a53b9958fa734f73aeffb9ddfe2fbad1ca65f90c
galt
  Mon Jan 30 16:18:41 2017 -0800
Check-in of CSP2 Content-Security-Policy work. All C-language CGIs should now support CSP2 in browser to stop major forms of XSS javascript injection. Javascript on pages is gathered together, and then emitted in a single script block at the end with a nonce that tells the browser, this is js that we generated instead of being injected by a hacker. Both inline script from script blocks and inline js event handlers had to be pulled out and separated. You will not see js sprinkled through-out the page now. Older browsers that support CSP1 or that do not understand CSP at all will still work, just without protection. External js libraries loaded at runtime need to be added to the CSP policy header in src/lib/htmshell.c.

diff --git src/hg/hgTracks/searchTracks.c src/hg/hgTracks/searchTracks.c
index 75915e0..5269f8d 100644
--- src/hg/hgTracks/searchTracks.c
+++ src/hg/hgTracks/searchTracks.c
@@ -326,87 +326,101 @@
 #define MAX_FOUND_TRACKS 100
 static void findTracksPageLinks(int tracksFound, int startFrom)
 {
 if (tracksFound <= MAX_FOUND_TRACKS)
     return;
 
 // Opener
 int willStartAt = 0;
 int curPage  = (startFrom/MAX_FOUND_TRACKS) + 1;
 int endAt = startFrom+MAX_FOUND_TRACKS;
 if (endAt > tracksFound)
     endAt = tracksFound;
 hPrintf("<span><em style='font-size:.9em;'>Listing %d - %d of %d tracks</em>&nbsp;&nbsp;&nbsp;",
         startFrom+1,endAt,tracksFound);
 
+char javascript[1024];
 // << and <
 if (startFrom >= MAX_FOUND_TRACKS)
     {
-    hPrintf("<a href='../cgi-bin/hgTracks?%s=Search&%s=0' title='First page of found tracks' "
-            "onclick='return findTracks.page(\"%s\",0);'>&#171;</a>&nbsp;",
-            TRACK_SEARCH,TRACK_SEARCH_PAGER,TRACK_SEARCH_PAGER);
+    hPrintf("<a href='../cgi-bin/hgTracks?%s=Search&%s=0' id='ftpl1' title='First page of found tracks'"
+	    ">&#171;</a>&nbsp;",
+            TRACK_SEARCH,TRACK_SEARCH_PAGER);
+    safef(javascript, sizeof javascript, "return findTracks.page(\"%s\",0);", TRACK_SEARCH_PAGER);
+    jsOnEventById("click", "ftpl1", javascript);
+
     willStartAt = startFrom - MAX_FOUND_TRACKS;
-    hPrintf("&nbsp;<a href='../cgi-bin/hgTracks?%s=Search&%s=%d' title='Previous page of found "
-            "tracks' onclick='return findTracks.page(\"%s\",%d);'>&#139;</a>&nbsp;",
-            TRACK_SEARCH,TRACK_SEARCH_PAGER,willStartAt,TRACK_SEARCH_PAGER,willStartAt);
+    hPrintf("&nbsp;<a href='../cgi-bin/hgTracks?%s=Search&%s=%d' id='ftpl2' "
+	"title='Previous page of found tracks'>&#139;</a>&nbsp;",
+            TRACK_SEARCH,TRACK_SEARCH_PAGER,willStartAt);
+    safef(javascript, sizeof javascript, "return findTracks.page(\"%s\",%d);", TRACK_SEARCH_PAGER,willStartAt);
+    jsOnEventById("click", "ftpl2", javascript);
     }
 
 // page number links
 int lastPage = (tracksFound/MAX_FOUND_TRACKS);
 if ((tracksFound % MAX_FOUND_TRACKS) > 0)
     lastPage++;
 
 int thisPage = curPage - 3; // Window of 3 pages above and below
 if (thisPage < 1)
     thisPage = 1;
 for (;thisPage <= lastPage && thisPage <= curPage + 3; thisPage++)
     {
     if (thisPage != curPage)
         {
         willStartAt = ((thisPage - 1) * MAX_FOUND_TRACKS);
         endAt = willStartAt+ MAX_FOUND_TRACKS;
         if (endAt > tracksFound)
             endAt = tracksFound;
-        hPrintf("&nbsp;<a href='../cgi-bin/hgTracks?%s=Search&%s=%d' title='Page %d (%d - %d) "
-                "tracks' onclick='return findTracks.page(\"%s\",%d);'>%d</a>&nbsp;",
-                TRACK_SEARCH,TRACK_SEARCH_PAGER,willStartAt,thisPage,willStartAt+1,endAt,
-                TRACK_SEARCH_PAGER,willStartAt,thisPage);
+        hPrintf("&nbsp;<a href='../cgi-bin/hgTracks?%s=Search&%s=%d' id='ftpl3' "
+		"title='Page %d (%d - %d) tracks'>%d</a>&nbsp;",
+                TRACK_SEARCH,TRACK_SEARCH_PAGER,willStartAt,thisPage,willStartAt+1,endAt,thisPage);
+	safef(javascript, sizeof javascript, "return findTracks.page(\"%s\",%d);",TRACK_SEARCH_PAGER,willStartAt);
+	jsOnEventById("click", "ftpl3", javascript);
         }
     else
         hPrintf("&nbsp;<em style='color:%s;'>%d</em>&nbsp;",COLOR_DARKGREY,thisPage);
     }
 
 // > and >>
 if ((startFrom + MAX_FOUND_TRACKS) < tracksFound)
     {
     willStartAt = startFrom + MAX_FOUND_TRACKS;
-    hPrintf("&nbsp;<a href='../cgi-bin/hgTracks?%s=Search&%s=%d' title='Next page of found tracks' "
-            "onclick='return findTracks.page(\"%s\",%d);'>&#155;</a>&nbsp;",
-            TRACK_SEARCH,TRACK_SEARCH_PAGER,willStartAt,TRACK_SEARCH_PAGER,willStartAt);
+    hPrintf("&nbsp;<a href='../cgi-bin/hgTracks?%s=Search&%s=%d' id='ftpl4' "
+	"title='Next page of found tracks'>&#155;</a>&nbsp;",
+	TRACK_SEARCH,TRACK_SEARCH_PAGER,willStartAt);
+    safef(javascript, sizeof javascript, "return findTracks.page(\"%s\",%d);",TRACK_SEARCH_PAGER,willStartAt);
+    jsOnEventById("click", "ftpl4", javascript);
+	    
     willStartAt =  tracksFound - (tracksFound % MAX_FOUND_TRACKS);
     if (willStartAt == tracksFound)
         willStartAt -= MAX_FOUND_TRACKS;
-    hPrintf("&nbsp;<a href='../cgi-bin/hgTracks?%s=Search&%s=%d' title='Last page of found tracks' "
-            "onclick='return findTracks.page(\"%s\",%d);'>&#187;</a></span>\n",
-            TRACK_SEARCH,TRACK_SEARCH_PAGER,willStartAt,TRACK_SEARCH_PAGER,willStartAt);
+    hPrintf("&nbsp;<a href='../cgi-bin/hgTracks?%s=Search&%s=%d' id='ftpl5' title='Last page of found tracks' "
+	    ">&#187;</a></span>\n",
+            TRACK_SEARCH,TRACK_SEARCH_PAGER,willStartAt);
+    safef(javascript, sizeof javascript, "return findTracks.page(\"%s\",%d);",TRACK_SEARCH_PAGER,willStartAt);
+    jsOnEventById("click", "ftpl5", javascript);
     }
 }
 
 static void displayFoundTracks(struct cart *cart, struct slRef *tracks, int tracksFound,
                                enum sortBy sortBy)
 // Routine for displaying found tracks
 {
+char id[256];
+char javascript[1024];
 hPrintf("<div id='found' style='display:none;'>\n"); // This div is emptied with 'clear' button
 if (tracksFound < 1)
     {
     hPrintf("<p>No tracks found</p>\n");
     }
 else
     {
     hPrintf("<form action='%s' name='%s' id='%s' method='post'>\n\n",
             hgTracksName(),SEARCH_RESULTS_FORM,SEARCH_RESULTS_FORM);
     cartSaveSession(cart);  // Creates hidden var of hgsid to avoid bad voodoo
 
     int startFrom = 0;
     hPrintf("<table id='foundTracks'>\n");
 
     // Opening view in browser button and foundTracks count
@@ -427,48 +441,52 @@
                 if (slPopHead(&tracks) == NULL) // memory waste
                     break;
                 }
             }
         hPrintf("</td><td align='right' valign='bottom'>\n");
         findTracksPageLinks(tracksFound,startFrom);
         hPrintf("</td></tr>\n");
         }
 
     // Begin foundTracks table
     //hPrintf("<table id='foundTracks'><tr><td colspan='2'>\n");
     hPrintf("<tr><td colspan='2'>\n");
     hPrintf("</td><td align='right'>\n");
     hPrintf("</td></tr><tr bgcolor='#%s'><td>",HG_COL_HEADER);
     #define PM_BUTTON \
-            "<IMG height=18 width=18 onclick=\"return findTracks.checkAllWithWait(%s);\" " \
+            "<IMG height=18 width=18 " \
             "id='btn_%s' src='../images/%s' title='%s all found tracks'>"
-    hPrintf(PM_BUTTON,"true",  "plus_all",   "add_sm.gif",  "Select");
-    hPrintf(PM_BUTTON,"false","minus_all","remove_sm.gif","Unselect");
+    hPrintf(PM_BUTTON,"plus_all",   "add_sm.gif",  "Select");
+    hPrintf(PM_BUTTON,"minus_all","remove_sm.gif","Unselect");
+    safef(javascript, sizeof javascript, "return findTracks.checkAllWithWait(true);");  
+    jsOnEventById("click", "btn_plus_all", javascript);
+    safef(javascript, sizeof javascript, "return findTracks.checkAllWithWait(false);");  
+    jsOnEventById("click", "btn_minus_all", javascript);
     hPrintf("</td><td><b>Visibility</b></td><td colspan=2>&nbsp;&nbsp;<b>Track Name</b>\n");
 
     // Sort options?
     if (tracksFound >= ENOUGH_FOUND_TRACKS)
         {
         hPrintf("<span style='float:right;'>Sort:");
-        cgiMakeOnClickRadioButton(TRACK_SEARCH_SORT, "0", (sortBy == sbRelevance),
-                                  "onclick=\"findTracks.sortNow(this);\"");
+        cgiMakeOnEventRadioButtonWithClass(TRACK_SEARCH_SORT, "0", (sortBy == sbRelevance), 
+	    NULL,"click", "findTracks.sortNow(this);");
         hPrintf("by Relevance");
-        cgiMakeOnClickRadioButton(TRACK_SEARCH_SORT, "1", (sortBy == sbAbc),
-                                  "onclick=\"findTracks.sortNow(this);\"");
+        cgiMakeOnEventRadioButtonWithClass(TRACK_SEARCH_SORT, "1", (sortBy == sbAbc), 
+	    NULL,"click", "findTracks.sortNow(this);");
         hPrintf("Alphabetically");
-        cgiMakeOnClickRadioButton(TRACK_SEARCH_SORT, "2",(sortBy == sbHierarchy),
-                                  "onclick=\"findTracks.sortNow(this);\"");
+        cgiMakeOnEventRadioButtonWithClass(TRACK_SEARCH_SORT, "2", (sortBy == sbHierarchy), 
+	    NULL,"click", "findTracks.sortNow(this);");
         hPrintf("by Hierarchy&nbsp;&nbsp;</span>\n");
         }
     hPrintf("</td></tr>\n");
 
     // Set up json for js functionality
     struct jsonElement *jsonTdbVars = newJsonObject(newHash(8));
 
     int trackCount=0;
     boolean containerTrackCount = 0;
     struct slRef *ptr;
     while((ptr = slPopHead(&tracks)))
         {
         if (++trackCount > MAX_FOUND_TRACKS)
             break;
 
@@ -488,80 +506,87 @@
         track->visibility = tdbVisLimitedByAncestors(cart, track->tdb, TRUE, TRUE);
         boolean checked = ( track->visibility != tvHide );
         if (tdbIsContainerChild(track->tdb))
             {
             // Don't need all 4 states here.  Visible=checked&&enabled
             checked = fourStateVisible(subtrackFourStateChecked(track->tdb,cart));
             // Checked is only if subtrack level vis is also set!
             checked = (checked && ( track->visibility != tvHide ));
             }
 
         // Setup the check box
         #define CB_HIDDEN_VAR "<INPUT TYPE=HIDDEN disabled=true NAME='%s_sel' VALUE='%s'>"
         // subtracks and folder children get "_sel" var. ("_sel" var is temp on folder children)
         if (tdbIsContainerChild(track->tdb) || tdbIsFolderContent(track->tdb))
             hPrintf(CB_HIDDEN_VAR,track->track,checked?"1":CART_VAR_EMPTY);
-        #define CB_SEEN "<INPUT TYPE=CHECKBOX id='%s_sel_id' VALUE='on' class='selCb' " \
-                        "onclick='findTracks.clickedOne(this,true);'%s>"
+        #define CB_SEEN "<INPUT TYPE=CHECKBOX id='%s_sel_id' VALUE='on' class='selCb' %s>"
         hPrintf(CB_SEEN,track->track,(checked ? " CHECKED" : ""));
+	safef(id, sizeof id, "%s_sel_id", track->track); // XSS Filter?
+	safef(javascript, sizeof javascript, "findTracks.clickedOne(this,true);");  
+	jsOnEventById("click", id, javascript);
         hPrintf("</td><td>\n");
 
         // Setup the visibility drop down
         #define VIS_HIDDEN_VAR "<INPUT TYPE=HIDDEN disabled=true NAME='%s' VALUE='%s'>"
         hPrintf(VIS_HIDDEN_VAR,track->track,CART_VAR_EMPTY); // All tracks get vis hidden var
-        char extra[512];
         if (tdbIsFolder(track->tdb))
             {
-            safef(extra,sizeof(extra),"id='%s_id' onchange='findTracks.changeVis(this)'",
-                  track->track);
+	    safef(javascript, sizeof javascript, "findTracks.changeVis(this);");
+            struct slPair *event = slPairNew("change", cloneString(javascript));
             hideShowDropDownWithClassAndExtra(track->track, (track->visibility != tvHide),
-                                              "normalText visDD",extra);
+                                              "normalText visDD", event);
             }
         else
             {
-            safef(extra,sizeof(extra),"id='%s_id' onchange='findTracks.changeVis(this)'",
-                  track->track);
+	    safef(javascript, sizeof javascript, "findTracks.changeVis(this);");
+            struct slPair *event = slPairNew("change", cloneString(javascript));
             hTvDropDownClassWithJavascript(NULL, track->visibility,track->canPack,
-                                           "normalText seenVis",extra);
+                                           "normalText seenVis",event);
             }
 
