Skip to content

add notebook loader and custom template#211

Open
lzfxxx wants to merge 2 commits into
jonashaag:masterfrom
momodel:add_notebook_loader
Open

add notebook loader and custom template#211
lzfxxx wants to merge 2 commits into
jonashaag:masterfrom
momodel:add_notebook_loader

Conversation

@lzfxxx
Copy link
Copy Markdown

@lzfxxx lzfxxx commented Jun 12, 2018

No description provided.

@lzfxxx
Copy link
Copy Markdown
Author

lzfxxx commented Jun 12, 2018

Related reviews are in origin pull request #210 (which mixed some unrelated changes, so I closed it)

Comment thread klaus/markup.py Outdated

def render_notebook(content):
nb = nbformat.reads(content, nbformat.NO_CONVERT)
(output, resources) = nbconvert.HTMLExporter(template_file='./klaus/templates/my_full.tpl').from_notebook_node(nb)
Copy link
Copy Markdown
Author

@lzfxxx lzfxxx Jun 12, 2018

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Moved from #210
jonashaag: my_full? Confusing name :-D

lzfxxx: It's just a little CSS modification of nbconvert template 'full', cause the width in @media setting of that template will make the html overflow the markup div. The naming is not very clear, do you have any suggestions?

jonashaag: I see! In this case could we simply use the default template and add the CSS fixes to klaus' CSS file? Or if that doesn't work, can we use inheritance to override the CSS instead of copy-pasting the whole file?

Copy link
Copy Markdown
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

fixed

@lzfxxx
Copy link
Copy Markdown
Author

lzfxxx commented Jun 12, 2018

Moved from #210
jonashaag:
In terms of security, XSS problems are possible at the least. So we have to account for that. Two ideas:

  • Apply a very restrictive Content Security Policy for the whole klaus application, and have 2 versions of .ipynb file viewer: a normal CSP-enabled version, and a a CSP-disabled version. We could toggle between them with a simple URL param e.g. ?nocsp.
  • Maybe we can use this SanitizeHTML preprocessor, haven't looked at it closely. Also we could have two versions of the viewer page, one which strips all <script>, <style>, <object> etc tags, and another one where everything is allowed.

(cherry picked from commit 8d91705)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants