156dbcfc96c9a4a5eba481f8d979700b0ca1024e
galt
  Mon Feb 3 06:28:18 2025 -0800
Fixing security concern in hgEncodeVocab. fixes #287. Note that actual full cleanup by removing the unneeded encode/cv.ra from trackDb files has not been done yet., and making the code tolerate its presence or absence in the trackDb.ra files, at the start of the controlledVocabulary setting.

diff --git src/hg/inc/hui.h src/hg/inc/hui.h
index 38bc99d043d..7b55544533f 100644
--- src/hg/inc/hui.h
+++ src/hg/inc/hui.h
@@ -1006,31 +1006,31 @@
  * Return TRUE if setting is present.  retDefault is TRUE if set to 'on', o/w FALSE
 */
 
 boolean compositeHideEmptySubtracks(struct cart *cart, struct trackDb *tdb,
                                         char **retMultiBedFile, char **retSubtrackIdFile);
 /* Parse hideEmptySubtracks setting and check cart
  * Return TRUE if we should hide empties
  */
 
 boolean compositeChildHideEmptySubtracks(struct cart *cart, struct trackDb *childTdb,
                                         char **retMultiBedFile, char **retSubtrackIdFile);
 /* Parse hideEmptySubtracks setting and check cart
  * Return TRUE if we should hide empties
  */
 
-char *wgEncodeVocabLink(char *file,char *term,char *value,char *title, char *label,char *suffix);
+char *wgEncodeVocabLink(char *term,char *value,char *title, char *label,char *suffix);
 // returns allocated string of HTML link to ENCODE controlled vocabulary term
 
 char *metadataAsHtmlTable(char *db,struct trackDb *tdb,boolean
         showLongLabel,boolean showShortLabel);
 /* If metadata from metaDb exists, return string of html with table definition */
 
 boolean compositeMetadataToggle(char *db,struct trackDb *tdb,char *title,
         boolean embeddedInText,boolean showLongLabel);
 /* If metadata from metaTbl exists, create a link that will allow toggling it's display */
 
 boolean superTrackDropDownWithExtra(struct cart *cart, struct trackDb *tdb,
                                     int visibleChild, struct slPair *events);
 /* Displays hide/show dropdown for supertrack.
  * Set visibleChild to indicate whether 'show' should be grayed
  * out to indicate that no supertrack members are visible: