d338d5080783d2ac5828658fe17160668bf64cdb chmalee Thu May 7 15:05:24 2026 -0700 Fixes from code review, refs #37500 - Revalidate shared myVariants tracks against hgcentral on every read path (hgTracks, hgc, hgTables); cart-supplied owner/db/project no longer trusted. New myVariantsResolveSharedTrack helper. - Scope shared-track UPDATE statements by share->project/db so a recipient can't edit rows outside the granted scope. - Add hgsid CSRF check to myVariantsJsCommand; pass hgsid in the hgTracks.js highlight Add-Annotation POST. - HTML-escape owner-controlled fields in the canEdit branch of doMyVariantsDetails (Chromosome, Project, project select options, hidden text input). - Validate targetUser against gbMembers when creating a share; return a clear 400 on typos. - Replace the concat(id,' ',name)='%s' lookup with parsed-id + name verification. - Remove cgiMakeColorVar / cgiMakeColorVarWithLabel; the canEdit form uses spectrum.js (already loaded for the create dialog). - Strip _hidden_* columns from hgTables field lists for shared tracks, both the display path and the selected-fields read path. - Make the per-assembly invariant explicit: myVariantsLoadItems and doMyVariantsDetails bail out if share->db != current database. - Memoize myVariantsSharedScopeWhere to avoid per-region hgcentral round-trips on genome-wide hgTables queries. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> diff --git src/inc/cheapcgi.h src/inc/cheapcgi.h index 76e5472297d..f60e578e7ea 100644 --- src/inc/cheapcgi.h +++ src/inc/cheapcgi.h @@ -389,36 +389,30 @@ #define NO_VALUE -96669 void cgiMakeIntVarInRange(char *varName, int initialVal, char *title, int width, char *min, char *max); /* Make a integer control filled with initial value. If min and/or max are non-NULL will enforce range Requires utils.js jQuery.js and inputBox class */ void cgiMakeIntVarWithLimits(char *varName, int initialVal, char *title, int width, int min, int max); void cgiMakeIntVarWithMin(char *varName, int initialVal, char *title, int width, int min); void cgiMakeIntVarWithMax(char *varName, int initialVal, char *title, int width, int max); #define cgiMakeIntVarNoLimits(varName,initialVal,title,width) \ cgiMakeIntVarInRange(varName,initialVal,title,width,NULL,NULL) /* All four of these call cgiMakeIntVarInRange() and therefore require utils.js */ -void cgiMakeColorVar(char *varName, char *initialColor); -/* Make a color input picker using the native color picker. initialColor is a hexval string */ - -void cgiMakeColorVarWithLabel(char *varName, char *label, char *initialColor, boolean boldLabel); -/* Make an input color picker labeled by label */ - void cgiMakeDoubleVar(char *varName, double initialVal, int maxDigits); /* Make a text control filled with initial floating-point value. */ void cgiMakeDoubleVarWithExtra(char *varName, double initialVal, int maxDigits, char *extra); /* Make a text control filled with initial floating-point value and optional extra HTML. */ void cgiMakeDoubleVarInRange(char *varName, double initialVal, char *title, int width, char *min, char *max); /* Make a floating point control filled with initial value. If min and/or max are non-NULL will enforce range Requires utils.js jQuery.js and inputBox class */ void cgiMakeDoubleVarWithLimits(char *varName, double initialVal, char *title, int width, double min, double max); void cgiMakeDoubleVarWithMin(char *varName, double initialVal, char *title, int width, double min); void cgiMakeDoubleVarWithMax(char *varName, double initialVal, char *title, int width, double max); #define cgiMakeDoubleVarNoLimits(varName,initialVal,title,width) \