d338d5080783d2ac5828658fe17160668bf64cdb
chmalee
  Thu May 7 15:05:24 2026 -0700
Fixes from code review, refs #37500

- Revalidate shared myVariants tracks against hgcentral on every read
path (hgTracks, hgc, hgTables); cart-supplied owner/db/project no
longer trusted. New myVariantsResolveSharedTrack helper.
- Scope shared-track UPDATE statements by share->project/db so a
recipient can't edit rows outside the granted scope.
- Add hgsid CSRF check to myVariantsJsCommand; pass hgsid in the
hgTracks.js highlight Add-Annotation POST.
- HTML-escape owner-controlled fields in the canEdit branch of
doMyVariantsDetails (Chromosome, Project, project select options,
hidden text input).
- Validate targetUser against gbMembers when creating a share; return
a clear 400 on typos.
- Replace the concat(id,' ',name)='%s' lookup with parsed-id +
name verification.
- Remove cgiMakeColorVar / cgiMakeColorVarWithLabel; the canEdit form
uses spectrum.js (already loaded for the create dialog).
- Strip _hidden_* columns from hgTables field lists for shared tracks,
both the display path and the selected-fields read path.
- Make the per-assembly invariant explicit: myVariantsLoadItems and
doMyVariantsDetails bail out if share->db != current database.
- Memoize myVariantsSharedScopeWhere to avoid per-region hgcentral
round-trips on genome-wide hgTables queries.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

diff --git src/hg/hgTables/hgTables.c src/hg/hgTables/hgTables.c
index 376e3da6709..563e7a6579e 100644
--- src/hg/hgTables/hgTables.c
+++ src/hg/hgTables/hgTables.c
@@ -1259,30 +1259,32 @@
         {
         conn = hAllocConn(CUSTOM_TRASH);
         if (startsWithWord("maf", type) ||
                 startsWithWord("myVariants", type) ||
                 sameWord("bedDetail", type) ||
                 sameWord("barChart", type) ||
                 sameWord("interact", type) ||
                 sameWord("bedMethyl", type) ||
                 sameWord("pgSnp", type))
             {
             if (sameWord("myVariants", type))
                 {
                 ct->dbTableName = myVariantsResolveDbTableForCustomTrack(ct->tdb->table, cart);
                 }
             fieldList = sqlListFields(conn, ct->dbTableName);
+            if (startsWith("myVariants_shared_", table))
+                myVariantsStripHiddenFields(&fieldList);
             }
         hFreeConn(&conn);
         }
     if (fieldList == NULL)
 	fieldList = getBedFields(ct->fieldCount);
     }
 else
     {
     char *splitTable;
     dbOverrideFromTable(dtBuf, &db, &table);
     conn = hAllocConn(db);
     splitTable = chromTable(conn, table);
     fieldList = sqlListFields(conn, splitTable);
     freez(&splitTable);
     hFreeConn(&conn);