         // If this is a container track, allow configuring...
         if (tdbIsContainer(track->tdb) || tdbIsFolder(track->tdb))
             {
             containerTrackCount++; // Using onclick ensures return to search tracks on submit
             hPrintf("&nbsp;<IMG SRC='../images/folderWrench.png' style='cursor:pointer;' "
-                    "title='Configure this track container...' "
-                    "onclick='findTracks.configSet(\"%s\");'>&nbsp;", track->track);
+                    "id='%s_confSet' title='Configure this track container...' "
+                    ">&nbsp;", track->track);
+	    safef(id, sizeof id, "%s_confSet", track->track); // XSS Filter?
+	    safef(javascript, sizeof javascript, "findTracks.configSet(\"%s\");", track->track);  
+	    jsOnEventById("click", id, javascript);
             }
 //#define SHOW_PARENT_FOLDER
 #ifdef SHOW_PARENT_FOLDER
         else if (tdbIsContainerChild(track->tdb) || tdbIsFolderContent(track->tdb))
             {
             struct trackDb *parentTdb =
                             tdbIsContainerChild(track->tdb) ? tdbGetContainer(track->tdb)
                                                             : tdbGetImmediateFolder(track->tdb);
             if (parentTdb != NULL) // Using href will not return to search tracks on submit
                 hPrintf("&nbsp;<A HREF='../cgi-bin/hgTrackUi?g=%s'><IMG SRC='../images/folderC.png'"
                         " title='Navigate to parent container...'></A>&nbsp;", parentTdb->track);
             }
 #endif///def SHOW_PARENT_FOLDER
         hPrintf("</td>\n");
 
         // shortLabel has description popup and longLabel has "..." metadata
-        hPrintf("<td><a target='_top' onclick=\"popUp.hgTrackUi('%s',true); return false;\" "
+        hPrintf("<td><a target='_top' id='%s_dispFndTrk' "
                 "href='%s' title='Display track details'>%s</a></td>\n",
                 track->track, trackUrl(track->track, NULL), track->shortLabel);
+	safef(id, sizeof id, "%s_dispFndTrk", track->track);
+	safef(javascript, sizeof javascript, "popUp.hgTrackUi('%s',true); return false;", track->track);
+	jsOnEventById("click", id, javascript);
         hPrintf("<td>%s", track->longLabel);
         compositeMetadataToggle(database, track->tdb, NULL, TRUE, FALSE);
         hPrintf("</td></tr>\n");
         }
     //hPrintf("</table>\n");
 
     // Closing view in browser button and foundTracks count
     hPrintf("<tr><td nowrap colspan=3>");
     hPrintf("<INPUT TYPE=SUBMIT NAME='submit' VALUE='Return to Browser' class='viewBtn' "
             "style='font-size:.8em;'>");
     hPrintf("&nbsp;&nbsp;&nbsp;&nbsp;<span class='selCbCount'></span>");
     if (tracksFound >= ENOUGH_FOUND_TRACKS)
         {
         hPrintf("</td><td align='right' valign='top'>\n");
         findTracksPageLinks(tracksFound,startFrom);
@@ -575,30 +600,31 @@
                 "(by clicking on the <IMG SRC='../images/folderWrench.png'> icon) before they can "
                 "be viewed in the browser.<BR>\n");
         //hPrintf("* Tracks so marked are containers which group related data tracks.  These may "
         //        "not be visible unless further configuration is done.  Click on the * to "
         //        "configure these.<BR><BR>\n");
     hPrintf("\n</form>\n");
 
     // be done with json
     jsonTdbSettingsUse(jsonTdbVars);
     }
 hPrintf("</div>"); // This div allows the clear button to empty it
 }
 
 void doSearchTracks(struct group *groupList)
 {
+char javascript[1024];
 webIncludeResourceFile("ui.dropdownchecklist.css");
 jsIncludeFile("ui.dropdownchecklist.js",NULL);
 // This line is needed to get the multi-selects initialized
 jsIncludeFile("ddcl.js",NULL);
 
 struct group *group;
 char *groups[128];
 char *labels[128];
 int numGroups = 1;
 groups[0] = ANYLABEL;
 labels[0] = ANYLABEL;
 char *nameSearch  = cartOptionalString(cart, TRACK_SEARCH_ON_NAME);
 char *typeSearch  = cartUsualString(   cart, TRACK_SEARCH_ON_TYPE,ANYLABEL);
 char *simpleEntry = cartOptionalString(cart, TRACK_SEARCH_SIMPLE);
 char *descSearch  = cartOptionalString(cart, TRACK_SEARCH_ON_DESCR);
@@ -658,109 +684,118 @@
 hPrintf("<input type='hidden' name='%s' id='currentTab' value='%s'>\n",
         TRACK_SEARCH_CURRENT_TAB, currentTab);
 hPrintf("<input type='hidden' name='%s' value=''>\n",TRACK_SEARCH_DEL_ROW);
 hPrintf("<input type='hidden' name='%s' value=''>\n",TRACK_SEARCH_ADD_ROW);
 hPrintf("<input type='hidden' name='%s' value=''>\n",TRACK_SEARCH_PAGER);
 
