f8b16feaacf8742673d634e6584ddd37ca5caa2a galt Thu Feb 2 14:13:51 2017 -0800 Fixing missing ajax transfer in hgTracks popup hgTrackUi js. Note this should basically pick up the equivalent of inline event handlers like onclick= stuff. diff --git src/hg/js/hgTracks.js src/hg/js/hgTracks.js index 951d9f7..9c71faa 100644 --- src/hg/js/hgTracks.js +++ src/hg/js/hgTracks.js @@ -3488,42 +3488,61 @@ var urlData = cart.varsToUrlData(changedVars); if (imageV2.mapIsUpdateable) { imageV2.requestImgUpdate(trackName,urlData,""); } else { window.location = "../cgi-bin/hgTracks?" + urlData + "&hgsid=" + getHgsid(); } } } } }, uiDialog: function (response, status) { // Take html from hgTrackUi and put it up as a modal dialog. - //alert("Got here popUp.uiDialog"); // DEBUG REMOVE GALT + var pageNonce = getNonce(); + alert('pageNonce='+pageNonce); // DEBUG REMOVE + + var ajaxNonce = stripNonce(response, false); + alert('ajaxNonce='+ajaxNonce); // DEBUG REMOVE + + var jsNonce = stripJsNonce(response, ajaxNonce, false);// DEBUG msg with true // make sure all links (e.g. help links) open up in a new window response = response.replace(/<a /ig, "<a target='_blank' "); var cleanHtml = response; cleanHtml = stripJsFiles(cleanHtml,false); // DEBUG msg with true cleanHtml = stripCssFiles(cleanHtml,false); // DEBUG msg with true cleanHtml = stripJsEmbedded(cleanHtml,false);// DEBUG msg with true //alert(cleanHtml); // DEBUG REMOVE $('#hgTrackUiDialog').html("<div id='pop' style='font-size:.9em;'>"+ cleanHtml +"</div>"); + // append ajax js blocks with nonce + var i; + for (i=0; i<jsNonce.length; ++i) { + var sTag = document.createElement("script"); + sTag.type = "text/javascript"; + sTag.text = jsNonce[i]; + sTag.setAttribute('nonce', pageNonce); // CSP2 Requires + + alert("about to call appendChild on:\n"+jsNonce[i]); + + document.head.appendChild(sTag); + } + // Strategy for popups with js: // - jsFiles and CSS should not be included in html. Here they are shluped out. // - The resulting files ought to be loadable dynamically (with getScript()), // but this was not working nicely with the modal dialog // Therefore include files must be included with hgTracks CGI ! // - embedded js should not be in the popup box. // - Somethings should be in a popup.ready() function, and this is emulated below, // as soon as the cleanHtml is added // Since there are many possible popup cfg dialogs, the ready should be all inclusive. if ( ! popUp.trackDescriptionOnly ) { // If subtrack then vis rules differ var subtrack = tdbIsSubtrack(hgTracks.trackDb[popUp.trackName]) ? popUp.trackName :""; // Saves the original vars (and vals) that may get changed by the popup cfg. popUp.saveAllVars = getAllVars( $('#hgTrackUiDialog'), subtrack );