d338d5080783d2ac5828658fe17160668bf64cdb chmalee Thu May 7 15:05:24 2026 -0700 Fixes from code review, refs #37500 - Revalidate shared myVariants tracks against hgcentral on every read path (hgTracks, hgc, hgTables); cart-supplied owner/db/project no longer trusted. New myVariantsResolveSharedTrack helper. - Scope shared-track UPDATE statements by share->project/db so a recipient can't edit rows outside the granted scope. - Add hgsid CSRF check to myVariantsJsCommand; pass hgsid in the hgTracks.js highlight Add-Annotation POST. - HTML-escape owner-controlled fields in the canEdit branch of doMyVariantsDetails (Chromosome, Project, project select options, hidden text input). - Validate targetUser against gbMembers when creating a share; return a clear 400 on typos. - Replace the concat(id,' ',name)='%s' lookup with parsed-id + name verification. - Remove cgiMakeColorVar / cgiMakeColorVarWithLabel; the canEdit form uses spectrum.js (already loaded for the create dialog). - Strip _hidden_* columns from hgTables field lists for shared tracks, both the display path and the selected-fields read path. - Make the per-assembly invariant explicit: myVariantsLoadItems and doMyVariantsDetails bail out if share->db != current database. - Memoize myVariantsSharedScopeWhere to avoid per-region hgcentral round-trips on genome-wide hgTables queries. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> diff --git src/hg/hgTables/joining.c src/hg/hgTables/joining.c index b6be5560ea9..97e46691bf3 100644 --- src/hg/hgTables/joining.c +++ src/hg/hgTables/joining.c @@ -299,30 +299,32 @@ char *type = ct->dbTrackType; struct slName *fieldList = NULL; if (startsWithWord("myVariants", type) || sameWord("bedDetail", type) || sameWord("barChart", type) || sameWord("interact", type) || sameWord("bedMethyl", type) || sameWord("pgSnp", type)) { struct sqlConnection *conn = hAllocConn(CUSTOM_TRASH); if (sameWord("myVariants", type)) { ct->dbTableName = myVariantsResolveDbTableForCustomTrack(ct->tdb->table, cart); } fieldList = sqlListFields(conn, ct->dbTableName); + if (startsWith("myVariants_shared_", track)) + myVariantsStripHiddenFields(&fieldList); hFreeConn(&conn); } else { fieldList = getBedFields(15); } makeOrderedCommaFieldList(fieldList, dtfList, dy); slFreeList(&fieldList); } static void makeBigBedOrderedCommaFieldList(struct joinerDtf *dtfList, struct dyString *dy) /* Make comma-separated field list in same order as fields are in * big bed. */ {