9db87ad5938d116af4d1e73f3e92cc29392df83c
chmalee
  Thu Mar 5 14:58:24 2026 -0800
Limit current tracks download feature to 100 tracks so we don't timeout out hubApi requests, refs #36858

diff --git src/hg/js/hgTracks.js src/hg/js/hgTracks.js
index 345efeb2695..46da1e41fd2 100644
--- src/hg/js/hgTracks.js
+++ src/hg/js/hgTracks.js
@@ -5756,30 +5756,39 @@
     },
 
     startDownload: function() {
         trackList = [];
         $(".downloadTrackName:checked").each(function(i, elem) {
             trackName = elem.id;
             if (getDb().startsWith("hub_")) {
                 // when we are working with assembly hubs, we undecorate the name
                 trackName = undecoratedTrack(elem.id);
             }
             trackList.push(trackName);
         });
         if (trackList.length == 0) {
             alert("At least one track must be selected");
             return;
+        } else if (trackList.length > 100) {
+            alert("Too many tracks requested. Please limit requests to 100 tracks or less");
+            return;
+        } else if (trackList.join(',').length > 7000) {
+            // tracks with too long of names and we hit the max URI length allowed
+            // by Apache, I doubt this could happen without requesting more than the
+            // 100 tracks allowed above, but just in case:
+            alert("Too many tracks requested");
+            return;
         }
         chrom = hgTracks.chromName;
         start = hgTracks.winStart;
         end = hgTracks.winEnd;
         db = getDb();
         apiUrl = "../cgi-bin/hubApi/getData/track?";
         apiUrl += "chrom=" + chrom;
         apiUrl += ";start=" + start;
         apiUrl += ";end=" + end;
         apiUrl += ";genome=" + db;
         apiUrl += ";jsonOutputArrays=1";
         apiUrl += ";track=" + trackList.join(',');
         var xmlhttp = new XMLHttpRequest();
         downloadCurrentTrackData.currentRequests[apiUrl] = true;
         xmlhttp.onreadystatechange = function() {