a5d8b47d899910abc483c0f15c7d47b4d119683f jcasper Tue May 12 10:43:30 2026 -0700 Fetching supporting files was breaking when a broken hub was attached; switching to hubFromIdNoAbort. refs #36320 diff --git src/hg/hgTrackUi/hgTrackUi.c src/hg/hgTrackUi/hgTrackUi.c index 09ad270f6c7..3d37fc6d397 100644 --- src/hg/hgTrackUi/hgTrackUi.c +++ src/hg/hgTrackUi/hgTrackUi.c @@ -4300,36 +4300,39 @@ initGenbankTableNames(database); char *fileUrl = cartOptionalString(cart, "fileUrl"); char *urlClone = cloneString(fileUrl); cgiDecode(urlClone, urlClone, strlen(urlClone)); fileUrl = resolveDotDots(urlClone); freeMem(urlClone); boolean matchFound = FALSE; // Check if fileUrl falls under a connected hub's base directory struct slName *hubIds = hubConnectHubsInCart(cart); struct slName *thisHubId = hubIds; while (thisHubId != NULL) { - struct hubConnectStatus *hubStatus = hubFromId(sqlUnsigned(thisHubId->name)); - if (fileUrlMatchesHub(fileUrl, hubStatus)) + struct hubConnectStatus *hubStatus = hubFromIdNoAbort(sqlUnsigned(thisHubId->name)); + if (hubStatus != NULL) + { + if (isEmpty(hubStatus->errorMessage) && fileUrlMatchesHub(fileUrl, hubStatus)) { matchFound = TRUE; break; } + } thisHubId = thisHubId->next; } // For native database tracks (not hub or custom tracks), check if fileUrl matches // a whitelisted trackDb setting. Only native tracks are checked here because their // settings are admin-configured and trusted. Hub and custom track settings are // user-controlled and could be used for SSRF attacks. if (!matchFound) { char *track = cartOptionalString(cart, "track"); char *sourceDb = cartOptionalString(cart, "sourceDb"); // for future quickLift use if (sourceDb == NULL) sourceDb = database; if (track != NULL && !isHubTrack(track) && !isCustomTrack(track)) {