaller than 0.
      *
      * default index value is the one of currently selected cell
      *
      * @method insert_cell_above
      * @param type {string} cell type
      * @param [index] {integer}
      *
      * @return handle to created cell or null
      **/
     Notebook.prototype.insert_cell_above = function (type, index) {
         index = this.index_or_selected(index);
         return this.insert_cell_at_index(type, index);
     };
 
     /**
      * Insert a cell of given type below given index, or at bottom
      * of notebook if index greater thatn number of cell
      *
      * default index value is the one of currently selected cell
      *
      * @method insert_cell_below
      * @param type {string} cell type
      * @param [index] {integer}
      *
      * @return handle to created cell or null
      *
      **/
     Notebook.prototype.insert_cell_below = function (type, index) {
         index = this.index_or_selected(index);
         return this.insert_cell_at_index(type, index+1);
     };
 
 
     /**
      * Insert cell at end of notebook
      *
      * @method insert_cell_at_bottom
      * @param {String} type cell type
      *
      * @return the added cell; or null
      **/
     Notebook.prototype.insert_cell_at_bottom = function (type){
         var len = this.ncells();
         return this.insert_cell_below(type,len-1);
     };
 
     /**
      * Turn a cell into a code cell.
      * 
      * @method to_code
      * @param {Number} [index] A cell's index
      */
     Notebook.prototype.to_code = function (index) {
         var i = this.index_or_selected(index);
         if (this.is_valid_cell_index(i)) {
             var source_element = this.get_cell_element(i);
             var source_cell = source_element.data("cell");
             if (!(source_cell instanceof IPython.CodeCell)) {
                 var target_cell = this.insert_cell_below('code',i);
                 var text = source_cell.get_text();
                 if (text === source_cell.placeholder) {
                     text = '';
                 }
                 target_cell.set_text(text);
                 // make this value the starting point, so that we can only undo
                 // to this state, instead of a blank cell
                 target_cell.code_mirror.clearHistory();
                 source_element.remove();
                 this.select(i);
                 this.set_dirty(true);
             }
         }
     };
 
     /**
      * Turn a cell into a Markdown cell.
      * 
      * @method to_markdown
      * @param {Number} [index] A cell's index
      */
     Notebook.prototype.to_markdown = function (index) {
         var i = this.index_or_selected(index);
         if (this.is_valid_cell_index(i)) {
             var source_element = this.get_cell_element(i);
             var source_cell = source_element.data("cell");
             if (!(source_cell instanceof IPython.MarkdownCell)) {
                 var target_cell = this.insert_cell_below('markdown',i);
                 var text = source_cell.get_text();
                 if (text === source_cell.placeholder) {
                     text = '';
                 }
                 // We must show the editor before setting its contents
                 target_cell.unrender();
                 target_cell.set_text(text);
                 // make this value the starting point, so that we can only undo
                 // to this state, instead of a blank cell
                 target_cell.code_mirror.clearHistory();
                 source_element.remove();
                 this.select(i);
                 if ((source_cell instanceof IPython.TextCell) && source_cell.rendered) {
                     target_cell.render();
                 }
                 this.set_dirty(true);
             }
         }
     };
 
     /**
      * Turn a cell into a raw text cell.
      * 
      * @method to_raw
      * @param {Number} [index] A cell's index
      */
     Notebook.prototype.to_raw = function (index) {
         var i = this.index_or_selected(index);
         if (this.is_valid_cell_index(i)) {
             var source_element = this.get_cell_element(i);
             var source_cell = source_element.data("cell");
             var target_cell = null;
             if (!(source_cell instanceof IPython.RawCell)) {
                 target_cell = this.insert_cell_below('raw',i);
                 var text = source_cell.get_text();
                 if (text === source_cell.placeholder) {
                     text = '';
                 }
                 // We must show the editor before setting its contents
                 target_cell.unrender();
                 target_cell.set_text(text);
                 // make this value the starting point, so that we can only undo
                 // to this state, instead of a blank cell
                 target_cell.code_mirror.clearHistory();
                 source_element.remove();
                 this.select(i);
                 this.set_dirty(true);
             }
         }
     };
 
     /**
      * Turn a cell into a heading cell.
      * 
      * @method to_heading
      * @param {Number} [index] A cell's index
      * @param {Number} [level] A heading level (e.g., 1 becomes &lt;h1&gt;)
      */
     Notebook.prototype.to_heading = function (index, level) {
         level = level || 1;
         var i = this.index_or_selected(index);
         if (this.is_valid_cell_index(i)) {
             var source_element = this.get_cell_element(i);
             var source_cell = source_element.data("cell");
             var target_cell = null;
             if (source_cell instanceof IPython.HeadingCell) {
                 source_cell.set_level(level);
             } else {
                 target_cell = this.insert_cell_below('heading',i);
                 var text = source_cell.get_text();
                 if (text === source_cell.placeholder) {
                     text = '';
                 }
                 // We must show the editor before setting its contents
                 target_cell.set_level(level);
                 target_cell.unrender();
                 target_cell.set_text(text);
                 // make this value the starting point, so that we can only undo
                 // to this state, instead of a blank cell
                 target_cell.code_mirror.clearHistory();
                 source_element.remove();
                 this.select(i);
                 if ((source_cell instanceof IPython.TextCell) && source_cell.rendered) {
                     target_cell.render();
                 }
             }
             this.set_dirty(true);
             $([IPython.events]).trigger('selected_cell_type_changed.Notebook',
                 {'cell_type':'heading',level:level}
             );
         }
     };
 
 
     // Cut/Copy/Paste
 
     /**
      * Enable UI elements for pasting cells.
      * 
      * @method enable_paste
      */
     Notebook.prototype.enable_paste = function () {
         var that = this;
         if (!this.paste_enabled) {
             $('#paste_cell_replace').removeClass('disabled')
                 .on('click', function () {that.paste_cell_replace();});
             $('#paste_cell_above').removeClass('disabled')
                 .on('click', function () {that.paste_cell_above();});
             $('#paste_cell_below').removeClass('disabled')
                 .on('click', function () {that.paste_cell_below();});
             this.paste_enabled = true;
         }
     };
 
     /**
      * Disable UI elements for pasting cells.
      * 
      * @method disable_paste
      */
     Notebook.prototype.disable_paste = function () {
         if (this.paste_enabled) {
             $('#paste_cell_replace').addClass('disabled').off('click');
             $('#paste_cell_above').addClass('disabled').off('click');
             $('#paste_cell_below').addClass('disabled').off('click');
             this.paste_enabled = false;
         }
     };
 
     /**
      * Cut a cell.
      * 
      * @method cut_cell
      */
     Notebook.prototype.cut_cell = function () {
         this.copy_cell();
         this.delete_cell();
     };
 
     /**
      * Copy a cell.
      * 
      * @method copy_cell
      */
     Notebook.prototype.copy_cell = function () {
         var cell = this.get_selected_cell();
         this.clipboard = cell.toJSON();
         this.enable_paste();
     };
 
     /**
      * Replace the selected cell with a cell in the clipboard.
      * 
      * @method paste_cell_replace
      */
     Notebook.prototype.paste_cell_replace = function () {
         if (this.clipboard !== null && this.paste_enabled) {
             var cell_data = this.clipboard;
             var new_cell = this.insert_cell_above(cell_data.cell_type);
             new_cell.fromJSON(cell_data);
             var old_cell = this.get_next_cell(new_cell);
             this.delete_cell(this.find_cell_index(old_cell));
             this.select(this.find_cell_index(new_cell));
         }
     };
 
     /**
      * Paste a cell from the clipboard above the selected cell.
      * 
      * @method paste_cell_above
      */
     Notebook.prototype.paste_cell_above = function () {
         if (this.clipboard !== null && this.paste_enabled) {
             var cell_data = this.clipboard;
             var new_cell = this.insert_cell_above(cell_data.cell_type);
             new_cell.fromJSON(cell_data);
             new_cell.focus_cell();
         }
     };
 
     /**
      * Paste a cell from the clipboard below the selected cell.
      * 
      * @method paste_cell_below
      */
     Notebook.prototype.paste_cell_below = function () {
         if (this.clipboard !== null && this.paste_enabled) {
             var cell_data = this.clipboard;
             var new_cell = this.insert_cell_below(cell_data.cell_type);
             new_cell.fromJSON(cell_data);
             new_cell.focus_cell();
         }
     };
 
     // Split/merge
 
     /**
      * Split the selected cell into two, at the cursor.
      * 
      * @method split_cell
      */
     Notebook.prototype.split_cell = function () {
         var mdc = IPython.MarkdownCell;
         var rc = IPython.RawCell;
         var cell = this.get_selected_cell();
         if (cell.is_splittable()) {
             var texta = cell.get_pre_cursor();
             var textb = cell.get_post_cursor();
             if (cell instanceof IPython.CodeCell) {
                 // In this case the operations keep the notebook in its existing mode
                 // so we don't need to do any post-op mode changes.
                 cell.set_text(textb);
                 var new_cell = this.insert_cell_above('code');
                 new_cell.set_text(texta);
             } else if ((cell instanceof mdc && !cell.rendered) || (cell instanceof rc)) {
                 // We know cell is !rendered so we can use set_text.
                 cell.set_text(textb);
                 var new_cell = this.insert_cell_above(cell.cell_type);
                 // Unrender the new cell so we can call set_text.
                 new_cell.unrender();
                 new_cell.set_text(texta);
             }
         }
     };
 
     /**
      * Combine the selected cell into the cell above it.
      * 
      * @method merge_cell_above
      */
     Notebook.prototype.merge_cell_above = function () {
         var mdc = IPython.MarkdownCell;
         var rc = IPython.RawCell;
         var index = this.get_selected_index();
         var cell = this.get_cell(index);
         var render = cell.rendered;
         if (!cell.is_mergeable()) {
             return;
         }
         if (index > 0) {
             var upper_cell = this.get_cell(index-1);
             if (!upper_cell.is_mergeable()) {
                 return;
             }
             var upper_text = upper_cell.get_text();
             var text = cell.get_text();
             if (cell instanceof IPython.CodeCell) {
                 cell.set_text(upper_text+'\n'+text);
             } else if ((cell instanceof mdc) || (cell instanceof rc)) {
                 cell.unrender(); // Must unrender before we set_text.
                 cell.set_text(upper_text+'\n\n'+text);
                 if (render) {
                     // The rendered state of the final cell should match
                     // that of the original selected cell;
                     cell.render();
                 }
             }
             this.delete_cell(index-1);
             this.select(this.find_cell_index(cell));
         }
     };
 
     /**
      * Combine the selected cell into the cell below it.
      * 
      * @method merge_cell_below
      */
     Notebook.prototype.merge_cell_below = function () {
         var mdc = IPython.MarkdownCell;
         var rc = IPython.RawCell;
         var index = this.get_selected_index();
         var cell = this.get_cell(index);
         var render = cell.rendered;
         if (!cell.is_mergeable()) {
             return;
         }
         if (index < this.ncells()-1) {
             var lower_cell = this.get_cell(index+1);
             if (!lower_cell.is_mergeable()) {
                 return;
             }
             var lower_text = lower_cell.get_text();
             var text = cell.get_text();
             if (cell instanceof IPython.CodeCell) {
                 cell.set_text(text+'\n'+lower_text);
             } else if ((cell instanceof mdc) || (cell instanceof rc)) {
                 cell.unrender(); // Must unrender before we set_text.
                 cell.set_text(text+'\n\n'+lower_text);
                 if (render) {
                     // The rendered state of the final cell should match
                     // that of the original selected cell;
                     cell.render();
                 }
             }
             this.delete_cell(index+1);
             this.select(this.find_cell_index(cell));
         }
     };
 
 
     // Cell collapsing and output clearing
 
     /**
      * Hide a cell's output.
      * 
      * @method collapse_output
      * @param {Number} index A cell's numeric index
      */
     Notebook.prototype.collapse_output = function (index) {
         var i = this.index_or_selected(index);
         var cell = this.get_cell(i);
         if (cell !== null && (cell instanceof IPython.CodeCell)) {
             cell.collapse_output();
             this.set_dirty(true);
         }
     };
 
     /**
      * Hide each code cell's output area.
      * 
      * @method collapse_all_output
      */
     Notebook.prototype.collapse_all_output = function () {
         $.map(this.get_cells(), function (cell, i) {
             if (cell instanceof IPython.CodeCell) {
                 cell.collapse_output();
             }
         });
         // this should not be set if the `collapse` key is removed from nbformat
         this.set_dirty(true);
     };
 
     /**
      * Show a cell's output.
      * 
      * @method expand_output
      * @param {Number} index A cell's numeric index
      */
     Notebook.prototype.expand_output = function (index) {
         var i = this.index_or_selected(index);
         var cell = this.get_cell(i);
         if (cell !== null && (cell instanceof IPython.CodeCell)) {
             cell.expand_output();
             this.set_dirty(true);
         }
     };
 
     /**
      * Expand each code cell's output area, and remove scrollbars.
      * 
      * @method expand_all_output
      */
     Notebook.prototype.expand_all_output = function () {
         $.map(this.get_cells(), function (cell, i) {
             if (cell instanceof IPython.CodeCell) {
                 cell.expand_output();
             }
         });
         // this should not be set if the `collapse` key is removed from nbformat
         this.set_dirty(true);
     };
 
     /**
      * Clear the selected CodeCell's output area.
      * 
      * @method clear_output
      * @param {Number} index A cell's numeric index
      */
     Notebook.prototype.clear_output = function (index) {
         var i = this.index_or_selected(index);
         var cell = this.get_cell(i);
         if (cell !== null && (cell instanceof IPython.CodeCell)) {
             cell.clear_output();
             this.set_dirty(true);
         }
     };
 
     /**
      * Clear each code cell's output area.
      * 
      * @method clear_all_output
      */
     Notebook.prototype.clear_all_output = function () {
         $.map(this.get_cells(), function (cell, i) {
             if (cell instanceof IPython.CodeCell) {
                 cell.clear_output();
             }
         });
         this.set_dirty(true);
     };
 
     /**
      * Scroll the selected CodeCell's output area.
      * 
      * @method scroll_output
      * @param {Number} index A cell's numeric index
      */
     Notebook.prototype.scroll_output = function (index) {
         var i = this.index_or_selected(index);
         var cell = this.get_cell(i);
         if (cell !== null && (cell instanceof IPython.CodeCell)) {
             cell.scroll_output();
             this.set_dirty(true);
         }
     };
 
     /**
      * Expand each code cell's output area, and add a scrollbar for long output.
      * 
      * @method scroll_all_output
      */
     Notebook.prototype.scroll_all_output = function () {
         $.map(this.get_cells(), function (cell, i) {
             if (cell instanceof IPython.CodeCell) {
                 cell.scroll_output();
             }
         });
         // this should not be set if the `collapse` key is removed from nbformat
         this.set_dirty(true);
     };
 
     /** Toggle whether a cell's output is collapsed or expanded.
      * 
      * @method toggle_output
      * @param {Number} index A cell's numeric index
      */
     Notebook.prototype.toggle_output = function (index) {
         var i = this.index_or_selected(index);
         var cell = this.get_cell(i);
         if (cell !== null && (cell instanceof IPython.CodeCell)) {
             cell.toggle_output();
             this.set_dirty(true);
         }
     };
 
     /**
      * Hide/show the output of all cells.
      * 
      * @method toggle_all_output
      */
     Notebook.prototype.toggle_all_output = function () {
         $.map(this.get_cells(), function (cell, i) {
             if (cell instanceof IPython.CodeCell) {
                 cell.toggle_output();
             }
         });
         // this should not be set if the `collapse` key is removed from nbformat
         this.set_dirty(true);
     };
 
     /**
      * Toggle a scrollbar for long cell outputs.
      * 
      * @method toggle_output_scroll
      * @param {Number} index A cell's numeric index
      */
     Notebook.prototype.toggle_output_scroll = function (index) {
         var i = this.index_or_selected(index);
         var cell = this.get_cell(i);
         if (cell !== null && (cell instanceof IPython.CodeCell)) {
             cell.toggle_output_scroll();
             this.set_dirty(true);
         }
     };
 
     /**
      * Toggle the scrolling of long output on all cells.
      * 
      * @method toggle_all_output_scrolling
      */
     Notebook.prototype.toggle_all_output_scroll = function () {
         $.map(this.get_cells(), function (cell, i) {
             if (cell instanceof IPython.CodeCell) {
                 cell.toggle_output_scroll();
             }
         });
         // this should not be set if the `collapse` key is removed from nbformat
         this.set_dirty(true);
     };
 
     // Other cell functions: line numbers, ...
 
