src/hg/lib/cart.c 9927343536614f63516f107aa859b495abf402d1

9927343536614f63516f107aa859b495abf402d1
jcasper
  Mon May 18 09:58:41 2026 -0700
Reducing bot abuse by restricting the number of IP addresses we'll accept the same hguid
from in a short timeframe before requiring a captcha re-up (if captcha is enabled).  refs #37494

diff --git src/hg/lib/cart.c src/hg/lib/cart.c
index efd41d38dd2..99340caa55b 100644
--- src/hg/lib/cart.c
+++ src/hg/lib/cart.c
@@ -1615,30 +1615,46 @@
 
 // Do not show a captcha if we have a valid cookie 
 // but for debugging, it's nice to be able to force the captcha
 if (userId && userIdFound && !cgiOptionalString("captcha"))
     return;
 
 // when the captcha is solved, our JS code does a full page-reload, no AJAX. That saves us one round-trip.
 // After the reload, the new page URL has the captcha token in the URL argument list, so now we need to validate it
 // and remove it from the cart
 char *token = cgiOptionalString("token");
 if (token)
 {
     if (isValidToken(token))
         {
         cartRemove(cart, "token");
+        // Drop any IP-tracking rows for this hguid so a legitimate user
+        // who roams networks isn't repeatedly captcha-gated.
+        if (cfgOptionBooleanDefault("hguidIpTracking.enabled", FALSE) && isNotEmpty(userId))
+            {
+            unsigned int userIdNum = cartDbParseId(userId, NULL);
+            if (userIdNum != 0)
+                {
+                struct sqlConnection *conn = hConnectCentralNoCache();
+                char *table = cfgOptionDefault("hguidIpTracking.table", "hguidIpAccess");
+                char query[256];
+                sqlSafef(query, sizeof(query),
+                         "DELETE FROM %s WHERE userId=%u", table, userIdNum);
+                sqlUpdate(conn, query);
+                sqlDisconnect(&conn);
+                }
+            }
         return;
         }
     else
         {
         puts("Content-Type: text/html\n");
         puts("<html><body>Internal captcha error: Cloudflare rejected the captcha token. "
                 "Something is not working internally, we are very sorry. You can try reloading the page. "
                 "If this problem persists, send an email to genome-www@soe.ucsc.edu and we will "
                 "look into it as quickly as we can in the PST timezone. You can use any internet browser "
                 "where you have used the genome browser before, but not from this internet browser. "
                 "You can try our mirror sites, "
                 "genome-euro.ucsc.edu or genome-asia.ucsc.edu, while we are working on a solution.</body></html>");
         exit(0);
         }
 }