Merge pull request #15 from girder/user-creation

Guard against creation of files under user

CHANGELOG.rst

@@ -0,0 +1,40 @@
+=============
+Release Notes
+=============
+
+This is the summary list of changes to girder_jupyter between each release. For full
+details, see the commit logs at https://github.com/girder/girder_jupyter
+
+Unreleased
+==========
+
+Added Features
+--------------
+
+Bug fixes
+---------
+
+Changes
+-------
+
+Deprecations
+------------
+
+DevOps
+------
+
+Removals
+--------
+
+Security Fixes
+--------------
+
+
+girder_jupyter 0.2.0
+====================
+
+
+Bug fixes
+---------
+
+* Guard against file creation under a user.

girder_jupyter/contents/manager.py

@@ -409,7 +409,10 @@ def _upload_to_path(self, content, mime_type, format, path):
 
         parent = self._create_folders('/'.join(folder_path))
 
-        if self._is_item(parent):
+        if self._is_user(parent):
+            raise web.HTTPError(400, 'Can\'t create file under user.',
+                                reason='Can\'t create file under user.')
+        elif self._is_item(parent):
             item = parent
         else:
             item = self.gc.loadOrCreateItem(name, parent['_id'], reuseExisting=True)