     /**
      * Toggle line numbers in the selected cell's input area.
      * 
      * @method cell_toggle_line_numbers
      */
     Notebook.prototype.cell_toggle_line_numbers = function() {
         this.get_selected_cell().toggle_line_numbers();
     };
 
     // Session related things
 
     /**
      * Start a new session and set it on each code cell.
      * 
      * @method start_session
      */
     Notebook.prototype.start_session = function () {
         this.session = new IPython.Session(this, this.options);
         this.session.start($.proxy(this._session_started, this));
     };
 
 
     /**
      * Once a session is started, link the code cells to the kernel and pass the 
      * comm manager to the widget manager
      *
      */
     Notebook.prototype._session_started = function(){
         this.kernel = this.session.kernel;
         var ncells = this.ncells();
         for (var i=0; i<ncells; i++) {
             var cell = this.get_cell(i);
             if (cell instanceof IPython.CodeCell) {
                 cell.set_kernel(this.session.kernel);
             }
         }
     };
     
     /**
      * Prompt the user to restart the IPython kernel.
      * 
      * @method restart_kernel
      */
     Notebook.prototype.restart_kernel = function () {
         var that = this;
         IPython.dialog.modal({
             title : "Restart kernel or continue running?",
             body : $("<p/>").text(
                 'Do you want to restart the current kernel?  You will lose all variables defined in it.'
             ),
             buttons : {
                 "Continue running" : {},
                 "Restart" : {
                     "class" : "btn-danger",
                     "click" : function() {
                         that.session.restart_kernel();
                     }
                 }
             }
         });
     };
     
     /**
      * Execute or render cell outputs and go into command mode.
      * 
      * @method execute_cell
      */
     Notebook.prototype.execute_cell = function () {
         // mode = shift, ctrl, alt
         var cell = this.get_selected_cell();
         var cell_index = this.find_cell_index(cell);
         
         cell.execute();
         cell.focus_cell();
         this.command_mode();
         this.set_dirty(true);
     };
 
     /**
      * Execute or render cell outputs and insert a new cell below.
      * 
      * @method execute_cell_and_insert_below
      */
     Notebook.prototype.execute_cell_and_insert_below = function () {
         var cell = this.get_selected_cell();
         var cell_index = this.find_cell_index(cell);
         
         cell.execute();
 
         // If we are at the end always insert a new cell and return
         if (cell_index === (this.ncells()-1)) {
             this.insert_cell_below('code');
             this.edit_mode(cell_index+1);
             this.scroll_to_bottom();
             this.set_dirty(true);
             return;
         }
   
         this.insert_cell_below('code');
         this.edit_mode(cell_index+1);
         this.set_dirty(true);
     };
 
     /**
      * Execute or render cell outputs and select the next cell.
      * 
      * @method execute_cell_and_select_below
      */
     Notebook.prototype.execute_cell_and_select_below = function () {
 
         var cell = this.get_selected_cell();
         var cell_index = this.find_cell_index(cell);
         
         cell.execute();
 
         // If we are at the end always insert a new cell and return
         if (cell_index === (this.ncells()-1)) {
             this.insert_cell_below('code');
             this.edit_mode(cell_index+1);
             this.scroll_to_bottom();
             this.set_dirty(true);
             return;
         }
 
         this.select(cell_index+1);
         this.get_cell(cell_index+1).focus_cell();
         this.command_mode();
         this.set_dirty(true);
     };
 
     /**
      * Execute all cells below the selected cell.
      * 
      * @method execute_cells_below
      */
     Notebook.prototype.execute_cells_below = function () {
         this.execute_cell_range(this.get_selected_index(), this.ncells());
         this.scroll_to_bottom();
     };
 
     /**
      * Execute all cells above the selected cell.
      * 
      * @method execute_cells_above
      */
     Notebook.prototype.execute_cells_above = function () {
         this.execute_cell_range(0, this.get_selected_index());
     };
 
     /**
      * Execute all cells.
      * 
      * @method execute_all_cells
      */
     Notebook.prototype.execute_all_cells = function () {
         this.execute_cell_range(0, this.ncells());
         this.scroll_to_bottom();
     };
 
     /**
      * Execute a contiguous range of cells.
      * 
      * @method execute_cell_range
      * @param {Number} start Index of the first cell to execute (inclusive)
      * @param {Number} end Index of the last cell to execute (exclusive)
      */
     Notebook.prototype.execute_cell_range = function (start, end) {
         for (var i=start; i<end; i++) {
             this.select(i);
             this.execute_cell();
         }
     };
 
     // Persistance and loading
 
     /**
      * Getter method for this notebook's name.
      * 
      * @method get_notebook_name
      * @return {String} This notebook's name (excluding file extension)
      */
     Notebook.prototype.get_notebook_name = function () {
         var nbname = this.notebook_name.substring(0,this.notebook_name.length-6);
         return nbname;
     };
 
     /**
      * Setter method for this notebook's name.
      *
      * @method set_notebook_name
      * @param {String} name A new name for this notebook
      */
     Notebook.prototype.set_notebook_name = function (name) {
         this.notebook_name = name;
     };
 
     /**
      * Check that a notebook's name is valid.
      * 
      * @method test_notebook_name
      * @param {String} nbname A name for this notebook
      * @return {Boolean} True if the name is valid, false if invalid
      */
     Notebook.prototype.test_notebook_name = function (nbname) {
         nbname = nbname || '';
         if (nbname.length>0 && !this.notebook_name_blacklist_re.test(nbname)) {
             return true;
         } else {
             return false;
         }
     };
 
     /**
      * Load a notebook from JSON (.ipynb).
      * 
      * This currently handles one worksheet: others are deleted.
      * 
      * @method fromJSON
      * @param {Object} data JSON representation of a notebook
      */
     Notebook.prototype.fromJSON = function (data) {
         var content = data.content;
         var ncells = this.ncells();
         var i;
         for (i=0; i<ncells; i++) {
             // Always delete cell 0 as they get renumbered as they are deleted.
             this.delete_cell(0);
         }
         // Save the metadata and name.
         this.metadata = content.metadata;
         this.notebook_name = data.name;
+        var trusted = true;
         // Only handle 1 worksheet for now.
         var worksheet = content.worksheets[0];
         if (worksheet !== undefined) {
             if (worksheet.metadata) {
                 this.worksheet_metadata = worksheet.metadata;
             }
             var new_cells = worksheet.cells;
             ncells = new_cells.length;
             var cell_data = null;
             var new_cell = null;
             for (i=0; i<ncells; i++) {
                 cell_data = new_cells[i];
                 // VERSIONHACK: plaintext -> raw
                 // handle never-released plaintext name for raw cells
                 if (cell_data.cell_type === 'plaintext'){
                     cell_data.cell_type = 'raw';
                 }
 
                 new_cell = this.insert_cell_at_index(cell_data.cell_type, i);
                 new_cell.fromJSON(cell_data);
+                if (new_cell.cell_type == 'code' && !new_cell.output_area.trusted) {
+                    trusted = false;
+                }
             }
         }
+        if (trusted != this.trusted) {
+            this.trusted = trusted;
+            $([IPython.events]).trigger("trust_changed.Notebook", trusted);
+        }
         if (content.worksheets.length > 1) {
             IPython.dialog.modal({
                 title : "Multiple worksheets",
                 body : "This notebook has " + data.worksheets.length + " worksheets, " +
                     "but this version of IPython can only handle the first.  " +
                     "If you save this notebook, worksheets after the first will be lost.",
                 buttons : {
                     OK : {
                         class : "btn-danger"
                     }
                 }
             });
         }
     };
 
     /**
      * Dump this notebook into a JSON-friendly object.
      * 
      * @method toJSON
      * @return {Object} A JSON-friendly representation of this notebook.
      */
     Notebook.prototype.toJSON = function () {
         var cells = this.get_cells();
         var ncells = cells.length;
         var cell_array = new Array(ncells);
+        var trusted = true;
         for (var i=0; i<ncells; i++) {
-            cell_array[i] = cells[i].toJSON();
+            var cell = cells[i];
+            if (cell.cell_type == 'code' && !cell.output_area.trusted) {
+                trusted = false;
+            }
+            cell_array[i] = cell.toJSON();
         }
         var data = {
             // Only handle 1 worksheet for now.
             worksheets : [{
                 cells: cell_array,
                 metadata: this.worksheet_metadata
             }],
             metadata : this.metadata
         };
+        if (trusted != this.trusted) {
+            this.trusted = trusted;
+            $([IPython.events]).trigger("trust_changed.Notebook", trusted);
+        }
         return data;
     };
 
     /**
      * Start an autosave timer, for periodically saving the notebook.
      * 
      * @method set_autosave_interval
      * @param {Integer} interval the autosave interval in milliseconds
      */
     Notebook.prototype.set_autosave_interval = function (interval) {
         var that = this;
         // clear previous interval, so we don't get simultaneous timers
         if (this.autosave_timer) {
             clearInterval(this.autosave_timer);
         }
         
         this.autosave_interval = this.minimum_autosave_interval = interval;
         if (interval) {
             this.autosave_timer = setInterval(function() {
                 if (that.dirty) {
                     that.save_notebook();
                 }
             }, interval);
             $([IPython.events]).trigger("autosave_enabled.Notebook", interval);
         } else {
             this.autosave_timer = null;
             $([IPython.events]).trigger("autosave_disabled.Notebook");
         }
     };
     
     /**
      * Save this notebook on the server.
      * 
      * @method save_notebook
      */
     Notebook.prototype.save_notebook = function (extra_settings) {
         // Create a JSON model to be sent to the server.
         var model = {};
         model.name = this.notebook_name;
         model.path = this.notebook_path;
         model.content = this.toJSON();
         model.content.nbformat = this.nbformat;
         model.content.nbformat_minor = this.nbformat_minor;
         // time the ajax call for autosave tuning purposes.
         var start =  new Date().getTime();
         // We do the call with settings so we can set cache to false.
         var settings = {
             processData : false,
             cache : false,
             type : "PUT",
             data : JSON.stringify(model),
             headers : {'Content-Type': 'application/json'},
             success : $.proxy(this.save_notebook_success, this, start),
             error : $.proxy(this.save_notebook_error, this)
         };
         if (extra_settings) {
             for (var key in extra_settings) {
                 settings[key] = extra_settings[key];
             }
         }
         $([IPython.events]).trigger('notebook_saving.Notebook');
         var url = utils.url_join_encode(
             this.base_url,
             'api/notebooks',
             this.notebook_path,
             this.notebook_name
         );
         $.ajax(url, settings);
     };
     
     /**
      * Success callback for saving a notebook.
      * 
      * @method save_notebook_success
      * @param {Integer} start the time when the save request started
      * @param {Object} data JSON representation of a notebook
      * @param {String} status Description of response status
      * @param {jqXHR} xhr jQuery Ajax object
      */
     Notebook.prototype.save_notebook_success = function (start, data, status, xhr) {
         this.set_dirty(false);
         $([IPython.events]).trigger('notebook_saved.Notebook');
         this._update_autosave_interval(start);
         if (this._checkpoint_after_save) {
             this.create_checkpoint();
             this._checkpoint_after_save = false;
         }
     };
     
     /**
      * update the autosave interval based on how long the last save took
      * 
      * @method _update_autosave_interval
      * @param {Integer} timestamp when the save request started
      */
     Notebook.prototype._update_autosave_interval = function (start) {
         var duration = (new Date().getTime() - start);
         if (this.autosave_interval) {
             // new save interval: higher of 10x save duration or parameter (default 30 seconds)
             var interval = Math.max(10 * duration, this.minimum_autosave_interval);
             // round to 10 seconds, otherwise we will be setting a new interval too often
             interval = 10000 * Math.round(interval / 10000);
             // set new interval, if it's changed
             if (interval != this.autosave_interval) {
                 this.set_autosave_interval(interval);
             }
         }
     };
     
     /**
      * Failure callback for saving a notebook.
      * 
      * @method save_notebook_error
      * @param {jqXHR} xhr jQuery Ajax object
      * @param {String} status Description of response status
      * @param {String} error HTTP error message
      */
     Notebook.prototype.save_notebook_error = function (xhr, status, error) {
         $([IPython.events]).trigger('notebook_save_failed.Notebook', [xhr, status, error]);
     };
 
+    /**
+     * Explicitly trust the output of this notebook.
+     *
+     * @method trust_notebook
+     */
+    Notebook.prototype.trust_notebook = function (extra_settings) {
+        var body = $("<div>").append($("<p>")
+            .text("A trusted IPython notebook may execute hidden malicious code ")
+            .append($("<strong>")
+                .append(
+                    $("<em>").text("when you open it")
+                )
+            ).append(".").append(
+                " Selecting trust will immediately reload this notebook in a trusted state."
+            ).append(
+                " For more information, see the "
+            ).append($("<a>").attr("href", "http://ipython.org/security.html")
+                .text("IPython security documentation")
+            ).append(".")
+        );
+
+        var nb = this;
+        IPython.dialog.modal({
+            title: "Trust this notebook?",
+            body: body,
+
+            buttons: {
+                Cancel : {},
+                Trust : {
+                    class : "btn-danger",
+                    click : function () {
+                        var cells = nb.get_cells();
+                        for (var i = 0; i < cells.length; i++) {
+                            var cell = cells[i];
+                            if (cell.cell_type == 'code') {
+                                cell.output_area.trusted = true;
+                            }
+                        }
+                        $([IPython.events]).on('notebook_saved.Notebook', function () {
+                            window.location.reload();
+                        });
+                        nb.save_notebook();
+                    }
+                }
+            }
+        });
+    };
+
     Notebook.prototype.new_notebook = function(){
         var path = this.notebook_path;
         var base_url = this.base_url;
         var settings = {
             processData : false,
             cache : false,
             type : "POST",
             dataType : "json",
             async : false,
             success : function (data, status, xhr){
                 var notebook_name = data.name;
                 window.open(
                     utils.url_join_encode(
                         base_url,
                         'notebooks',
                         path,
                         notebook_name
                     ),
                     '_blank'
                 );
             }
         };
         var url = utils.url_join_encode(
             base_url,
             'api/notebooks',
             path
         );
         $.ajax(url,settings);
     };
 
 
     Notebook.prototype.copy_notebook = function(){
         var path = this.notebook_path;
         var base_url = this.base_url;
         var settings = {
             processData : false,
             cache : false,
             type : "POST",
             dataType : "json",
             data : JSON.stringify({copy_from : this.notebook_name}),
             async : false,
             success : function (data, status, xhr) {
                 window.open(utils.url_join_encode(
                     base_url,
                     'notebooks',
                     data.path,
                     data.name
                 ), '_blank');
             }
         };
         var url = utils.url_join_encode(
             base_url,
             'api/notebooks',
             path
         );
         $.ajax(url,settings);
     };
 
     Notebook.prototype.rename = function (nbname) {
         var that = this;
         if (!nbname.match(/\.ipynb$/)) {
             nbname = nbname + ".ipynb";
         }
         var data = {name: nbname};
         var settings = {
             processData : false,
             cache : false,
             type : "PATCH",
             data : JSON.stringify(data),
             dataType: "json",
             headers : {'Content-Type': 'application/json'},
             success : $.proxy(that.rename_success, this),
             error : $.proxy(that.rename_error, this)
         };
         $([IPython.events]).trigger('rename_notebook.Notebook', data);
         var url = utils.url_join_encode(
             this.base_url,
             'api/notebooks',
             this.notebook_path,
             this.notebook_name
         );
         $.ajax(url, settings);
     };
 
     Notebook.prototype.delete = function () {
         var that = this;
         var settings = {
             processData : false,
             cache : false,
             type : "DELETE",
             dataType: "json",
         };
         var url = utils.url_join_encode(
             this.base_url,
             'api/notebooks',
             this.notebook_path,
             this.notebook_name
         );
         $.ajax(url, settings);
     };
 
     
     Notebook.prototype.rename_success = function (json, status, xhr) {
         var name = this.notebook_name = json.name;
         var path = json.path;
         this.session.rename_notebook(name, path);
         $([IPython.events]).trigger('notebook_renamed.Notebook', json);
     };
 
     Notebook.prototype.rename_error = function (xhr, status, error) {
         var that = this;
         var dialog = $('<div/>').append(
             $("<p/>").addClass("rename-message")
             .text('This notebook name already exists.')
         );
         $([IPython.events]).trigger('notebook_rename_failed.Notebook', [xhr, status, error]);
         IPython.dialog.modal({
             title: "Notebook Rename Error!",
             body: dialog,
             buttons : {
                 "Cancel": {},
                 "OK": {
                     class: "btn-primary",
                     click: function () {
                         IPython.save_widget.rename_notebook();
                 }}
                 },
             open : function (event, ui) {
                 var that = $(this);
                 // Upon ENTER, click the OK button.
                 that.find('input[type="text"]').keydown(function (event, ui) {
                     if (event.which === IPython.keyboard.keycodes.enter) {
                         that.find('.btn-primary').first().click();
                     }
                 });
                 that.find('input[type="text"]').focus();
             }
         });
     };
 
     /**
      * Request a notebook's data from the server.
      * 
      * @method load_notebook
      * @param {String} notebook_name and path A notebook to load
      */
     Notebook.prototype.load_notebook = function (notebook_name, notebook_path) {
         var that = this;
         this.notebook_name = notebook_name;
         this.notebook_path = notebook_path;
         // We do the call with settings so we can set cache to false.
         var settings = {
             processData : false,
             cache : false,
             type : "GET",
             dataType : "json",
             success : $.proxy(this.load_notebook_success,this),
             error : $.proxy(this.load_notebook_error,this),
         };
         $([IPython.events]).trigger('notebook_loading.Notebook');
         var url = utils.url_join_encode(
             this.base_url,
             'api/notebooks',
             this.notebook_path,
             this.notebook_name
         );
         $.ajax(url, settings);
     };
 
     /**
      * Success callback for loading a notebook from the server.
      * 
      * Load notebook data from the JSON response.
      * 
      * @method load_notebook_success
      * @param {Object} data JSON representation of a notebook
      * @param {String} status Description of response status
      * @param {jqXHR} xhr jQuery Ajax object
      */
     Notebook.prototype.load_notebook_success = function (data, status, xhr) {
         this.fromJSON(data);
         if (this.ncells() === 0) {
             this.insert_cell_below('code');
             this.edit_mode(0);
         } else {
             this.select(0);
             this.command_mode();
         }
         this.set_dirty(false);
         this.scroll_to_top();
         if (data.orig_nbformat !== undefined && data.nbformat !== data.orig_nbformat) {
             var msg = "This notebook has been converted from an older " +
             "notebook format (v"+data.orig_nbformat+") to the current notebook " +
             "format (v"+data.nbformat+"). The next time you save this notebook, the " +
             "newer notebook format will be used and older versions of IPython " +
             "may not be able to read it. To keep the older version, close the " +
             "notebook without saving it.";
             IPython.dialog.modal({
                 title : "Notebook converted",
                 body : msg,
                 buttons : {
                     OK : {
                         class : "btn-primary"
                     }
                 }
             });
         } else if (data.orig_nbformat_minor !== undefined && data.nbformat_minor !== data.orig_nbformat_minor) {
             var that = this;
             var orig_vs = 'v' + data.nbformat + '.' + data.orig_nbformat_minor;
             var this_vs = 'v' + data.nbformat + '.' + this.nbformat_minor;
             var msg = "This notebook is version " + orig_vs + ", but we only fully support up to " +
             this_vs + ".  You can still work with this notebook, but some features " +
             "introduced in later notebook versions may not be available.";
 
             IPython.dialog.modal({
                 title : "Newer Notebook",
                 body : msg,
                 buttons : {
                     OK : {
                         class : "btn-danger"
                     }
                 }
             });
 
         }
         
         // Create the session after the notebook is completely loaded to prevent
         // code execution upon loading, which is a security risk.
         if (this.session === null) {
             this.start_session();
         }
         // load our checkpoint list
         this.list_checkpoints();
         
         // load toolbar state
         if (this.metadata.celltoolbar) {
             IPython.CellToolbar.global_show();
             IPython.CellToolbar.activate_preset(this.metadata.celltoolbar);
         }
         
         $([IPython.events]).trigger('notebook_loaded.Notebook');
     };
 
     /**
      * Failure callback for loading a notebook from the server.
      * 
      * @method load_notebook_error
      * @param {jqXHR} xhr jQuery Ajax object
      * @param {String} status Description of response status
      * @param {String} error HTTP error message
      */
     Notebook.prototype.load_notebook_error = function (xhr, status, error) {
         $([IPython.events]).trigger('notebook_load_failed.Notebook', [xhr, status, error]);
         var msg;
         if (xhr.status === 400) {
             msg = error;
         } else if (xhr.status === 500) {
             msg = "An unknown error occurred while loading this notebook. " +
             "This version can load notebook formats " +
             "v" + this.nbformat + " or earlier.";
         }
         IPython.dialog.modal({
             title: "Error loading notebook",
             body : msg,
             buttons : {
                 "OK": {}
             }
         });
     };
 
     /*********************  checkpoint-related  *********************/
     
     /**
      * Save the notebook then immediately create a checkpoint.
      * 
      * @method save_checkpoint
      */
     Notebook.prototype.save_checkpoint = function () {
         this._checkpoint_after_save = true;
         this.save_notebook();
     };
     
     /**
      * Add a checkpoint for this notebook.
      * for use as a callback from checkpoint creation.
      * 
      * @method add_checkpoint
      */
     Notebook.prototype.add_checkpoint = function (checkpoint) {
         var found = false;
         for (var i = 0; i < this.checkpoints.length; i++) {
             var existing = this.checkpoints[i];
             if (existing.id == checkpoint.id) {
                 found = true;
                 this.checkpoints[i] = checkpoint;
                 break;
             }
         }
         if (!found) {
             this.checkpoints.push(checkpoint);
         }
         this.last_checkpoint = this.checkpoints[this.checkpoints.length - 1];
     };
     
     /**
      * List checkpoints for this notebook.
      * 
      * @method list_checkpoints
      */
     Notebook.prototype.list_checkpoints = function () {
         var url = utils.url_join_encode(
             this.base_url,
             'api/notebooks',
             this.notebook_path,
             this.notebook_name,
             'checkpoints'
         );
         $.get(url).done(
             $.proxy(this.list_checkpoints_success, this)
         ).fail(
             $.proxy(this.list_checkpoints_error, this)
         );
     };
 
     /**
      * Success callback for listing checkpoints.
      * 
      * @method list_checkpoint_success
      * @param {Object} data JSON representation of a checkpoint
      * @param {String} status Description of response status
      * @param {jqXHR} xhr jQuery Ajax object
      */
     Notebook.prototype.list_checkpoints_success = function (data, status, xhr) {
         data = $.parseJSON(data);
         this.checkpoints = data;
         if (data.length) {
             this.last_checkpoint = data[data.length - 1];
         } else {
             this.last_checkpoint = null;
         }
         $([IPython.events]).trigger('checkpoints_listed.Notebook', [data]);
     };
 
     /**
      * Failure callback for listing a checkpoint.
      * 
      * @method list_checkpoint_error
      * @param {jqXHR} xhr jQuery Ajax object
      * @param {String} status Description of response status
      * @param {String} error_msg HTTP error message
      */
     Notebook.prototype.list_checkpoints_error = function (xhr, status, error_msg) {
         $([IPython.events]).trigger('list_checkpoints_failed.Notebook');
     };
     
     /**
      * Create a checkpoint of this notebook on the server from the most recent save.
      * 
      * @method create_checkpoint
      */
     Notebook.prototype.create_checkpoint = function () {
         var url = utils.url_join_encode(
             this.base_url,
             'api/notebooks',
             this.notebook_path,
             this.notebook_name,
             'checkpoints'
         );
         $.post(url).done(
             $.proxy(this.create_checkpoint_success, this)
         ).fail(
             $.proxy(this.create_checkpoint_error, this)
         );
     };
 
     /**
      * Success callback for creating a checkpoint.
      * 
      * @method create_checkpoint_success
      * @param {Object} data JSON representation of a checkpoint
      * @param {String} status Description of response status
      * @param {jqXHR} xhr jQuery Ajax object
      */
     Notebook.prototype.create_checkpoint_success = function (data, status, xhr) {
         data = $.parseJSON(data);
         this.add_checkpoint(data);
         $([IPython.events]).trigger('checkpoint_created.Notebook', data);
     };
 
     /**
      * Failure callback for creating a checkpoint.
      * 
      * @method create_checkpoint_error
      * @param {jqXHR} xhr jQuery Ajax object
      * @param {String} status Description of response status
      * @param {String} error_msg HTTP error message
      */
     Notebook.prototype.create_checkpoint_error = function (xhr, status, error_msg) {
         $([IPython.events]).trigger('checkpoint_failed.Notebook');
     };
     
     Notebook.prototype.restore_checkpoint_dialog = function (checkpoint) {
         var that = this;
         checkpoint = checkpoint || this.last_checkpoint;
         if ( ! checkpoint ) {
             console.log("restore dialog, but no checkpoint to restore to!");
             return;
         }
         var body = $('<div/>').append(
             $('<p/>').addClass("p-space").text(
                 "Are you sure you want to revert the notebook to " +
                 "the latest checkpoint?"
             ).append(
                 $("<strong/>").text(
                     " This cannot be undone."
                 )
             )
         ).append(
             $('<p/>').addClass("p-space").text("The checkpoint was last updated at:")
         ).append(
             $('<p/>').addClass("p-space").text(
                 Date(checkpoint.last_modified)
             ).css("text-align", "center")
         );
         
         IPython.dialog.modal({
             title : "Revert notebook to checkpoint",
             body : body,
             buttons : {
                 Revert : {
                     class : "btn-danger",
                     click : function () {
                         that.restore_checkpoint(checkpoint.id);
                     }
                 },
                 Cancel : {}
                 }
         });
     };
     
     /**
      * Restore the notebook to a checkpoint state.
      * 
      * @method restore_checkpoint
      * @param {String} checkpoint ID
      */
     Notebook.prototype.restore_checkpoint = function (checkpoint) {
         $([IPython.events]).trigger('notebook_restoring.Notebook', checkpoint);
         var url = utils.url_join_encode(
             this.base_url,
             'api/notebooks',
             this.notebook_path,
             this.notebook_name,
             'checkpoints',
             checkpoint
         );
         $.post(url).done(
             $.proxy(this.restore_checkpoint_success, this)
         ).fail(
             $.proxy(this.restore_checkpoint_error, this)
         );
     };
     
     /**
      * Success callback for restoring a notebook to a checkpoint.
      * 
      * @method restore_checkpoint_success
      * @param {Object} data (ignored, should be empty)
      * @param {String} status Description of response status
      * @param {jqXHR} xhr jQuery Ajax object
      */
     Notebook.prototype.restore_checkpoint_success = function (data, status, xhr) {
         $([IPython.events]).trigger('checkpoint_restored.Notebook');
         this.load_notebook(this.notebook_name, this.notebook_path);
     };
 
     /**
      * Failure callback for restoring a notebook to a checkpoint.
      * 
      * @method restore_checkpoint_error
      * @param {jqXHR} xhr jQuery Ajax object
      * @param {String} status Description of response status
      * @param {String} error_msg HTTP error message
      */
     Notebook.prototype.restore_checkpoint_error = function (xhr, status, error_msg) {
         $([IPython.events]).trigger('checkpoint_restore_failed.Notebook');
     };
     
     /**
      * Delete a notebook checkpoint.
      * 
      * @method delete_checkpoint
      * @param {String} checkpoint ID
      */
     Notebook.prototype.delete_checkpoint = function (checkpoint) {
         $([IPython.events]).trigger('notebook_restoring.Notebook', checkpoint);
         var url = utils.url_join_encode(
             this.base_url,
             'api/notebooks',
             this.notebook_path,
             this.notebook_name,
             'checkpoints',
             checkpoint
         );
         $.ajax(url, {
             type: 'DELETE',
             success: $.proxy(this.delete_checkpoint_success, this),
             error: $.proxy(this.delete_notebook_error,this)
         });
     };
     
     /**
      * Success callback for deleting a notebook checkpoint
      * 
      * @method delete_checkpoint_success
      * @param {Object} data (ignored, should be empty)
      * @param {String} status Description of response status
      * @param {jqXHR} xhr jQuery Ajax object
      */
     Notebook.prototype.delete_checkpoint_success = function (data, status, xhr) {
         $([IPython.events]).trigger('checkpoint_deleted.Notebook', data);
         this.load_notebook(this.notebook_name, this.notebook_path);
     };
 
     /**
      * Failure callback for deleting a notebook checkpoint.
      * 
      * @method delete_checkpoint_error
      * @param {jqXHR} xhr jQuery Ajax object
      * @param {String} status Description of response status
      * @param {String} error_msg HTTP error message
      */
     Notebook.prototype.delete_checkpoint_error = function (xhr, status, error_msg) {
         $([IPython.events]).trigger('checkpoint_delete_failed.Notebook');
     };
 
 
     IPython.Notebook = Notebook;
 
 
     return IPython;
 
 }(IPython));
 

IPython/html/static/notebook/js/outputarea.js

@@ -1,865 +1,868 b''
 //----------------------------------------------------------------------------
 //  Copyright (C) 2008 The IPython Development Team
 //
 //  Distributed under the terms of the BSD License.  The full license is in
 //  the file COPYING, distributed as part of this software.
 //----------------------------------------------------------------------------
 
 //============================================================================
 // OutputArea
 //============================================================================
 
 /**
  * @module IPython
  * @namespace IPython
  * @submodule OutputArea
  */
 var IPython = (function (IPython) {
     "use strict";
 
     var utils = IPython.utils;
 
     /**
      * @class OutputArea
      *
      * @constructor
      */
 
     var OutputArea = function (selector, prompt_area) {
         this.selector = selector;
         this.wrapper = $(selector);
         this.outputs = [];
         this.collapsed = false;
         this.scrolled = false;
         this.trusted = true;
         this.clear_queued = null;
         if (prompt_area === undefined) {
             this.prompt_area = true;
         } else {
             this.prompt_area = prompt_area;
         }
         this.create_elements();
         this.style();
         this.bind_events();
     };
 
 
     /**
      * Class prototypes
      **/
 
     OutputArea.prototype.create_elements = function () {
         this.element = $("<div/>");
         this.collapse_button = $("<div/>");
         this.prompt_overlay = $("<div/>");
         this.wrapper.append(this.prompt_overlay);
         this.wrapper.append(this.element);
         this.wrapper.append(this.collapse_button);
     };
 
 
     OutputArea.prototype.style = function () {
         this.collapse_button.hide();
         this.prompt_overlay.hide();
         
         this.wrapper.addClass('output_wrapper');
         this.element.addClass('output');
         
         this.collapse_button.addClass("btn output_collapsed");
         this.collapse_button.attr('title', 'click to expand output');
         this.collapse_button.text('. . .');
         
         this.prompt_overlay.addClass('out_prompt_overlay prompt');
         this.prompt_overlay.attr('title', 'click to expand output; double click to hide output');
         
         this.collapse();
     };
 
     /**
      * Should the OutputArea scroll?
      * Returns whether the height (in lines) exceeds a threshold.
      *
      * @private
      * @method _should_scroll
      * @param [lines=100]{Integer}
      * @return {Bool}
      *
      */
     OutputArea.prototype._should_scroll = function (lines) {
         if (lines <=0 ){ return }
         if (!lines) {
             lines = 100;
         }
         // line-height from http://stackoverflow.com/questions/1185151
         var fontSize = this.element.css('font-size');
         var lineHeight = Math.floor(parseInt(fontSize.replace('px','')) * 1.5);
         
         return (this.element.height() > lines * lineHeight);
     };
 
 
     OutputArea.prototype.bind_events = function () {
         var that = this;
         this.prompt_overlay.dblclick(function () { that.toggle_output(); });
         this.prompt_overlay.click(function () { that.toggle_scroll(); });
 
         this.element.resize(function () {
             // FIXME: Firefox on Linux misbehaves, so automatic scrolling is disabled
             if ( IPython.utils.browser[0] === "Firefox" ) {
                 return;
             }
             // maybe scroll output,
             // if it's grown large enough and hasn't already been scrolled.
             if ( !that.scrolled && that._should_scroll(OutputArea.auto_scroll_threshold)) {
                 that.scroll_area();
             }
         });
         this.collapse_button.click(function () {
             that.expand();
         });
     };
 
 
     OutputArea.prototype.collapse = function () {
         if (!this.collapsed) {
             this.element.hide();
             this.prompt_overlay.hide();
             if (this.element.html()){
                 this.collapse_button.show();
             }
             this.collapsed = true;
         }
     };
 
 
     OutputArea.prototype.expand = function () {
         if (this.collapsed) {
             this.collapse_button.hide();
             this.element.show();
             this.prompt_overlay.show();
             this.collapsed = false;
         }
     };
 
 
     OutputArea.prototype.toggle_output = function () {
         if (this.collapsed) {
             this.expand();
         } else {
             this.collapse();
         }
     };
 
 
     OutputArea.prototype.scroll_area = function () {
         this.element.addClass('output_scroll');
         this.prompt_overlay.attr('title', 'click to unscroll output; double click to hide');
         this.scrolled = true;
     };
 
 
     OutputArea.prototype.unscroll_area = function () {
         this.element.removeClass('output_scroll');
         this.prompt_overlay.attr('title', 'click to scroll output; double click to hide');
         this.scrolled = false;
     };
 
     /**
      *
      * Scroll OutputArea if height supperior than a threshold (in lines).
      *
      * Threshold is a maximum number of lines. If unspecified, defaults to
      * OutputArea.minimum_scroll_threshold.
      *
      * Negative threshold will prevent the OutputArea from ever scrolling.
      *
      * @method scroll_if_long
      *
      * @param [lines=20]{Number} Default to 20 if not set,
      * behavior undefined for value of `0`.
      *
      **/
     OutputArea.prototype.scroll_if_long = function (lines) {
         var n = lines | OutputArea.minimum_scroll_threshold;
         if(n <= 0){
             return
         }
 
         if (this._should_scroll(n)) {
             // only allow scrolling long-enough output
             this.scroll_area();
         }
     };
 
 
     OutputArea.prototype.toggle_scroll = function () {
         if (this.scrolled) {
             this.unscroll_area();
         } else {
             // only allow scrolling long-enough output
             this.scroll_if_long();
         }
     };
 
 
     // typeset with MathJax if MathJax is available
     OutputArea.prototype.typeset = function () {
         if (window.MathJax){
             MathJax.Hub.Queue(["Typeset",MathJax.Hub]);
         }
     };
 
 
     OutputArea.prototype.handle_output = function (msg) {
         var json = {};
         var msg_type = json.output_type = msg.header.msg_type;
         var content = msg.content;
         if (msg_type === "stream") {
             json.text = content.data;
             json.stream = content.name;
         } else if (msg_type === "display_data") {
             json = content.data;
             json.output_type = msg_type;
             json.metadata = content.metadata;
         } else if (msg_type === "pyout") {
             json = content.data;
             json.output_type = msg_type;
             json.metadata = content.metadata;
             json.prompt_number = content.execution_count;
         } else if (msg_type === "pyerr") {
             json.ename = content.ename;
             json.evalue = content.evalue;
             json.traceback = content.traceback;
         }
         this.append_output(json);
     };
     
     
     OutputArea.prototype.rename_keys = function (data, key_map) {
         var remapped = {};
         for (var key in data) {
             var new_key = key_map[key] || key;
             remapped[new_key] = data[key];
         }
         return remapped;
     };
 
 
     OutputArea.output_types = [
         'application/javascript',
         'text/html',
         'text/latex',
         'image/svg+xml',
         'image/png',
         'image/jpeg',
         'application/pdf',
         'text/plain'
     ];
 
     OutputArea.prototype.validate_output = function (json) {
         // scrub invalid outputs
         // TODO: right now everything is a string, but JSON really shouldn't be.
         // nbformat 4 will fix that.
         $.map(OutputArea.output_types, function(key){
             if (json[key] !== undefined && typeof json[key] !== 'string') {
                 console.log("Invalid type for " + key, json[key]);
                 delete json[key];
             }
         });
         return json;
     };
     
     OutputArea.prototype.append_output = function (json) {
         this.expand();
         // Clear the output if clear is queued.
         var needs_height_reset = false;
         if (this.clear_queued) {
             this.clear_output(false);
             needs_height_reset = true;
         }
         
         // validate output data types
         json = this.validate_output(json);
 
         if (json.output_type === 'pyout') {
             this.append_pyout(json);
         } else if (json.output_type === 'pyerr') {
             this.append_pyerr(json);
         } else if (json.output_type === 'display_data') {
             this.append_display_data(json);
         } else if (json.output_type === 'stream') {
             this.append_stream(json);
         }
         
         this.outputs.push(json);
         
         // Only reset the height to automatic if the height is currently
         // fixed (done by wait=True flag on clear_output).
         if (needs_height_reset) {
             this.element.height('');    
         }
 
         var that = this;
         setTimeout(function(){that.element.trigger('resize');}, 100);
     };
 
 
     OutputArea.prototype.create_output_area = function () {
         var oa = $("<div/>").addClass("output_area");
         if (this.prompt_area) {
             oa.append($('<div/>').addClass('prompt'));
         }
         return oa;
     };
 
 
     function _get_metadata_key(metadata, key, mime) {
         var mime_md = metadata[mime];
         // mime-specific higher priority
         if (mime_md && mime_md[key] !== undefined) {
             return mime_md[key];
         }
         // fallback on global
         return metadata[key];
     }
 
     OutputArea.prototype.create_output_subarea = function(md, classes, mime) {
         var subarea = $('<div/>').addClass('output_subarea').addClass(classes);
         if (_get_metadata_key(md, 'isolated', mime)) {
             // Create an iframe to isolate the subarea from the rest of the
             // document
             var iframe = $('<iframe/>').addClass('box-flex1');
             iframe.css({'height':1, 'width':'100%', 'display':'block'});
             iframe.attr('frameborder', 0);
             iframe.attr('scrolling', 'auto');
 
             // Once the iframe is loaded, the subarea is dynamically inserted
             iframe.on('load', function() {
                 // Workaround needed by Firefox, to properly render svg inside
                 // iframes, see http://stackoverflow.com/questions/10177190/
                 // svg-dynamically-added-to-iframe-does-not-render-correctly
                 this.contentDocument.open();
 
                 // Insert the subarea into the iframe
                 // We must directly write the html. When using Jquery's append
                 // method, javascript is evaluated in the parent document and
                 // not in the iframe document.  At this point, subarea doesn't
                 // contain any user content.
                 this.contentDocument.write(subarea.html());
 
                 this.contentDocument.close();
 
                 var body = this.contentDocument.body;
                 // Adjust the iframe height automatically
                 iframe.height(body.scrollHeight + 'px');
             });
 
             // Elements should be appended to the inner subarea and not to the
             // iframe
             iframe.append = function(that) {
                 subarea.append(that);
             };
 
             return iframe;
         } else {
             return subarea;
         }
     }
 
 
     OutputArea.prototype._append_javascript_error = function (err, element) {
         // display a message when a javascript error occurs in display output
         var msg = "Javascript error adding output!"
         if ( element === undefined ) return;
         element
             .append($('<div/>').text(msg).addClass('js-error'))
             .append($('<div/>').text(err.toString()).addClass('js-error'))
             .append($('<div/>').text('See your browser Javascript console for more details.').addClass('js-error'));
     };
     
     OutputArea.prototype._safe_append = function (toinsert) {
         // safely append an item to the document
         // this is an object created by user code,
         // and may have errors, which should not be raised
         // under any circumstances.
         try {
             this.element.append(toinsert);
         } catch(err) {
             console.log(err);
             // Create an actual output_area and output_subarea, which creates
             // the prompt area and the proper indentation.
             var toinsert = this.create_output_area();
             var subarea = $('<div/>').addClass('output_subarea');
             toinsert.append(subarea);
             this._append_javascript_error(err, subarea);
             this.element.append(toinsert);
         }
     };
 
 
     OutputArea.prototype.append_pyout = function (json) {
         var n = json.prompt_number || ' ';
         var toinsert = this.create_output_area();
         if (this.prompt_area) {
             toinsert.find('div.prompt').addClass('output_prompt').text('Out[' + n + ']:');
         }
         this.append_mime_type(json, toinsert);
         this._safe_append(toinsert);
         // If we just output latex, typeset it.
         if ((json['text/latex'] !== undefined) || (json['text/html'] !== undefined)) {
             this.typeset();
         }
     };
 
 
     OutputArea.prototype.append_pyerr = function (json) {
         var tb = json.traceback;
         if (tb !== undefined && tb.length > 0) {
             var s = '';
             var len = tb.length;
             for (var i=0; i<len; i++) {
                 s = s + tb[i] + '\n';
             }
             s = s + '\n';
             var toinsert = this.create_output_area();
             this.append_text(s, {}, toinsert);
             this._safe_append(toinsert);
         }
     };
 
 
     OutputArea.prototype.append_stream = function (json) {
         // temporary fix: if stream undefined (json file written prior to this patch),
         // default to most likely stdout:
         if (json.stream == undefined){
             json.stream = 'stdout';
         }
         var text = json.text;
         var subclass = "output_"+json.stream;
         if (this.outputs.length > 0){
             // have at least one output to consider
             var last = this.outputs[this.outputs.length-1];
             if (last.output_type == 'stream' && json.stream == last.stream){
                 // latest output was in the same stream,
                 // so append directly into its pre tag
                 // escape ANSI & HTML specials:
                 var pre = this.element.find('div.'+subclass).last().find('pre');
                 var html = utils.fixCarriageReturn(
                     pre.html() + utils.fixConsole(text));
                 // The only user content injected with this HTML call is
                 // escaped by the fixConsole() method.
                 pre.html(html);
                 return;
             }
         }
 
         if (!text.replace("\r", "")) {
             // text is nothing (empty string, \r, etc.)
             // so don't append any elements, which might add undesirable space
             return;
         }
 
         // If we got here, attach a new div
         var toinsert = this.create_output_area();
         this.append_text(text, {}, toinsert, "output_stream "+subclass);
         this._safe_append(toinsert);
     };
 
 
     OutputArea.prototype.append_display_data = function (json) {
         var toinsert = this.create_output_area();
         if (this.append_mime_type(json, toinsert)) {
             this._safe_append(toinsert);
             // If we just output latex, typeset it.
             if ((json['text/latex'] !== undefined) || (json['text/html'] !== undefined)) {
                 this.typeset();
             }
         }
     };
 
 
     OutputArea.safe_outputs = {
         'text/plain' : true,
+        'text/latex' : true,
         'image/png' : true,
         'image/jpeg' : true
     };
     
     OutputArea.prototype.append_mime_type = function (json, element) {
         for (var type_i in OutputArea.display_order) {
             var type = OutputArea.display_order[type_i];
             var append = OutputArea.append_map[type];
             if ((json[type] !== undefined) && append) {
+                var value = json[type];
                 if (!this.trusted && !OutputArea.safe_outputs[type]) {
-                    // not trusted show warning and do not display
-                    var content = {
-                        text : "Untrusted " + type + " output ignored.",
-                        stream : "stderr"
+                    // not trusted, sanitize HTML
+                    if (type==='text/html' || type==='text/svg') {
+                        value = IPython.security.sanitize_html(value);
+                    } else {
+                        // don't display if we don't know how to sanitize it
+                        console.log("Ignoring untrusted " + type + " output.");
+                        continue;
                     }
-                    this.append_stream(content);
-                    continue;
                 }
                 var md = json.metadata || {};
-                var toinsert = append.apply(this, [json[type], md, element]);
-                $([IPython.events]).trigger('output_appended.OutputArea', [type, json[type], md, toinsert]);
+                var toinsert = append.apply(this, [value, md, element]);
+                $([IPython.events]).trigger('output_appended.OutputArea', [type, value, md, toinsert]);
                 return true;
             }
         }
         return false;
     };
 
 
     OutputArea.prototype.append_html = function (html, md, element) {
         var type = 'text/html';
         var toinsert = this.create_output_subarea(md, "output_html rendered_html", type);
         IPython.keyboard_manager.register_events(toinsert);
         toinsert.append(html);
         element.append(toinsert);
         return toinsert;
     };
 
 
     OutputArea.prototype.append_javascript = function (js, md, element) {
         // We just eval the JS code, element appears in the local scope.
         var type = 'application/javascript';
         var toinsert = this.create_output_subarea(md, "output_javascript", type);
         IPython.keyboard_manager.register_events(toinsert);
         element.append(toinsert);
         // FIXME TODO : remove `container element for 3.0` 
         //backward compat, js should be eval'ed in a context where `container` is defined.
         var container = element;
         container.show = function(){console.log('Warning "container.show()" is deprecated.')};
         // end backward compat
         try {
             eval(js);
         } catch(err) {
             console.log(err);
             this._append_javascript_error(err, toinsert);
         }
         return toinsert;
     };
 
 
     OutputArea.prototype.append_text = function (data, md, element, extra_class) {
         var type = 'text/plain';
         var toinsert = this.create_output_subarea(md, "output_text", type);
         // escape ANSI & HTML specials in plaintext:
         data = utils.fixConsole(data);
         data = utils.fixCarriageReturn(data);
         data = utils.autoLinkUrls(data);
         if (extra_class){
             toinsert.addClass(extra_class);
         }
         // The only user content injected with this HTML call is
         // escaped by the fixConsole() method.
         toinsert.append($("<pre/>").html(data));
         element.append(toinsert);
         return toinsert;
     };
 
 
     OutputArea.prototype.append_svg = function (svg, md, element) {
         var type = 'image/svg+xml';
         var toinsert = this.create_output_subarea(md, "output_svg", type);
         toinsert.append(svg);
         element.append(toinsert);
         return toinsert;
     };
 
 
     OutputArea.prototype._dblclick_to_reset_size = function (img) {
         // wrap image after it's loaded on the page,
         // otherwise the measured initial size will be incorrect
         img.on("load", function (){
             var h0 = img.height();
             var w0 = img.width();
             if (!(h0 && w0)) {
                 // zero size, don't make it resizable
                 return;
             }
             img.resizable({
                 aspectRatio: true,
                 autoHide: true
             });
             img.dblclick(function () {
                 // resize wrapper & image together for some reason:
                 img.parent().height(h0);
                 img.height(h0);
                 img.parent().width(w0);
                 img.width(w0);
             });
         });
     };
     
     var set_width_height = function (img, md, mime) {
         // set width and height of an img element from metadata
         var height = _get_metadata_key(md, 'height', mime);
         if (height !== undefined) img.attr('height', height);
         var width = _get_metadata_key(md, 'width', mime);
         if (width !== undefined) img.attr('width', width);
     };
     
     OutputArea.prototype.append_png = function (png, md, element) {
         var type = 'image/png';
         var toinsert = this.create_output_subarea(md, "output_png", type);
         var img = $("<img/>").attr('src','data:image/png;base64,'+png);
         set_width_height(img, md, 'image/png');
         this._dblclick_to_reset_size(img);
         toinsert.append(img);
         element.append(toinsert);
         return toinsert;
     };
 