 hPrintf("<div id='tabs' style='display:none; %s'>\n<ul>\n<li><a href='#simpleTab'>"
         "<B style='font-size:.9em;font-family: arial, Geneva, Helvetica, san-serif;'>Search</B>"
         "</a></li>\n<li><a href='#advancedTab'>"
         "<B style='font-size:.9em;font-family: arial, Geneva, Helvetica, san-serif;'>Advanced</B>"
         "</a></li>\n</ul>\n<div id='simpleTab' style='max-width:inherit;'>\n",
         cgiBrowser()==btIE?"width:1060px;":"max-width:inherit;");
 
 hPrintf("<table id='simpleTable' style='width:100%%; font-size:.9em;'><tr><td colspan='2'>");
 hPrintf("<input type='text' name='%s' id='simpleSearch' class='submitOnEnter' value='%s' "
-        "style='max-width:1000px; width:100%%;' onkeyup='findTracks.searchButtonsEnable(true);'>\n",
+        "style='max-width:1000px; width:100%%;'>\n",
         TRACK_SEARCH_SIMPLE,simpleEntry == NULL ? "" : simpleEntry);
+safef(javascript, sizeof javascript, "findTracks.searchButtonsEnable(true);");
+jsOnEventById("keyup", "simpleSearch", javascript);
 
 hPrintf("</td></tr><td style='max-height:4px;'></td></tr></table>");
 //hPrintf("</td></tr></table>");
 hPrintf("<input type='submit' name='%s' id='searchSubmit' value='search' "
         "style='font-size:.8em;'>\n", TRACK_SEARCH);
-hPrintf("<input type='button' name='clear' value='clear' class='clear' "
-        "style='font-size:.8em;' onclick='findTracks.clear();'>\n");
+hPrintf("<input type='button'id='doSTClear1' name='clear' value='clear' class='clear' "
+        "style='font-size:.8em;'>\n");
+safef(javascript, sizeof javascript, "findTracks.clear();");
+jsOnEventById("click", "doSTClear1", javascript);
 hPrintf("<input type='submit' name='submit' value='cancel' class='cancel' "
         "style='font-size:.8em;'>\n");
 hPrintf("</div>\n");
 
 // Advanced tab
 hPrintf("<div id='advancedTab' style='width:inherit;'>\n"
         "<table id='advancedTable' cellSpacing=0 style='width:inherit; font-size:.9em;'>\n");
 cols = 8;
 
 // Track Name contains
 hPrintf("<tr><td colspan=3></td>");
 hPrintf("<td nowrap><b style='max-width:100px;'>Track&nbsp;Name:</b></td>");
 hPrintf("<td align='right'>contains</td>\n");
 hPrintf("<td colspan='%d'>", cols - 4);
 hPrintf("<input type='text' name='%s' id='nameSearch' class='submitOnEnter' value='%s' "
-        "onkeyup='findTracks.searchButtonsEnable(true);' style='min-width:326px; font-size:.9em;'>",
+        "style='min-width:326px; font-size:.9em;'>",
         TRACK_SEARCH_ON_NAME, nameSearch == NULL ? "" : nameSearch);
+safef(javascript, sizeof javascript, "findTracks.searchButtonsEnable(true);");
+jsOnEventById("keyup", "nameSearch", javascript);
 hPrintf("</td></tr>\n");
 
