d338d5080783d2ac5828658fe17160668bf64cdb
chmalee
  Thu May 7 15:05:24 2026 -0700
Fixes from code review, refs #37500

- Revalidate shared myVariants tracks against hgcentral on every read
path (hgTracks, hgc, hgTables); cart-supplied owner/db/project no
longer trusted. New myVariantsResolveSharedTrack helper.
- Scope shared-track UPDATE statements by share->project/db so a
recipient can't edit rows outside the granted scope.
- Add hgsid CSRF check to myVariantsJsCommand; pass hgsid in the
hgTracks.js highlight Add-Annotation POST.
- HTML-escape owner-controlled fields in the canEdit branch of
doMyVariantsDetails (Chromosome, Project, project select options,
hidden text input).
- Validate targetUser against gbMembers when creating a share; return
a clear 400 on typos.
- Replace the concat(id,' ',name)='%s' lookup with parsed-id +
name verification.
- Remove cgiMakeColorVar / cgiMakeColorVarWithLabel; the canEdit form
uses spectrum.js (already loaded for the create dialog).
- Strip _hidden_* columns from hgTables field lists for shared tracks,
both the display path and the selected-fields read path.
- Make the per-assembly invariant explicit: myVariantsLoadItems and
doMyVariantsDetails bail out if share->db != current database.
- Memoize myVariantsSharedScopeWhere to avoid per-region hgcentral
round-trips on genome-wide hgTables queries.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

diff --git src/inc/cheapcgi.h src/inc/cheapcgi.h
index 76e5472297d..f60e578e7ea 100644
--- src/inc/cheapcgi.h
+++ src/inc/cheapcgi.h
@@ -389,36 +389,30 @@
 
 #define NO_VALUE            -96669
 void cgiMakeIntVarInRange(char *varName, int initialVal, char *title, int width, 
                           char *min, char *max);
 /* Make a integer control filled with initial value.
    If min and/or max are non-NULL will enforce range
    Requires utils.js jQuery.js and inputBox class */
 void cgiMakeIntVarWithLimits(char *varName, int initialVal, char *title, int width, 
                              int min, int max);
 void cgiMakeIntVarWithMin(char *varName, int initialVal, char *title, int width, int min);
 void cgiMakeIntVarWithMax(char *varName, int initialVal, char *title, int width, int max);
 #define cgiMakeIntVarNoLimits(varName,initialVal,title,width) \
         cgiMakeIntVarInRange(varName,initialVal,title,width,NULL,NULL)
 /* All four of these call cgiMakeIntVarInRange() and therefore require utils.js */
 
-void cgiMakeColorVar(char *varName, char *initialColor);
-/* Make a color input picker using the native color picker. initialColor is a hexval string */
-
-void cgiMakeColorVarWithLabel(char *varName, char *label, char *initialColor, boolean boldLabel);
-/* Make an input color picker labeled by label */
-
 void cgiMakeDoubleVar(char *varName, double initialVal, int maxDigits);
 /* Make a text control filled with initial floating-point value.  */
 void cgiMakeDoubleVarWithExtra(char *varName, double initialVal, int maxDigits, char *extra);
 /* Make a text control filled with initial floating-point value and optional extra HTML.  */
 
 void cgiMakeDoubleVarInRange(char *varName, double initialVal, char *title, int width, 
                              char *min, char *max);
 /* Make a floating point control filled with initial value.
    If min and/or max are non-NULL will enforce range
    Requires utils.js jQuery.js and inputBox class */
 void cgiMakeDoubleVarWithLimits(char *varName, double initialVal, char *title, int width, 
                                 double min, double max);
 void cgiMakeDoubleVarWithMin(char *varName, double initialVal, char *title, int width, double min);
 void cgiMakeDoubleVarWithMax(char *varName, double initialVal, char *title, int width, double max);
 #define cgiMakeDoubleVarNoLimits(varName,initialVal,title,width) \