 
     OutputArea.prototype.append_jpeg = function (jpeg, md, element) {
         var type = 'image/jpeg';
         var toinsert = this.create_output_subarea(md, "output_jpeg", type);
         var img = $("<img/>").attr('src','data:image/jpeg;base64,'+jpeg);
         set_width_height(img, md, 'image/jpeg');
         this._dblclick_to_reset_size(img);
         toinsert.append(img);
         element.append(toinsert);
         return toinsert;
     };
 
 
     OutputArea.prototype.append_pdf = function (pdf, md, element) {
         var type = 'application/pdf';
         var toinsert = this.create_output_subarea(md, "output_pdf", type);
         var a = $('<a/>').attr('href', 'data:application/pdf;base64,'+pdf);
         a.attr('target', '_blank');
         a.text('View PDF')
         toinsert.append(a);
         element.append(toinsert);
         return toinsert;
      }
 
     OutputArea.prototype.append_latex = function (latex, md, element) {
         // This method cannot do the typesetting because the latex first has to
         // be on the page.
         var type = 'text/latex';
         var toinsert = this.create_output_subarea(md, "output_latex", type);
         toinsert.append(latex);
         element.append(toinsert);
         return toinsert;
     };
 
 
     OutputArea.prototype.append_raw_input = function (msg) {
         var that = this;
         this.expand();
         var content = msg.content;
         var area = this.create_output_area();
         
         // disable any other raw_inputs, if they are left around
         $("div.output_subarea.raw_input").remove();
         
         area.append(
             $("<div/>")
             .addClass("box-flex1 output_subarea raw_input")
             .append(
                 $("<span/>")
                 .addClass("input_prompt")
                 .text(content.prompt)
             )
             .append(
                 $("<input/>")
                 .addClass("raw_input")
                 .attr('type', 'text')
                 .attr("size", 47)
                 .keydown(function (event, ui) {
                     // make sure we submit on enter,
                     // and don't re-execute the *cell* on shift-enter
                     if (event.which === IPython.keyboard.keycodes.enter) {
                         that._submit_raw_input();
                         return false;
                     }
                 })
             )
         );
         
         this.element.append(area);
         var raw_input = area.find('input.raw_input');
         // Register events that enable/disable the keyboard manager while raw
         // input is focused.
         IPython.keyboard_manager.register_events(raw_input);
         // Note, the following line used to read raw_input.focus().focus().
         // This seemed to be needed otherwise only the cell would be focused.
         // But with the modal UI, this seems to work fine with one call to focus().
         raw_input.focus();
     }
 
     OutputArea.prototype._submit_raw_input = function (evt) {
         var container = this.element.find("div.raw_input");
         var theprompt = container.find("span.input_prompt");
         var theinput = container.find("input.raw_input");
         var value = theinput.val();
         var content = {
             output_type : 'stream',
             name : 'stdout',
             text : theprompt.text() + value + '\n'
         }
         // remove form container
         container.parent().remove();
         // replace with plaintext version in stdout
         this.append_output(content, false);
         $([IPython.events]).trigger('send_input_reply.Kernel', value);
     }
 
 
     OutputArea.prototype.handle_clear_output = function (msg) {
         // msg spec v4 had stdout, stderr, display keys
         // v4.1 replaced these with just wait
         // The default behavior is the same (stdout=stderr=display=True, wait=False),
         // so v4 messages will still be properly handled,
         // except for the rarely used clearing less than all output.
         this.clear_output(msg.content.wait || false);
     };
 
 
     OutputArea.prototype.clear_output = function(wait) {
         if (wait) {
 
             // If a clear is queued, clear before adding another to the queue.
             if (this.clear_queued) {
                 this.clear_output(false);
             };
 
             this.clear_queued = true;
         } else {
 
             // Fix the output div's height if the clear_output is waiting for
             // new output (it is being used in an animation).
             if (this.clear_queued) {
                 var height = this.element.height();
                 this.element.height(height);
                 this.clear_queued = false;
             }
             
             // clear all, no need for logic
             this.element.html("");
             this.outputs = [];
             this.trusted = true;
             this.unscroll_area();
             return;
         };
     };
 
 
     // JSON serialization
 
     OutputArea.prototype.fromJSON = function (outputs) {
         var len = outputs.length;
         var data;
 
         for (var i=0; i<len; i++) {
             data = outputs[i];
             var msg_type = data.output_type;
             if (msg_type === "display_data" || msg_type === "pyout") {
                 // convert short keys to mime keys
                 // TODO: remove mapping of short keys when we update to nbformat 4
                  data = this.rename_keys(data, OutputArea.mime_map_r);
                  data.metadata = this.rename_keys(data.metadata, OutputArea.mime_map_r);
             }
             
             this.append_output(data);
         }
     };
 
 
     OutputArea.prototype.toJSON = function () {
         var outputs = [];
         var len = this.outputs.length;
         var data;
         for (var i=0; i<len; i++) {
             data = this.outputs[i];
             var msg_type = data.output_type;
             if (msg_type === "display_data" || msg_type === "pyout") {
                   // convert mime keys to short keys
                  data = this.rename_keys(data, OutputArea.mime_map);
                  data.metadata = this.rename_keys(data.metadata, OutputArea.mime_map);
             }
             outputs[i] = data;
         }
         return outputs;
     };
 
     /**
      * Class properties
      **/
 
     /**
      * Threshold to trigger autoscroll when the OutputArea is resized,
      * typically when new outputs are added.
      *
      * Behavior is undefined if autoscroll is lower than minimum_scroll_threshold,
      * unless it is < 0, in which case autoscroll will never be triggered
      *
      * @property auto_scroll_threshold
      * @type Number
      * @default 100
      *
      **/
     OutputArea.auto_scroll_threshold = 100;
 
     /**
      * Lower limit (in lines) for OutputArea to be made scrollable. OutputAreas
      * shorter than this are never scrolled.
      *
      * @property minimum_scroll_threshold
      * @type Number
      * @default 20
      *
      **/
     OutputArea.minimum_scroll_threshold = 20;
 
 
 
     OutputArea.mime_map = {
         "text/plain" : "text",
         "text/html" : "html",
         "image/svg+xml" : "svg",
         "image/png" : "png",
         "image/jpeg" : "jpeg",
         "text/latex" : "latex",
         "application/json" : "json",
         "application/javascript" : "javascript",
     };
 
     OutputArea.mime_map_r = {
         "text" : "text/plain",
         "html" : "text/html",
         "svg" : "image/svg+xml",
         "png" : "image/png",
         "jpeg" : "image/jpeg",
         "latex" : "text/latex",
         "json" : "application/json",
         "javascript" : "application/javascript",
     };
 
     OutputArea.display_order = [
         'application/javascript',
         'text/html',
         'text/latex',
         'image/svg+xml',
         'image/png',
         'image/jpeg',
         'application/pdf',
         'text/plain'
     ];
 
     OutputArea.append_map = {
         "text/plain" : OutputArea.prototype.append_text,
         "text/html" : OutputArea.prototype.append_html,
         "image/svg+xml" : OutputArea.prototype.append_svg,
         "image/png" : OutputArea.prototype.append_png,
         "image/jpeg" : OutputArea.prototype.append_jpeg,
         "text/latex" : OutputArea.prototype.append_latex,
         "application/javascript" : OutputArea.prototype.append_javascript,
         "application/pdf" : OutputArea.prototype.append_pdf
     };
 
     IPython.OutputArea = OutputArea;
 
     return IPython;
 
 }(IPython));

IPython/html/static/notebook/js/textcell.js

@@ -1,561 +1,550 b''
 //----------------------------------------------------------------------------
 //  Copyright (C) 2008-2012  The IPython Development Team
 //
 //  Distributed under the terms of the BSD License.  The full license is in
 //  the file COPYING, distributed as part of this software.
 //----------------------------------------------------------------------------
 
 //============================================================================
 // TextCell
 //============================================================================
 
 
 
 /**
     A module that allow to create different type of Text Cell
     @module IPython
     @namespace IPython
  */
 var IPython = (function (IPython) {
     "use strict";
 
     // TextCell base class
     var keycodes = IPython.keyboard.keycodes;
+    var security = IPython.security;
 
     /**
      * Construct a new TextCell, codemirror mode is by default 'htmlmixed', and cell type is 'text'
      * cell start as not redered.
      *
      * @class TextCell
      * @constructor TextCell
      * @extend IPython.Cell
      * @param {object|undefined} [options]
      *      @param [options.cm_config] {object} config to pass to CodeMirror, will extend/overwrite default config
      *      @param [options.placeholder] {string} default string to use when souce in empty for rendering (only use in some TextCell subclass)
      */
     var TextCell = function (options) {
         // in all TextCell/Cell subclasses
         // do not assign most of members here, just pass it down
         // in the options dict potentially overwriting what you wish.
         // they will be assigned in the base class.
 
         // we cannot put this as a class key as it has handle to "this".
         var cm_overwrite_options  = {
             onKeyEvent: $.proxy(this.handle_keyevent,this)
         };
 
         options = this.mergeopt(TextCell,options,{cm_config:cm_overwrite_options});
 
         this.cell_type = this.cell_type || 'text';
 
         IPython.Cell.apply(this, [options]);
 
         this.rendered = false;
     };
 
     TextCell.prototype = new IPython.Cell();
 
     TextCell.options_default = {
         cm_config : {
             extraKeys: {"Tab": "indentMore","Shift-Tab" : "indentLess"},
             mode: 'htmlmixed',
             lineWrapping : true,
         }
     };
 
 
     /**
      * Create the DOM element of the TextCell
      * @method create_element
      * @private
      */
     TextCell.prototype.create_element = function () {
         IPython.Cell.prototype.create_element.apply(this, arguments);
 
         var cell = $("<div>").addClass('cell text_cell border-box-sizing');
         cell.attr('tabindex','2');
 
         var prompt = $('<div/>').addClass('prompt input_prompt');
         cell.append(prompt);
         var inner_cell = $('<div/>').addClass('inner_cell');
         this.celltoolbar = new IPython.CellToolbar(this);
         inner_cell.append(this.celltoolbar.element);
         var input_area = $('<div/>').addClass('input_area');
         this.code_mirror = new CodeMirror(input_area.get(0), this.cm_config);
         // The tabindex=-1 makes this div focusable.
         var render_area = $('<div/>').addClass('text_cell_render border-box-sizing').
             addClass('rendered_html').attr('tabindex','-1');
         inner_cell.append(input_area).append(render_area);
         cell.append(inner_cell);
         this.element = cell;
     };
 
 
     /**
      * Bind the DOM evet to cell actions
      * Need to be called after TextCell.create_element
      * @private
      * @method bind_event
      */
     TextCell.prototype.bind_events = function () {
         IPython.Cell.prototype.bind_events.apply(this);
         var that = this;
 
         this.element.dblclick(function () {
             if (that.selected === false) {
                 $([IPython.events]).trigger('select.Cell', {'cell':that});
             }
             var cont = that.unrender();
             if (cont) {
                 that.focus_editor();
             }
         });
     };
 
     TextCell.prototype.handle_keyevent = function (editor, event) {
 
         // console.log('CM', this.mode, event.which, event.type)
 
         if (this.mode === 'command') {
             return true;
         } else if (this.mode === 'edit') {
             return this.handle_codemirror_keyevent(editor, event);
         }
     };
 
     /**
      * This method gets called in CodeMirror's onKeyDown/onKeyPress
      * handlers and is used to provide custom key handling.
      *
      * Subclass should override this method to have custom handeling
      *
      * @method handle_codemirror_keyevent
      * @param {CodeMirror} editor - The codemirror instance bound to the cell
      * @param {event} event -
      * @return {Boolean} `true` if CodeMirror should ignore the event, `false` Otherwise
      */
     TextCell.prototype.handle_codemirror_keyevent = function (editor, event) {
         var that = this;
 
         if (event.keyCode === 13 && (event.shiftKey || event.ctrlKey || event.altKey)) {
             // Always ignore shift-enter in CodeMirror as we handle it.
             return true;
         } else if (event.which === keycodes.up && event.type === 'keydown') {
             // If we are not at the top, let CM handle the up arrow and
             // prevent the global keydown handler from handling it.
             if (!that.at_top()) {
                 event.stop();
                 return false;
             } else {
                 return true;
             };
         } else if (event.which === keycodes.down && event.type === 'keydown') {
             // If we are not at the bottom, let CM handle the down arrow and
             // prevent the global keydown handler from handling it.
             if (!that.at_bottom()) {
                 event.stop();
                 return false;
             } else {
                 return true;
             };
         } else if (event.which === keycodes.esc && event.type === 'keydown') {
             if (that.code_mirror.options.keyMap === "vim-insert") {
                 // vim keyMap is active and in insert mode. In this case we leave vim
                 // insert mode, but remain in notebook edit mode.
                 // Let' CM handle this event and prevent global handling.
                 event.stop();
                 return false;
             } else {
                 // vim keyMap is not active. Leave notebook edit mode.
                 // Don't let CM handle the event, defer to global handling.
                 return true;
             }
         }
         return false;
     };
 
     // Cell level actions
     
     TextCell.prototype.select = function () {
         var cont = IPython.Cell.prototype.select.apply(this);
         if (cont) {
             if (this.mode === 'edit') {
                 this.code_mirror.refresh();
             }
         }
         return cont;
     };
 
     TextCell.prototype.unrender = function () {
         if (this.read_only) return;
         var cont = IPython.Cell.prototype.unrender.apply(this);
         if (cont) {
             var text_cell = this.element;
             var output = text_cell.find("div.text_cell_render");
             output.hide();
             text_cell.find('div.input_area').show();
             if (this.get_text() === this.placeholder) {
                 this.set_text('');
             }
             this.refresh();
         }
         return cont;
     };
 
     TextCell.prototype.execute = function () {
         this.render();
     };
 
     /**
      * setter: {{#crossLink "TextCell/set_text"}}{{/crossLink}}
      * @method get_text
      * @retrun {string} CodeMirror current text value
      */
     TextCell.prototype.get_text = function() {
         return this.code_mirror.getValue();
     };
 
     /**
      * @param {string} text - Codemiror text value
      * @see TextCell#get_text
      * @method set_text
      * */
     TextCell.prototype.set_text = function(text) {
         this.code_mirror.setValue(text);
         this.code_mirror.refresh();
     };
 
     /**
      * setter :{{#crossLink "TextCell/set_rendered"}}{{/crossLink}}
      * @method get_rendered
      * @return {html} html of rendered element
      * */
     TextCell.prototype.get_rendered = function() {
         return this.element.find('div.text_cell_render').html();
     };
 
     /**
      * @method set_rendered
      */
     TextCell.prototype.set_rendered = function(text) {
         this.element.find('div.text_cell_render').html(text);
     };
 
     /**
      * @method at_top
      * @return {Boolean}
      */
     TextCell.prototype.at_top = function () {
         if (this.rendered) {
             return true;
         } else {
             var cursor = this.code_mirror.getCursor();
             if (cursor.line === 0 && cursor.ch === 0) {
                 return true;
             } else {
                 return false;
             }
         }
     };
 
     /**
      * @method at_bottom
      * @return {Boolean}
      * */
     TextCell.prototype.at_bottom = function () {
         if (this.rendered) {
             return true;
         } else {
             var cursor = this.code_mirror.getCursor();
             if (cursor.line === (this.code_mirror.lineCount()-1) && cursor.ch === this.code_mirror.getLine(cursor.line).length) {
                 return true;
             } else {
                 return false;
             }
         }
     };
 
     /**
      * Create Text cell from JSON
      * @param {json} data - JSON serialized text-cell
      * @method fromJSON
      */
     TextCell.prototype.fromJSON = function (data) {
         IPython.Cell.prototype.fromJSON.apply(this, arguments);
         if (data.cell_type === this.cell_type) {
             if (data.source !== undefined) {
                 this.set_text(data.source);
                 // make this value the starting point, so that we can only undo
                 // to this state, instead of a blank cell
                 this.code_mirror.clearHistory();
                 // TODO: This HTML needs to be treated as potentially dangerous
                 // user input and should be handled before set_rendered.         
                 this.set_rendered(data.rendered || '');
                 this.rendered = false;
                 this.render();
             }
         }
     };
 
