a53b9958fa734f73aeffb9ddfe2fbad1ca65f90c galt Mon Jan 30 16:18:41 2017 -0800 Check-in of CSP2 Content-Security-Policy work. All C-language CGIs should now support CSP2 in browser to stop major forms of XSS javascript injection. Javascript on pages is gathered together, and then emitted in a single script block at the end with a nonce that tells the browser, this is js that we generated instead of being injected by a hacker. Both inline script from script blocks and inline js event handlers had to be pulled out and separated. You will not see js sprinkled through-out the page now. Older browsers that support CSP1 or that do not understand CSP at all will still work, just without protection. External js libraries loaded at runtime need to be added to the CSP policy header in src/lib/htmshell.c. diff --git src/hg/lib/gtexUi.c src/hg/lib/gtexUi.c index 6dc5b62..35ef303 100644 --- src/hg/lib/gtexUi.c +++ src/hg/lib/gtexUi.c @@ -1,485 +1,486 @@ /* GTEx (Genotype Tissue Expression) track controls */ /* Copyright (C) 2015 The Regents of the University of California * See README in this or parent directory for licensing information. */ #include "cheapcgi.h" #include "cart.h" #include "hui.h" #include "trackDb.h" #include "jsHelper.h" #include "hCommon.h" #include "gtexTissue.h" #include "gtexInfo.h" #include "gtexUi.h" #define SYSTEM_BRAIN "Brain" #define SYSTEM_REPRODUCTIVE "Reproductive" #define SYSTEM_GASTRO "Digestive" #define SYSTEM_ENDOCRINE "Endocrine" #define SYSTEM_CARDIO "Cardiovascular" #define SYSTEM_OTHER "Other" /* Restrict features on right-click (popup) version */ static boolean isPopup = FALSE; /* Path to Body Map-based track configuration */ static char *_hgGtexTrackSettingsName = "../cgi-bin/hgGtexTrackSettings"; boolean gtexIsGeneTrack(char *trackName) /* Identify GTEx gene track so custom trackUi CGI can be launched */ { return startsWith(GTEX_GENE_TRACK_BASENAME, trackName); } char *gtexGeneTrackUiName() /* Refer to Body Map CGI if suitable */ { // Display body map configuration page if user is on a browser we've tested enum browserType bt = cgiBrowser(); if (bt == btChrome || bt == btFF || bt == btSafari) return(_hgGtexTrackSettingsName); return hgTrackUiName(); } /* Convenience functions for tissue filter controls */ static char *makeTissueColorPatch(struct gtexTissue *tis) /* Display a box colored by defined tissue color */ { char buf[256]; safef(buf, sizeof(buf), "
\n", orderVar, sortOrder); puts(" | "); printf(" | Tissue | ", sortableClass, onClick); printf("Samples | ", sortableClass, onClick); printf("Organ | ", sortableClass, onClick); printf("System | ", sortableClass, onClick); puts("\n
---|---|---|---|---|---|
", name, tis->name, isChecked ? "checked" : "", isPopup ? "disabled" : ""); // color patch printf("\n%s", makeTissueColorPatch(tis)); // tissue name printf("\n | %s | ", tis->description); // sample count int samples = hashIntValDefault(tscHash, tis->name, 0); printf("\n%d | ", samples, samples); // organ printf("\n%s | ", tis->organ); // system printf("\n%s | ", getSystem(tis)); puts("\n
",
isPopup ? 75 : 100, boxed ?" width='100%'":"");
char cartVar[1024];
/* Gene labels */
puts(" ");
gtexGeneUiGeneLabel(cart, track, tdb);
puts(" \n");
/* Filter on coding genes */
puts("");
gtexGeneUiCodingFilter(cart, track, tdb);
/* Show exons in gene model */
puts(" ");