 // Description contains
 hPrintf("<tr><td colspan=2></td><td align='right'>and&nbsp;</td>");
 hPrintf("<td><b style='max-width:100px;'>Description:</b></td>");
 hPrintf("<td align='right'>contains</td>\n");
 hPrintf("<td colspan='%d'>", cols - 4);
 hPrintf("<input type='text' name='%s' id='descSearch' value='%s' class='submitOnEnter' "
-        "onkeyup='findTracks.searchButtonsEnable(true);' "
         "style='max-width:536px; width:536px; font-size:.9em;'>",
         TRACK_SEARCH_ON_DESCR, descSearch == NULL ? "" : descSearch);
+safef(javascript, sizeof javascript, "findTracks.searchButtonsEnable(true);");
+jsOnEventById("keyup", "descSearch", javascript);
 hPrintf("</td></tr>\n");
 
 hPrintf("<tr><td colspan=2></td><td align='right'>and&nbsp;</td>\n");
 hPrintf("<td><b style='max-width:100px;'>Group:</b></td>");
 hPrintf("<td align='right'>is</td>\n");
 hPrintf("<td colspan='%d'>", cols - 4);
-cgiMakeDropListFull(TRACK_SEARCH_ON_GROUP, labels, groups, numGroups, groupSearch,
-                    "class='groupSearch' style='min-width:40%; font-size:.9em;'");
+cgiMakeDropListFullExt(TRACK_SEARCH_ON_GROUP, labels, groups, numGroups, groupSearch,
+    NULL, NULL, "min-width:40%; font-size:.9em;", "groupSearch");
 hPrintf("</td></tr>\n");
 
 // Track Type is (drop down)
 hPrintf("<tr><td colspan=2></td><td align='right'>and&nbsp;</td>\n");
 hPrintf("<td nowrap><b style='max-width:100px;'>Data Format:</b></td>");
 hPrintf("<td align='right'>is</td>\n");
 hPrintf("<td colspan='%d'>", cols - 4);
 char **formatTypes = NULL;
 char **formatLabels = NULL;
 int formatCount = getFormatTypes(&formatLabels, &formatTypes);
-cgiMakeDropListFull(TRACK_SEARCH_ON_TYPE, formatLabels, formatTypes, formatCount, typeSearch,
-                    "class='typeSearch' style='min-width:40%; font-size:.9em;'");
+cgiMakeDropListFullExt(TRACK_SEARCH_ON_TYPE, formatLabels, formatTypes, formatCount, typeSearch,
+    NULL, NULL, "'min-width:40%; font-size:.9em;", "typeSearch");
 hPrintf("</td></tr>\n");
 
 // mdb selects
 struct slPair *mdbSelects = NULL;
 if (metaDbExists)
     {
     struct slPair *mdbVars = mdbVarsSearchable(conn,TRUE,FALSE); // Tables but not file only objects
     mdbSelects = mdbSelectPairs(cart, mdbVars);
     char *output = mdbSelectsHtmlRows(conn,mdbSelects,mdbVars,cols,FALSE);  // not a fileSearch
     if (output)
         {
         puts(output);
         freeMem(output);
         }
     slPairFreeList(&mdbVars);
     }
 
 hPrintf("</table>\n");
 hPrintf("<input type='submit' name='%s' id='searchSubmit' value='search' "
         "style='font-size:.8em;'>\n", TRACK_SEARCH);
-hPrintf("<input type='button' name='clear' value='clear' class='clear' "
-        "style='font-size:.8em;' onclick='findTracks.clear();'>\n");
+hPrintf("<input type='button' id='doSTClear2' name='clear' value='clear' class='clear' "
+        "style='font-size:.8em;'>\n");
+safef(javascript, sizeof javascript, "findTracks.clear();");
+jsOnEventById("click", "doSTClear2", javascript);
 hPrintf("<input type='submit' name='submit' value='cancel' class='cancel' "
         "style='font-size:.8em;'>\n");
 //hPrintf("<a target='_blank' href='../goldenPath/help/trackSearch.html'>help</a>\n");
 hPrintf("</div>\n");
 
 hPrintf("</div>\n");
 
 hPrintf("</form>\n");
 hPrintf("</div>"); // Restricts to max-width:1000px;
 cgiDown(0.8);
 
 if (measureTiming)
     measureTime("Rendered tabs");
 
 if (doSearch)