     /** Generate JSON from cell
      * @return {object} cell data serialised to json
      */
     TextCell.prototype.toJSON = function () {
         var data = IPython.Cell.prototype.toJSON.apply(this);
         data.source = this.get_text();
         if (data.source == this.placeholder) {
             data.source = "";
         }
         return data;
     };
 
 
     /**
      * @class MarkdownCell
      * @constructor MarkdownCell
      * @extends IPython.HTMLCell
      */
     var MarkdownCell = function (options) {
         options = this.mergeopt(MarkdownCell, options);
 
         this.cell_type = 'markdown';
         TextCell.apply(this, [options]);
     };
 
     MarkdownCell.options_default = {
         cm_config: {
             mode: 'gfm'
         },
         placeholder: "Type *Markdown* and LaTeX: $\\alpha^2$"
     };
 
     MarkdownCell.prototype = new TextCell();
 
     /**
      * @method render
      */
     MarkdownCell.prototype.render = function () {
         var cont = IPython.TextCell.prototype.render.apply(this);
         if (cont) {
             var text = this.get_text();
             var math = null;
             if (text === "") { text = this.placeholder; }
             var text_and_math = IPython.mathjaxutils.remove_math(text);
             text = text_and_math[0];
             math = text_and_math[1];
             var html = marked.parser(marked.lexer(text));
-            html = $(IPython.mathjaxutils.replace_math(html, math));
-            // Links in markdown cells should open in new tabs.
+            html = IPython.mathjaxutils.replace_math(html, math);
+            html = security.sanitize_html(html);
+            html = $(html);
+            // links in markdown cells should open in new tabs
             html.find("a[href]").not('[href^="#"]').attr("target", "_blank");
-            try {
-                // TODO: This HTML needs to be treated as potentially dangerous
-                // user input and should be handled before set_rendered.         
-                this.set_rendered(html);
-            } catch (e) {
-                console.log("Error running Javascript in Markdown:");
-                console.log(e);
-                this.set_rendered(
-                    $("<div/>")
-                        .append($("<div/>").text('Error rendering Markdown!').addClass("js-error"))
-                        .append($("<div/>").text(e.toString()).addClass("js-error"))
-                        .html()
-                );
-            }
+            this.set_rendered(html);
             this.element.find('div.input_area').hide();
             this.element.find("div.text_cell_render").show();
             this.typeset();
         }
         return cont;
     };
 
 
     // RawCell
 
     /**
      * @class RawCell
      * @constructor RawCell
      * @extends IPython.TextCell
      */
     var RawCell = function (options) {
 
         options = this.mergeopt(RawCell,options);
         TextCell.apply(this, [options]);
         this.cell_type = 'raw';
         // RawCell should always hide its rendered div
         this.element.find('div.text_cell_render').hide();
     };
 
     RawCell.options_default = {
         placeholder : "Write raw LaTeX or other formats here, for use with nbconvert.\n" +
             "It will not be rendered in the notebook.\n" + 
             "When passing through nbconvert, a Raw Cell's content is added to the output unmodified."
     };
 
     RawCell.prototype = new TextCell();
 
     /** @method bind_events **/
     RawCell.prototype.bind_events = function () {
         TextCell.prototype.bind_events.apply(this);
         var that = this;
         this.element.focusout(function() {
             that.auto_highlight();
         });
     };
 
     /**
      * Trigger autodetection of highlight scheme for current cell
      * @method auto_highlight
      */
     RawCell.prototype.auto_highlight = function () {
         this._auto_highlight(IPython.config.raw_cell_highlight);
     };
 
     /** @method render **/
     RawCell.prototype.render = function () {
         // Make sure that this cell type can never be rendered
         if (this.rendered) {
             this.unrender();
         }
         var text = this.get_text();
         if (text === "") { text = this.placeholder; }
         this.set_text(text);
     };
 
 
     /**
      * @class HeadingCell
      * @extends IPython.TextCell
      */
 
     /**
      * @constructor HeadingCell
      * @extends IPython.TextCell
      */
     var HeadingCell = function (options) {
         options = this.mergeopt(HeadingCell, options);
 
         this.level = 1;
         this.cell_type = 'heading';
         TextCell.apply(this, [options]);
 
         /**
          * heading level of the cell, use getter and setter to access
          * @property level
          */
     };
 
     HeadingCell.options_default = {
         placeholder: "Type Heading Here"
     };
 
     HeadingCell.prototype = new TextCell();
 
     /** @method fromJSON */
     HeadingCell.prototype.fromJSON = function (data) {
         if (data.level !== undefined){
             this.level = data.level;
         }
         TextCell.prototype.fromJSON.apply(this, arguments);
     };
 
 
     /** @method toJSON */
     HeadingCell.prototype.toJSON = function () {
         var data = TextCell.prototype.toJSON.apply(this);
         data.level = this.get_level();
         return data;
     };
 
     /**
      * can the cell be split into two cells
      * @method is_splittable
      **/
     HeadingCell.prototype.is_splittable = function () {
         return false;
     };
 
 
     /**
      * can the cell be merged with other cells
      * @method is_mergeable
      **/
     HeadingCell.prototype.is_mergeable = function () {
         return false;
     };
 
     /**
      * Change heading level of cell, and re-render
      * @method set_level
      */
     HeadingCell.prototype.set_level = function (level) {
         this.level = level;
         if (this.rendered) {
             this.rendered = false;
             this.render();
         }
     };
 
     /** The depth of header cell, based on html (h1 to h6)
      * @method get_level
      * @return {integer} level - for 1 to 6
      */
     HeadingCell.prototype.get_level = function () {
         return this.level;
     };
 
 
     HeadingCell.prototype.set_rendered = function (html) {
         this.element.find("div.text_cell_render").html(html);
     };
 
 
     HeadingCell.prototype.get_rendered = function () {
         var r = this.element.find("div.text_cell_render");
         return r.children().first().html();
     };
 
 
     HeadingCell.prototype.render = function () {
         var cont = IPython.TextCell.prototype.render.apply(this);
         if (cont) {
             var text = this.get_text();
             var math = null;
             // Markdown headings must be a single line
             text = text.replace(/\n/g, ' ');
             if (text === "") { text = this.placeholder; }
             text = Array(this.level + 1).join("#") + " " + text;
             var text_and_math = IPython.mathjaxutils.remove_math(text);
             text = text_and_math[0];
             math = text_and_math[1];
             var html = marked.parser(marked.lexer(text));
-            var h = $(IPython.mathjaxutils.replace_math(html, math));
+            html = IPython.mathjaxutils.replace_math(html, math);
+            html = security.sanitize_html(html);
+            var h = $(html);
             // add id and linkback anchor
             var hash = h.text().replace(/ /g, '-');
             h.attr('id', hash);
             h.append(
                 $('<a/>')
                     .addClass('anchor-link')
                     .attr('href', '#' + hash)
                     .text('¶')
             );
-            // TODO: This HTML needs to be treated as potentially dangerous
-            // user input and should be handled before set_rendered.         
             this.set_rendered(h);
-            this.typeset();
-            this.element.find('div.input_area').hide();
+            this.element.find('div.text_cell_input').hide();
             this.element.find("div.text_cell_render").show();
-
+            this.typeset();
         }
         return cont;
     };
 
     IPython.TextCell = TextCell;
     IPython.MarkdownCell = MarkdownCell;
     IPython.RawCell = RawCell;
     IPython.HeadingCell = HeadingCell;
 
 
     return IPython;
 
 }(IPython));
 

IPython/html/static/notebook/less/style_noapp.less

@@ -1,10 +1,10 b''
 @import "variables.less";
 @import "ansicolors.less";
 @import "cell.less";
 @import "codecell.less";
 @import "codemirror.less";
 @import "highlight.less";
 @import "outputarea.less";
 @import "renderedhtml.less";
 @import "textcell.less";
-@import "widgets.less";
+@import "../../widgets/less/widgets.less";

IPython/html/templates/notebook.html

@@ -1,353 +1,358 b''
 {% extends "page.html" %}
 
 {% block stylesheet %}
 
 {% if mathjax_url %}
 <script type="text/javascript" src="{{mathjax_url}}?config=TeX-AMS_HTML-full&delayStartupUntil=configured" charset="utf-8"></script>
 {% endif %}
 <script type="text/javascript">
 // MathJax disabled, set as null to distingish from *missing* MathJax,
 // where it will be undefined, and should prompt a dialog later.
 window.mathjax_url = "{{mathjax_url}}";
 </script>
 
 <link rel="stylesheet" href="{{ static_url("components/codemirror/lib/codemirror.css") }}">
 
 {{super()}}
 
 <link rel="stylesheet" href="{{ static_url("notebook/css/override.css") }}" type="text/css" />
 
 {% endblock %}
 
 {% block params %}
 
 data-project="{{project}}"
 data-base-url="{{base_url}}"
 data-notebook-name="{{notebook_name}}"
 data-notebook-path="{{notebook_path}}"
 class="notebook_app"
 
 {% endblock %}
 
 
 {% block header %}
 
 <span id="save_widget" class="nav pull-left">
     <span id="notebook_name"></span>
     <span id="checkpoint_status"></span>
     <span id="autosave_status"></span>
 </span>
 
 {% endblock %}
 
 
 {% block site %}
 
 <div id="menubar-container" class="container">
 <div id="menubar">
 <div class="navbar">
   <div class="navbar-inner">
     <div class="container">
     <ul id="menus" class="nav">
         <li class="dropdown"><a href="#" class="dropdown-toggle" data-toggle="dropdown">File</a>
             <ul id="file_menu" class="dropdown-menu">
                 <li id="new_notebook"
                     title="Make a new notebook (Opens a new window)">
                     <a href="#">New</a></li>
                 <li id="open_notebook"
                     title="Opens a new window with the Dashboard view">
                     <a href="#">Open...</a></li>
                 <!-- <hr/> -->
                 <li class="divider"></li>
                 <li id="copy_notebook"
                     title="Open a copy of this notebook's contents and start a new kernel">
                     <a href="#">Make a Copy...</a></li>
                 <li id="rename_notebook"><a href="#">Rename...</a></li>
                 <li id="save_checkpoint"><a href="#">Save and Checkpoint</a></li>
                 <!-- <hr/> -->
                 <li class="divider"></li>
                 <li id="restore_checkpoint" class="dropdown-submenu"><a href="#">Revert to Checkpoint</a>
                   <ul class="dropdown-menu">
                     <li><a href="#"></a></li>
                     <li><a href="#"></a></li>
                     <li><a href="#"></a></li>
                     <li><a href="#"></a></li>
                     <li><a href="#"></a></li>
                   </ul>
                 </li>
                 <li class="divider"></li>
                 <li id="print_preview"><a href="#">Print Preview</a></li>
                 <li class="dropdown-submenu"><a href="#">Download as</a>
                     <ul class="dropdown-menu">
                         <li id="download_ipynb"><a href="#">IPython Notebook (.ipynb)</a></li>
                         <li id="download_py"><a href="#">Python (.py)</a></li>
                         <li id="download_html"><a href="#">HTML (.html)</a></li>
                         <li id="download_rst"><a href="#">reST (.rst)</a></li>
                     </ul>
                 </li>
                 <li class="divider"></li>
-                
+                <li id="trust_notebook"
+                    title="Trust the output of this notebook">
+                    <a href="#" >Trust Notebook</a></li>
+                <li class="divider"></li>
                 <li id="kill_and_exit"
                     title="Shutdown this notebook's kernel, and close this window">
                     <a href="#" >Close and halt</a></li>
             </ul>
         </li>
         <li class="dropdown"><a href="#" class="dropdown-toggle" data-toggle="dropdown">Edit</a>
             <ul id="edit_menu" class="dropdown-menu">
                 <li id="cut_cell"><a href="#">Cut Cell</a></li>
                 <li id="copy_cell"><a href="#">Copy Cell</a></li>
                 <li id="paste_cell_above" class="disabled"><a href="#">Paste Cell Above</a></li>
                 <li id="paste_cell_below" class="disabled"><a href="#">Paste Cell Below</a></li>
                 <li id="paste_cell_replace" class="disabled"><a href="#">Paste Cell &amp; Replace</a></li>
                 <li id="delete_cell"><a href="#">Delete Cell</a></li>
                 <li id="undelete_cell" class="disabled"><a href="#">Undo Delete Cell</a></li>
                 <li class="divider"></li>
                 <li id="split_cell"><a href="#">Split Cell</a></li>
                 <li id="merge_cell_above"><a href="#">Merge Cell Above</a></li>
                 <li id="merge_cell_below"><a href="#">Merge Cell Below</a></li>
                 <li class="divider"></li>
                 <li id="move_cell_up"><a href="#">Move Cell Up</a></li>
                 <li id="move_cell_down"><a href="#">Move Cell Down</a></li>
                 <li class="divider"></li>
                 <li id="edit_nb_metadata"><a href="#">Edit Notebook Metadata</a></li>
             </ul>
         </li>
         <li class="dropdown"><a href="#" class="dropdown-toggle" data-toggle="dropdown">View</a>
             <ul id="view_menu" class="dropdown-menu">
                 <li id="toggle_header"
                     title="Show/Hide the IPython Notebook logo and notebook title (above menu bar)">
                     <a href="#">Toggle Header</a></li>
                 <li id="toggle_toolbar"
                     title="Show/Hide the action icons (below menu bar)">
                     <a href="#">Toggle Toolbar</a></li>
             </ul>
         </li>
         <li class="dropdown"><a href="#" class="dropdown-toggle" data-toggle="dropdown">Insert</a>
             <ul id="insert_menu" class="dropdown-menu">
                 <li id="insert_cell_above"
                     title="Insert an empty Code cell above the currently active cell">
                     <a href="#">Insert Cell Above</a></li>
                 <li id="insert_cell_below"
                     title="Insert an empty Code cell below the currently active cell">
                     <a href="#">Insert Cell Below</a></li>
             </ul>
         </li>
         <li class="dropdown"><a href="#" class="dropdown-toggle" data-toggle="dropdown">Cell</a>
             <ul id="cell_menu" class="dropdown-menu">
                 <li id="run_cell" title="Run this cell, and move cursor to the next one">
                     <a href="#">Run</a></li>
                 <li id="run_cell_select_below" title="Run this cell, select below">
                     <a href="#">Run and Select Below</a></li>
                 <li id="run_cell_insert_below" title="Run this cell, insert below">
                     <a href="#">Run and Insert Below</a></li>
                 <li id="run_all_cells" title="Run all cells in the notebook">
                     <a href="#">Run All</a></li>
                 <li id="run_all_cells_above" title="Run all cells above (but not including) this cell">
                     <a href="#">Run All Above</a></li>
                 <li id="run_all_cells_below" title="Run this cell and all cells below it">
                     <a href="#">Run All Below</a></li>
                 <li class="divider"></li>
                 <li id="change_cell_type" class="dropdown-submenu"
                     title="All cells in the notebook have a cell type. By default, new cells are created as 'Code' cells">
                     <a href="#">Cell Type</a>
                     <ul class="dropdown-menu">
                       <li id="to_code"
                           title="Contents will be sent to the kernel for execution, and output will display in the footer of cell">
                           <a href="#">Code</a></li>
                       <li id="to_markdown"
                           title="Contents will be rendered as HTML and serve as explanatory text">
                           <a href="#">Markdown</a></li>
                       <li id="to_raw"
                           title="Contents will pass through nbconvert unmodified">
                           <a href="#">Raw NBConvert</a></li>
                       <li id="to_heading1"><a href="#">Heading 1</a></li>
                       <li id="to_heading2"><a href="#">Heading 2</a></li>
                       <li id="to_heading3"><a href="#">Heading 3</a></li>
                       <li id="to_heading4"><a href="#">Heading 4</a></li>
                       <li id="to_heading5"><a href="#">Heading 5</a></li>
                       <li id="to_heading6"><a href="#">Heading 6</a></li>
                     </ul>
                 </li>
                 <li class="divider"></li>
                 <li id="current_outputs" class="dropdown-submenu"><a href="#">Current Output</a>
                     <ul class="dropdown-menu">
                         <li id="toggle_current_output"
                             title="Hide/Show the output of the current cell">
                             <a href="#">Toggle</a>
                         </li>
                         <li id="toggle_current_output_scroll"
                             title="Scroll the output of the current cell">
                             <a href="#">Toggle Scrolling</a>
                         </li>
                         <li id="clear_current_output"
                             title="Clear the output of the current cell">
                             <a href="#">Clear</a>
                         </li>
                     </ul>
                 </li>
                 <li id="all_outputs" class="dropdown-submenu"><a href="#">All Output</a>
                     <ul class="dropdown-menu">
                         <li id="toggle_all_output"
                             title="Hide/Show the output of all cells">
                             <a href="#">Toggle</a>
                         </li>
                         <li id="toggle_all_output_scroll"
                             title="Scroll the output of all cells">
                             <a href="#">Toggle Scrolling</a>
                         </li>
                         <li id="clear_all_output"
                             title="Clear the output of all cells">
                             <a href="#">Clear</a>
                         </li>
                     </ul>
                 </li>
             </ul>
         </li>
         <li class="dropdown"><a href="#" class="dropdown-toggle" data-toggle="dropdown">Kernel</a>
             <ul id="kernel_menu" class="dropdown-menu">
                 <li id="int_kernel"
                     title="Send KeyboardInterrupt (CTRL-C) to the Kernel">
                     <a href="#">Interrupt</a></li>
                 <li id="restart_kernel"
                     title="Restart the Kernel">
                     <a href="#">Restart</a></li>
             </ul>
         </li>
         <li class="dropdown"><a href="#" class="dropdown-toggle" data-toggle="dropdown">Help</a>
             <ul  id="help_menu" class="dropdown-menu">
                 <li id="keyboard_shortcuts" title="Opens a tooltip with all keyboard shortcuts"><a href="#">Keyboard Shortcuts</a></li>
                 <li class="divider"></li>
                 {% set
                     sections = (
                         (
                             ("http://ipython.org/documentation.html","IPython Help",True),
                             ("http://nbviewer.ipython.org/github/ipython/ipython/tree/master/examples/notebooks/", "Notebook Examples", True),
                             ("http://ipython.org/ipython-doc/stable/interactive/notebook.html","Notebook Help",True),
                             ("http://ipython.org/ipython-doc/dev/interactive/cm_keyboard.html","Editor Shortcuts",True),
                         ),(
                             ("http://docs.python.org","Python",True),
                             ("http://docs.scipy.org/doc/numpy/reference/","NumPy",True),
                             ("http://docs.scipy.org/doc/scipy/reference/","SciPy",True),
                             ("http://matplotlib.org/contents.html","Matplotlib",True),
                             ("http://docs.sympy.org/dev/index.html","SymPy",True),
                             ("http://pandas.pydata.org/pandas-docs/stable/","pandas", True)
                         )
                     )
                 %}
 