gtexGeneUiGeneModel(cart, track, tdb);
puts(" ");
/* Data transform. When selected, the next control (view limits max) is disabled */
puts("");
gtexGeneUiLogTransform(cart, track, tdb);
/* Viewing limits max. This control is disabled if log transform is selected */
// construct class so JS can toggle
puts(" ");
gtexGeneUiViewLimits(cart, track, tdb);
puts(" ");
#ifdef COMPARISON
/* Sample selection */
printf("Samples: ");
safef(cartVar, sizeof(cartVar), "%s.%s", track, GTEX_SAMPLES);
char *selected = cartCgiUsualString(cart, cartVar, GTEX_SAMPLES_DEFAULT);
boolean isAllSamples = sameString(selected, GTEX_SAMPLES_ALL);
-safef(buf, sizeof buf, "onchange='gtexSamplesChanged(\"%s\")'", track);
+safef(buf, sizeof buf, "gtexSamplesChanged(\"%s\");", track);
char *command = buf;
-cgiMakeOnClickRadioButton(cartVar, GTEX_SAMPLES_ALL, isAllSamples, command);
+cgiMakeOnEventRadioButtonWithClass(cartVar, GTEX_SAMPLES_ALL, isAllSamples, NULL, "change", command);
printf("All\n");
-cgiMakeOnClickRadioButton(cartVar, GTEX_SAMPLES_COMPARE_SEX, !isAllSamples, command);
+cgiMakeOnEventRadioButtonWithClass(cartVar, GTEX_SAMPLES_COMPARE_SEX, !isAllSamples, NULL, "change", command);
printf("Compare by gender\n");
printf(" ");
/* Comparison type. Disabled if All samples selected. */
safef(buf, sizeof buf, "%sComparisonLabel %s", track, isAllSamples ? "disabled" : "");
printf("Comparison display:", buf);
safef(cartVar, sizeof(cartVar), "%s.%s", track, GTEX_COMPARISON_DISPLAY);
selected = cartCgiUsualString(cart, cartVar, GTEX_COMPARISON_DEFAULT);
boolean isMirror = sameString(selected, GTEX_COMPARISON_MIRROR);
cgiMakeRadioButton(cartVar, GTEX_COMPARISON_DIFF, !isMirror);
printf("Difference graph", buf);
cgiMakeRadioButton(cartVar, GTEX_COMPARISON_MIRROR, isMirror);
printf("Two graphs\n", buf);
printf(" ");
#endif
/* Color scheme */
// We don't need the rainbow color scheme, but may want another (e.g. different
// colors for brain tissues), so leaving code in for now.
#ifdef COLOR_SCHEME
printf("Tissue colors:\n"); safef(cartVar, sizeof(cartVar), "%s.%s", track, GTEX_COLORS); selected = cartCgiUsualString(cart, cartVar, GTEX_COLORS_DEFAULT); boolean isGtexColors = sameString(selected, GTEX_COLORS_GTEX); cgiMakeRadioButton(cartVar, GTEX_COLORS_GTEX, isGtexColors); printf("GTEx\n"); cgiMakeRadioButton(cartVar, GTEX_COLORS_RAINBOW, !isGtexColors); printf("Rainbow\n"); printf(" "); #endif /* Tissue filter */ printf(""); printf(" Tissues:\n");
safef(cartVar, sizeof(cartVar), "%s.%s", track, GTEX_TISSUE_SELECT);
if (isPopup)
{
printf("",
hTrackUiForTrack(track), track);
}
else
{
jsMakeCheckboxGroupSetClearButton(cartVar, TRUE);
puts(" ");
jsMakeCheckboxGroupSetClearButton(cartVar, FALSE);
}
printf(" ");
char *version = gtexVersion(tdb->table);
struct gtexTissue *tissues = gtexGetTissues(version);
struct slName *selectedValues = NULL;
if (cartListVarExistsAnyLevel(cart, tdb, FALSE, GTEX_TISSUE_SELECT))
selectedValues = cartOptionalSlNameListClosestToHome(cart, tdb, FALSE, GTEX_TISSUE_SELECT);
char *selectType = cgiUsualString("tis", "table");
if (sameString(selectType, "group"))
makeGroupedTissueCheckboxes(cartVar, tissues, selectedValues);
else if (sameString(selectType, "table"))
makeTableTissueCheckboxes(cartVar, tissues, selectedValues, cart, track, version);
else
makeAllTissueCheckboxes(cartVar, tissues, selectedValues);
puts("\n |