                 {% for helplinks in sections %}
                     {% for link in helplinks %}
                         <li><a href="{{link[0]}}" {{'target="_blank" title="Opens in a new window"' if link[2]}}>
                         {{'<i class="icon-external-link menu-icon pull-right"></i>' if link[2]}}
                         {{link[1]}}
                         </a></li>
                     {% endfor %}
                     {% if not loop.last %}
                         <li class="divider"></li>
                     {% endif %}
                 {% endfor %}
                 </li>
             </ul>
         </li>
     </ul>
     <div id="kernel_indicator" class="indicator_area pull-right">
        <i id="kernel_indicator_icon"></i>
     </div>
     <div id="modal_indicator" class="indicator_area pull-right">
        <i id="modal_indicator_icon"></i>
     </div>
     <div id="notification_area"></div>
     </div>
   </div>
 </div>
 </div>
 <div id="maintoolbar" class="navbar">
   <div class="toolbar-inner navbar-inner navbar-nobg">
     <div id="maintoolbar-container" class="container"></div>
   </div>
 </div>
 </div>
 
 <div id="ipython-main-app">
 
     <div id="notebook_panel">
         <div id="notebook"></div>
         <div id="pager_splitter"></div>
         <div id="pager">
             <div id='pager_button_area'>
             </div>
             <div id="pager-container" class="container"></div>
         </div>
     </div>
 
 </div>
 <div id='tooltip' class='ipython_tooltip' style='display:none'></div>
 
 
 {% endblock %}
 
 
 {% block script %}
 
 {{super()}}
 
+<script src="{{ static_url("components/google-caja/html-css-sanitizer-minified.js") }}" charset="utf-8"></script>
 <script src="{{ static_url("components/codemirror/lib/codemirror.js") }}" charset="utf-8"></script>
 <script type="text/javascript">
     CodeMirror.modeURL = "{{ static_url("components/codemirror/mode/%N/%N.js", include_version=False) }}";
 </script>
 <script src="{{ static_url("components/codemirror/addon/mode/loadmode.js") }}" charset="utf-8"></script>
 <script src="{{ static_url("components/codemirror/addon/mode/multiplex.js") }}" charset="utf-8"></script>
 <script src="{{ static_url("components/codemirror/addon/mode/overlay.js") }}" charset="utf-8"></script>
 <script src="{{ static_url("components/codemirror/addon/edit/matchbrackets.js") }}" charset="utf-8"></script>
 <script src="{{ static_url("components/codemirror/addon/edit/closebrackets.js") }}" charset="utf-8"></script>
 <script src="{{ static_url("components/codemirror/addon/comment/comment.js") }}" charset="utf-8"></script>
 <script src="{{ static_url("components/codemirror/mode/htmlmixed/htmlmixed.js") }}" charset="utf-8"></script>
 <script src="{{ static_url("components/codemirror/mode/xml/xml.js") }}" charset="utf-8"></script>
 <script src="{{ static_url("components/codemirror/mode/javascript/javascript.js") }}" charset="utf-8"></script>
 <script src="{{ static_url("components/codemirror/mode/css/css.js") }}" charset="utf-8"></script>
 <script src="{{ static_url("components/codemirror/mode/rst/rst.js") }}" charset="utf-8"></script>
 <script src="{{ static_url("components/codemirror/mode/markdown/markdown.js") }}" charset="utf-8"></script>
 <script src="{{ static_url("components/codemirror/mode/gfm/gfm.js") }}" charset="utf-8"></script>
 <script src="{{ static_url("components/codemirror/mode/python/python.js") }}" charset="utf-8"></script>
 <script src="{{ static_url("notebook/js/codemirror-ipython.js") }}" charset="utf-8"></script>
 
 <script src="{{ static_url("components/highlight.js/build/highlight.pack.js") }}" charset="utf-8"></script>
 
 <script src="{{ static_url("dateformat/date.format.js") }}" charset="utf-8"></script>
 
 <script src="{{ static_url("base/js/events.js") }}" type="text/javascript" charset="utf-8"></script>
 <script src="{{ static_url("base/js/utils.js") }}" type="text/javascript" charset="utf-8"></script>
 <script src="{{ static_url("base/js/keyboard.js") }}" type="text/javascript" charset="utf-8"></script>
+<script src="{{ static_url("base/js/security.js") }}" type="text/javascript" charset="utf-8"></script>
 <script src="{{ static_url("base/js/dialog.js") }}" type="text/javascript" charset="utf-8"></script>
 <script src="{{ static_url("services/kernels/js/kernel.js") }}" type="text/javascript" charset="utf-8"></script>
 <script src="{{ static_url("services/kernels/js/comm.js") }}" type="text/javascript" charset="utf-8"></script>
 <script src="{{ static_url("services/sessions/js/session.js") }}" type="text/javascript" charset="utf-8"></script>
 <script src="{{ static_url("notebook/js/layoutmanager.js") }}" type="text/javascript" charset="utf-8"></script>
 <script src="{{ static_url("notebook/js/mathjaxutils.js") }}" type="text/javascript" charset="utf-8"></script>
 <script src="{{ static_url("notebook/js/outputarea.js") }}" type="text/javascript" charset="utf-8"></script>
 <script src="{{ static_url("notebook/js/cell.js") }}" type="text/javascript" charset="utf-8"></script>
 <script src="{{ static_url("notebook/js/celltoolbar.js") }}" type="text/javascript" charset="utf-8"></script>
 <script src="{{ static_url("notebook/js/codecell.js") }}" type="text/javascript" charset="utf-8"></script>
 <script src="{{ static_url("notebook/js/completer.js") }}" type="text/javascript" charset="utf-8"></script>
 <script src="{{ static_url("notebook/js/textcell.js") }}" type="text/javascript" charset="utf-8"></script>
 <script src="{{ static_url("notebook/js/savewidget.js") }}" type="text/javascript" charset="utf-8"></script>
 <script src="{{ static_url("notebook/js/quickhelp.js") }}" type="text/javascript" charset="utf-8"></script>
 <script src="{{ static_url("notebook/js/pager.js") }}" type="text/javascript" charset="utf-8"></script>
 <script src="{{ static_url("notebook/js/menubar.js") }}" type="text/javascript" charset="utf-8"></script>
 <script src="{{ static_url("notebook/js/toolbar.js") }}" type="text/javascript" charset="utf-8"></script>
 <script src="{{ static_url("notebook/js/maintoolbar.js") }}" type="text/javascript" charset="utf-8"></script>
 <script src="{{ static_url("notebook/js/notebook.js") }}" type="text/javascript" charset="utf-8"></script>
 <script src="{{ static_url("notebook/js/keyboardmanager.js") }}" type="text/javascript" charset="utf-8"></script>
 <script src="{{ static_url("notebook/js/notificationwidget.js") }}" type="text/javascript" charset="utf-8"></script>
 <script src="{{ static_url("notebook/js/notificationarea.js") }}" type="text/javascript" charset="utf-8"></script>
 <script src="{{ static_url("notebook/js/tooltip.js") }}" type="text/javascript" charset="utf-8"></script>
 <script src="{{ static_url("notebook/js/config.js") }}" type="text/javascript" charset="utf-8"></script>
 <script src="{{ static_url("notebook/js/main.js") }}" type="text/javascript" charset="utf-8"></script>
 
 <script src="{{ static_url("notebook/js/contexthint.js") }}" charset="utf-8"></script>
 
 <script src="{{ static_url("notebook/js/celltoolbarpresets/default.js") }}" type="text/javascript" charset="utf-8"></script>
 <script src="{{ static_url("notebook/js/celltoolbarpresets/rawcell.js") }}" type="text/javascript" charset="utf-8"></script>
 <script src="{{ static_url("notebook/js/celltoolbarpresets/slideshow.js") }}" type="text/javascript" charset="utf-8"></script>
 
 {% endblock %}

setupbase.py

@@ -1,696 +1,697 b''
 # encoding: utf-8
 """
 This module defines the things that are used in setup.py for building IPython
 
 This includes:
 
     * The basic arguments to setup
     * Functions for finding things like packages, package data, etc.
     * A function for checking dependencies.
 """
 from __future__ import print_function
 
 #-------------------------------------------------------------------------------
 #  Copyright (C) 2008  The IPython Development Team
 #
 #  Distributed under the terms of the BSD License.  The full license is in
 #  the file COPYING, distributed as part of this software.
 #-------------------------------------------------------------------------------
 
 #-------------------------------------------------------------------------------
 # Imports
 #-------------------------------------------------------------------------------
 import errno
 import os
 import sys
 
 from distutils.command.build_py import build_py
 from distutils.command.build_scripts import build_scripts
 from distutils.command.install import install
 from distutils.command.install_scripts import install_scripts
 from distutils.cmd import Command
 from glob import glob
 from subprocess import call
 
 from setupext import install_data_ext
 
 #-------------------------------------------------------------------------------
 # Useful globals and utility functions
 #-------------------------------------------------------------------------------
 
 # A few handy globals
 isfile = os.path.isfile
 pjoin = os.path.join
 repo_root = os.path.dirname(os.path.abspath(__file__))
 
 def oscmd(s):
     print(">", s)
     os.system(s)
 
 # Py3 compatibility hacks, without assuming IPython itself is installed with
 # the full py3compat machinery.
 
 try:
     execfile
 except NameError:
     def execfile(fname, globs, locs=None):
         locs = locs or globs
         exec(compile(open(fname).read(), fname, "exec"), globs, locs)
 
 # A little utility we'll need below, since glob() does NOT allow you to do
 # exclusion on multiple endings!
 def file_doesnt_endwith(test,endings):
     """Return true if test is a file and its name does NOT end with any
     of the strings listed in endings."""
     if not isfile(test):
         return False
     for e in endings:
         if test.endswith(e):
             return False
     return True
 
 #---------------------------------------------------------------------------
 # Basic project information
 #---------------------------------------------------------------------------
 
 # release.py contains version, authors, license, url, keywords, etc.
 execfile(pjoin(repo_root, 'IPython','core','release.py'), globals())
 
 # Create a dict with the basic information
 # This dict is eventually passed to setup after additional keys are added.
 setup_args = dict(
       name             = name,
       version          = version,
       description      = description,
       long_description = long_description,
       author           = author,
       author_email     = author_email,
       url              = url,
       download_url     = download_url,
       license          = license,
       platforms        = platforms,
       keywords         = keywords,
       classifiers      = classifiers,
       cmdclass         = {'install_data': install_data_ext},
       )
 
 
 #---------------------------------------------------------------------------
 # Find packages
 #---------------------------------------------------------------------------
 
 def find_packages():
     """
     Find all of IPython's packages.
     """
     excludes = ['deathrow', 'quarantine']
     packages = []
     for dir,subdirs,files in os.walk('IPython'):
         package = dir.replace(os.path.sep, '.')
         if any(package.startswith('IPython.'+exc) for exc in excludes):
             # package is to be excluded (e.g. deathrow)
             continue
         if '__init__.py' not in files:
             # not a package
             continue
         packages.append(package)
     return packages
 
 #---------------------------------------------------------------------------
 # Find package data
 #---------------------------------------------------------------------------
 
 def find_package_data():
     """
     Find IPython's package_data.
     """
     # This is not enough for these things to appear in an sdist.
     # We need to muck with the MANIFEST to get this to work
     
     # exclude components from the walk,
     # we will build the components separately
     excludes = ['components']
     
     # add 'static/' prefix to exclusions, and tuplify for use in startswith
     excludes = tuple([pjoin('static', ex) for ex in excludes])
     
     # walk notebook resources:
     cwd = os.getcwd()
     os.chdir(os.path.join('IPython', 'html'))
     static_data = []
     for parent, dirs, files in os.walk('static'):
         if parent.startswith(excludes):
             continue
         for f in files:
             static_data.append(pjoin(parent, f))
     components = pjoin("static", "components")
     # select the components we actually need to install
     # (there are lots of resources we bundle for sdist-reasons that we don't actually use)
     static_data.extend([
         pjoin(components, "backbone", "backbone-min.js"),
         pjoin(components, "bootstrap", "bootstrap", "js", "bootstrap.min.js"),
         pjoin(components, "font-awesome", "font", "*.*"),
+        pjoin(components, "google-caja", "html-css-sanitizer-minified.js"),
         pjoin(components, "highlight.js", "build", "highlight.pack.js"),
         pjoin(components, "jquery", "jquery.min.js"),
         pjoin(components, "jquery-ui", "ui", "minified", "jquery-ui.min.js"),
         pjoin(components, "jquery-ui", "themes", "smoothness", "jquery-ui.min.css"),
         pjoin(components, "marked", "lib", "marked.js"),
         pjoin(components, "requirejs", "require.js"),
         pjoin(components, "underscore", "underscore-min.js"),
     ])
     
     # Ship all of Codemirror's CSS and JS
     for parent, dirs, files in os.walk(pjoin(components, 'codemirror')):
         for f in files:
             if f.endswith(('.js', '.css')):
                 static_data.append(pjoin(parent, f))
     
     os.chdir(os.path.join('tests',))
     js_tests = glob('*.js') + glob('*/*.js')
 
     os.chdir(os.path.join(cwd, 'IPython', 'nbconvert'))
     nbconvert_templates = [os.path.join(dirpath, '*.*')
                             for dirpath, _, _ in os.walk('templates')]
 
     os.chdir(cwd)
 
     package_data = {
         'IPython.config.profile' : ['README*', '*/*.py'],
         'IPython.core.tests' : ['*.png', '*.jpg'],
         'IPython.lib.tests' : ['*.wav'],
         'IPython.testing.plugin' : ['*.txt'],
         'IPython.html' : ['templates/*'] + static_data,
         'IPython.html.tests' : js_tests,
         'IPython.qt.console' : ['resources/icon/*.svg'],
         'IPython.nbconvert' : nbconvert_templates +
             ['tests/files/*.*', 'exporters/tests/files/*.*'],
         'IPython.nbconvert.filters' : ['marked.js'],
         'IPython.nbformat' : ['tests/*.ipynb']
     }
     
     return package_data
 
 
 def check_package_data(package_data):
     """verify that package_data globs make sense"""
     print("checking package data")
     for pkg, data in package_data.items():
         pkg_root = pjoin(*pkg.split('.'))
         for d in data:
             path = pjoin(pkg_root, d)
             if '*' in path:
                 assert len(glob(path)) > 0, "No files match pattern %s" % path
             else:
                 assert os.path.exists(path), "Missing package data: %s" % path
 
 
 def check_package_data_first(command):
     """decorator for checking package_data before running a given command
     
     Probably only needs to wrap build_py
     """
     class DecoratedCommand(command):
         def run(self):
             check_package_data(self.package_data)
             command.run(self)
     return DecoratedCommand
 
 
 #---------------------------------------------------------------------------
 # Find data files
 #---------------------------------------------------------------------------
 
 def make_dir_struct(tag,base,out_base):
     """Make the directory structure of all files below a starting dir.
 
     This is just a convenience routine to help build a nested directory
     hierarchy because distutils is too stupid to do this by itself.
 
     XXX - this needs a proper docstring!
     """
 
     # we'll use these a lot below
     lbase = len(base)
     pathsep = os.path.sep
     lpathsep = len(pathsep)
 
     out = []
     for (dirpath,dirnames,filenames) in os.walk(base):
         # we need to strip out the dirpath from the base to map it to the
         # output (installation) path.  This requires possibly stripping the
         # path separator, because otherwise pjoin will not work correctly
         # (pjoin('foo/','/bar') returns '/bar').
 
         dp_eff = dirpath[lbase:]
         if dp_eff.startswith(pathsep):
             dp_eff = dp_eff[lpathsep:]
         # The output path must be anchored at the out_base marker
         out_path = pjoin(out_base,dp_eff)
         # Now we can generate the final filenames. Since os.walk only produces
         # filenames, we must join back with the dirpath to get full valid file
         # paths:
         pfiles = [pjoin(dirpath,f) for f in filenames]
         # Finally, generate the entry we need, which is a pari of (output
         # path, files) for use as a data_files parameter in install_data.
         out.append((out_path, pfiles))
 
     return out
 
 
 def find_data_files():
     """
     Find IPython's data_files.
 
     Just man pages at this point.
     """
 
     manpagebase = pjoin('share', 'man', 'man1')
 
     # Simple file lists can be made by hand
     manpages = [f for f in glob(pjoin('docs','man','*.1.gz')) if isfile(f)]
     if not manpages:
         # When running from a source tree, the manpages aren't gzipped
         manpages = [f for f in glob(pjoin('docs','man','*.1')) if isfile(f)]
 
     # And assemble the entire output list
     data_files = [ (manpagebase, manpages) ]
 
     return data_files
 
 
 def make_man_update_target(manpage):
     """Return a target_update-compliant tuple for the given manpage.
 
     Parameters
     ----------
     manpage : string
       Name of the manpage, must include the section number (trailing number).
 
     Example
     -------
 
     >>> make_man_update_target('ipython.1') #doctest: +NORMALIZE_WHITESPACE
     ('docs/man/ipython.1.gz',
      ['docs/man/ipython.1'],
      'cd docs/man && gzip -9c ipython.1 > ipython.1.gz')
     """
     man_dir = pjoin('docs', 'man')
     manpage_gz = manpage + '.gz'
     manpath = pjoin(man_dir, manpage)
     manpath_gz = pjoin(man_dir, manpage_gz)
     gz_cmd = ( "cd %(man_dir)s && gzip -9c %(manpage)s > %(manpage_gz)s" %
                locals() )
     return (manpath_gz, [manpath], gz_cmd)
 
 # The two functions below are copied from IPython.utils.path, so we don't need
 # to import IPython during setup, which fails on Python 3.
 
 def target_outdated(target,deps):
     """Determine whether a target is out of date.
 
     target_outdated(target,deps) -> 1/0
 
     deps: list of filenames which MUST exist.
     target: single filename which may or may not exist.
 
     If target doesn't exist or is older than any file listed in deps, return
     true, otherwise return false.
     """
     try:
         target_time = os.path.getmtime(target)
     except os.error:
         return 1
     for dep in deps:
         dep_time = os.path.getmtime(dep)
         if dep_time > target_time:
             #print "For target",target,"Dep failed:",dep # dbg
             #print "times (dep,tar):",dep_time,target_time # dbg
             return 1
     return 0
 
 
 def target_update(target,deps,cmd):
     """Update a target with a given command given a list of dependencies.
 
     target_update(target,deps,cmd) -> runs cmd if target is outdated.
 
     This is just a wrapper around target_outdated() which calls the given
     command if target is outdated."""
 
     if target_outdated(target,deps):
         os.system(cmd)
 
 #---------------------------------------------------------------------------
 # Find scripts
 #---------------------------------------------------------------------------
 
 def find_entry_points():
     """Find IPython's scripts.
 
     if entry_points is True:
         return setuptools entry_point-style definitions
     else:
         return file paths of plain scripts [default]
 
     suffix is appended to script names if entry_points is True, so that the
     Python 3 scripts get named "ipython3" etc.
     """
     ep = [
             'ipython%s = IPython:start_ipython',
             'ipcontroller%s = IPython.parallel.apps.ipcontrollerapp:launch_new_instance',
             'ipengine%s = IPython.parallel.apps.ipengineapp:launch_new_instance',
             'ipcluster%s = IPython.parallel.apps.ipclusterapp:launch_new_instance',
             'iptest%s = IPython.testing.iptestcontroller:main',
         ]
     suffix = str(sys.version_info[0])
     return [e % '' for e in ep] + [e % suffix for e in ep]
 
 script_src = """#!{executable}
 # This script was automatically generated by setup.py
 if __name__ == '__main__':
     from {mod} import {func}
     {func}()
 """
 
 class build_scripts_entrypt(build_scripts):
     def run(self):
         self.mkpath(self.build_dir)
         outfiles = []
         for script in find_entry_points():
             name, entrypt = script.split('=')
             name = name.strip()
             entrypt = entrypt.strip()
             outfile = os.path.join(self.build_dir, name)
             outfiles.append(outfile)
             print('Writing script to', outfile)
 
             mod, func = entrypt.split(':')
             with open(outfile, 'w') as f:
                 f.write(script_src.format(executable=sys.executable,
                                           mod=mod, func=func))
 
         return outfiles, outfiles
 
 class install_lib_symlink(Command):
     user_options = [
         ('install-dir=', 'd', "directory to install to"),
         ]
 
     def initialize_options(self):
         self.install_dir = None
 
     def finalize_options(self):
         self.set_undefined_options('symlink',
                                    ('install_lib', 'install_dir'),
                                   )
 
     def run(self):
         if sys.platform == 'win32':
             raise Exception("This doesn't work on Windows.")
         pkg = os.path.join(os.getcwd(), 'IPython')
         dest = os.path.join(self.install_dir, 'IPython')
         if os.path.islink(dest):
             print('removing existing symlink at %s' % dest)
             os.unlink(dest)
         print('symlinking %s -> %s' % (pkg, dest))
         os.symlink(pkg, dest)
 
 class unsymlink(install):
     def run(self):
         dest = os.path.join(self.install_lib, 'IPython')
         if os.path.islink(dest):
             print('removing symlink at %s' % dest)
             os.unlink(dest)
         else:
             print('No symlink exists at %s' % dest)
 
 class install_symlinked(install):
     def run(self):
         if sys.platform == 'win32':
             raise Exception("This doesn't work on Windows.")
 
         # Run all sub-commands (at least those that need to be run)
         for cmd_name in self.get_sub_commands():
             self.run_command(cmd_name)
     
     # 'sub_commands': a list of commands this command might have to run to
     # get its work done.  See cmd.py for more info.
     sub_commands = [('install_lib_symlink', lambda self:True),
                     ('install_scripts_sym', lambda self:True),
                    ]
 
 class install_scripts_for_symlink(install_scripts):
     """Redefined to get options from 'symlink' instead of 'install'.
     
     I love distutils almost as much as I love setuptools.
     """
     def finalize_options(self):
         self.set_undefined_options('build', ('build_scripts', 'build_dir'))
         self.set_undefined_options('symlink',
                                    ('install_scripts', 'install_dir'),
                                    ('force', 'force'),
                                    ('skip_build', 'skip_build'),
                                   )
 
 #---------------------------------------------------------------------------
 # Verify all dependencies
 #---------------------------------------------------------------------------
 
 def check_for_dependencies():
     """Check for IPython's dependencies.
 
     This function should NOT be called if running under setuptools!
     """
     from setupext.setupext import (
         print_line, print_raw, print_status,
         check_for_sphinx, check_for_pygments,
         check_for_nose, check_for_pexpect,
         check_for_pyzmq, check_for_readline,
         check_for_jinja2, check_for_tornado
     )
     print_line()
     print_raw("BUILDING IPYTHON")
     print_status('python', sys.version)
     print_status('platform', sys.platform)
     if sys.platform == 'win32':
         print_status('Windows version', sys.getwindowsversion())
 
     print_raw("")
     print_raw("OPTIONAL DEPENDENCIES")
 
     check_for_sphinx()
     check_for_pygments()
     check_for_nose()
     if os.name == 'posix':
         check_for_pexpect()
     check_for_pyzmq()
     check_for_tornado()
     check_for_readline()
     check_for_jinja2()
 
 #---------------------------------------------------------------------------
 # VCS related
 #---------------------------------------------------------------------------
 
 # utils.submodule has checks for submodule status
 execfile(pjoin('IPython','utils','submodule.py'), globals())
 
 class UpdateSubmodules(Command):
     """Update git submodules
     
     IPython's external javascript dependencies live in a separate repo.
     """
     description = "Update git submodules"
     user_options = []
     
     def initialize_options(self):
         pass
     
     def finalize_options(self):
         pass
     
     def run(self):
         failure = False
         try:
             self.spawn('git submodule init'.split())
             self.spawn('git submodule update --recursive'.split())
         except Exception as e:
             failure = e
             print(e)
         
         if not check_submodule_status(repo_root) == 'clean':
             print("submodules could not be checked out")
             sys.exit(1)
 
 
 def git_prebuild(pkg_dir, build_cmd=build_py):
     """Return extended build or sdist command class for recording commit
     
     records git commit in IPython.utils._sysinfo.commit
     
     for use in IPython.utils.sysinfo.sys_info() calls after installation.
     
     Also ensures that submodules exist prior to running
     """
     
     class MyBuildPy(build_cmd):
         ''' Subclass to write commit data into installation tree '''
         def run(self):
             build_cmd.run(self)
             # this one will only fire for build commands
             if hasattr(self, 'build_lib'):
                 self._record_commit(self.build_lib)
         
         def make_release_tree(self, base_dir, files):
             # this one will fire for sdist
             build_cmd.make_release_tree(self, base_dir, files)
             self._record_commit(base_dir)
         
         def _record_commit(self, base_dir):
             import subprocess
             proc = subprocess.Popen('git rev-parse --short HEAD',
                                     stdout=subprocess.PIPE,
                                     stderr=subprocess.PIPE,
                                     shell=True)
             repo_commit, _ = proc.communicate()
             repo_commit = repo_commit.strip().decode("ascii")
             
             out_pth = pjoin(base_dir, pkg_dir, 'utils', '_sysinfo.py')
             if os.path.isfile(out_pth) and not repo_commit:
                 # nothing to write, don't clobber
                 return
             
             print("writing git commit '%s' to %s" % (repo_commit, out_pth))
             
             # remove to avoid overwriting original via hard link
             try:
                 os.remove(out_pth)
             except (IOError, OSError):
                 pass
             with open(out_pth, 'w') as out_file:
                 out_file.writelines([
                     '# GENERATED BY setup.py\n',
                     'commit = "%s"\n' % repo_commit,
                 ])
     return require_submodules(MyBuildPy)
 
 
 def require_submodules(command):
     """decorator for instructing a command to check for submodules before running"""
     class DecoratedCommand(command):
         def run(self):
             if not check_submodule_status(repo_root) == 'clean':
                 print("submodules missing! Run `setup.py submodule` and try again")
                 sys.exit(1)
             command.run(self)
     return DecoratedCommand
 
 #---------------------------------------------------------------------------
 # bdist related
 #---------------------------------------------------------------------------
 
 def get_bdist_wheel():
     """Construct bdist_wheel command for building wheels
     
     Constructs py2-none-any tag, instead of py2.7-none-any
     """
     class RequiresWheel(Command):
         description = "Dummy command for missing bdist_wheel"
         user_options = []
 
         def initialize_options(self):
             pass
 
         def finalize_options(self):
             pass
 
         def run(self):
             print("bdist_wheel requires the wheel package")
             sys.exit(1)
 
     if 'setuptools' not in sys.modules:
         return RequiresWheel
     else:
         try:
             from wheel.bdist_wheel import bdist_wheel, read_pkg_info, write_pkg_info
         except ImportError:
             return RequiresWheel
         
         class bdist_wheel_tag(bdist_wheel):
 
             def get_tag(self):
                 return ('py%i' % sys.version_info[0], 'none', 'any')
 
             def add_requirements(self, metadata_path):
                 """transform platform-dependent requirements"""
                 pkg_info = read_pkg_info(metadata_path)
                 # pkg_info is an email.Message object (?!)
                 # we have to remove the unconditional 'readline' and/or 'pyreadline' entries
                 # and transform them to conditionals
                 requires = pkg_info.get_all('Requires-Dist')
                 del pkg_info['Requires-Dist']
                 def _remove_startswith(lis, prefix):
                     """like list.remove, but with startswith instead of =="""
                     found = False
                     for idx, item in enumerate(lis):
                         if item.startswith(prefix):
                             found = True
                             break
                     if found:
                         lis.pop(idx)
                 
                 for pkg in ("gnureadline", "pyreadline", "mock"):
                     _remove_startswith(requires, pkg)
                 requires.append("gnureadline; sys.platform == 'darwin' and platform.python_implementation == 'CPython'")
                 requires.append("pyreadline (>=2.0); sys.platform == 'win32' and platform.python_implementation == 'CPython'")
                 requires.append("mock; extra == 'test' and python_version < '3.3'")
                 for r in requires:
                     pkg_info['Requires-Dist'] = r
                 write_pkg_info(metadata_path, pkg_info)
         
         return bdist_wheel_tag
 
 #---------------------------------------------------------------------------
 # Notebook related
 #---------------------------------------------------------------------------
 
 class CompileCSS(Command):
     """Recompile Notebook CSS
     
     Regenerate the compiled CSS from LESS sources.
     
     Requires various dev dependencies, such as fabric and lessc.
     """
     description = "Recompile Notebook CSS"
     user_options = []
     
     def initialize_options(self):
         pass
     
     def finalize_options(self):
         pass
     
     def run(self):
         call("fab css", shell=True, cwd=pjoin(repo_root, "IPython", "html"))
 
 class JavascriptVersion(Command):
     """write the javascript version to notebook javascript"""
     description = "Write IPython version to javascript"
     user_options = []
     
     def initialize_options(self):
         pass
     
     def finalize_options(self):
         pass
     
     def run(self):
         nsfile = pjoin(repo_root, "IPython", "html", "static", "base", "js", "namespace.js")
         with open(nsfile) as f:
             lines = f.readlines()
         with open(nsfile, 'w') as f:
             for line in lines:
                 if line.startswith("IPython.version"):
                     line = 'IPython.version = "{0}";\n'.format(version)
                 f.write(line)