Commits for max
switch to files view, user index
v502_preview2 to v502_base (2026-08-04 to 2026-08-10) v502
Show details
c465f5ce00f640497ff3f0b607552d7701bfa758 Tue Aug 4 06:44:15 2026 -0700
- hgLogin: show provider OAuth errors on the login page instead of falling through to the signup page; trim whitespace in oauth config values and log OIDC discovery failures; document CILogon/LS-AAI issuer URLs in mirrorManual. refs #37984
- src/hg/hgLogin/hgLogin.c - lines changed 19, context: html, text, full: html, text
- src/hg/hgLogin/oauthLogin.c - lines changed 24, context: html, text, full: html, text
- src/hg/htdocs/goldenPath/help/mirrorManual.html - lines changed 10, context: html, text, full: html, text
- src/product/mirrorManual.txt - lines changed 8, context: html, text, full: html, text
c7fcdde6db52ba01fbabfa695b49205bf7261a33 Tue Aug 4 07:40:32 2026 -0700
- hgBlat/hgc: QA fixes for the new BLAT table view and alignment page
Address Gerardo's QA findings on the new BLAT UI:
- Table view: label each hit with its own query (new Query column +
"Queries" count in the summary) when the search has multiple queries,
reading cfg.multiQuery / hit.qName from the payload.
- Table view: strip the "hub_NNN_" prefix from the Assembly field so hub
assemblies no longer show a doubled prefix.
- Alignment page: strip the same prefix from the organism in the page title
for non-GenArk assembly hubs (blatAsmLabel fallback path).
- Table view: do not pre-select hit #1; show a prompt until the user clicks
a row, since top hits are often tied.
- Table view: add a divider between the Browser / New tab / Alignment links.
- Alignment page: sidebar link now reads "Side by Side Alignment" to match
the section heading.
- Alignment page: comma-format coordinates and base counts in the summary,
matching the table view and the rest of the browser.
refs #37893
4ea2a83211550c3d706b60ad6a37fb896771e81d Tue Aug 4 07:49:33 2026 -0700
- hgBlat table view: tighten colors and font sizes to the house style
Follow the UCSC browser UI style guide for CGI output more closely:
- drop the decorative green/orange coloring of the Matches/Mismatch values
in the detail panel; only the identity percentage keeps a meaningful color
(the semantic identity scale).
- make the selected-hit location plain ink instead of navy.
- shrink the oversized detail tile values (17px) and location (15px) to the
14px body size, so the panel reads as a data table, not a KPI dashboard.
- darken the washed-out faint-grey stat/tile labels to the palette's muted grey.
- use the palette header tint for the identity/coverage bar tracks instead of
an off-palette shade.
refs #37893
832428cffce91e64b62eb16c0ca2edff8de29501 Tue Aug 4 07:58:47 2026 -0700
- hgBlat table view: give the header the house-style tan/wheat title band
The results header was steel-blue, which left the whole page a single blue
family (navy nav, blue-grey table, navy buttons/links) - it read as a generic
blue dashboard. Per the UCSC UI style guide the results bar is a title band
(page title + right-aligned primary action), so make it the signature wheat
#e9cf9a band with navy bold title, matching hgGateway/hgCollection. Steel-blue
stays for the section headers on the alignment page.
refs #37893
0eb31efa784bb2ca354d34243f1ab5e36eff6df6 Tue Aug 4 12:44:45 2026 -0700
- adding hprc2annot for qa
- src/hg/makeDb/trackDb/betaGenArk.txt - lines changed 1, context: html, text, full: html, text
690cc018255362c9d1af6ed5f4fa15ae7a0fc81d Wed Aug 5 11:26:22 2026 -0700
- changes after automated code review
hgLogin: sign the pending social identity with hmacMd5() instead of a hand-built
cookieSalt-prefix + MD5. The salt now keys the HMAC rather than being prepended to
the hashed message. This is the signature that closes the account-takeover hole in
the OAuth account chooser, so it should use a real MAC. It also now fails closed:
with login.cookieSalt unset the old code hashed an empty salt, so anyone could
compute a valid signature and the protection was silently absent - hgLogin refuses
to run a social login without the salt. Ordinary login pages never reach this check.
Pending identities in flight across the upgrade no longer validate; those users are
asked to sign in again.
lib/hmac.c: hmacSha1() and hmacMd5() sized their hex buffers at exactly 40 and 32
chars, so the last sprintf wrote its terminating zero one byte past the array and
the following strlen read out of bounds. Grow both by one and use cloneString().
Output is unchanged, verified against openssl dgst -hmac.
userAccounts.css: drop the #helpBox rule, unused since the last id="helpBox" was
removed from hgLogin.c.
mirrorManual, ex.hg.conf: the login section claimed "three" extra ways to sign in
when there are two (external provider, one-time email link). Also document that
login.cookieSalt is required for social sign-in, now that the check fails closed.
Edited mirrorManual.txt and regenerated the html with mirrorDocs/make, since the
html is pandoc output and hand edits there do not survive.
refs #37984
- src/hg/hgLogin/hgLogin.c - lines changed 10, context: html, text, full: html, text
- src/hg/htdocs/goldenPath/help/mirrorManual.html - lines changed 8, context: html, text, full: html, text
- src/hg/htdocs/style/userAccounts.css - lines changed 6, context: html, text, full: html, text
- src/product/mirrorManual.txt - lines changed 6, context: html, text, full: html, text
24ea8d9178f71bca95f19c145b1f378cfd75a6f0 Thu Aug 6 01:49:48 2026 -0700
- kent-core testing into current dir, no redmine
- build/kent-core/makefile - lines changed 1, context: html, text, full: html, text
c9655cda984d9a119d0c4ee37505392fa853a224 Thu Aug 6 05:47:02 2026 -0700
- Move the orphaned range-filter warning from hgTrackUi to hubCheck, refs #37927
Per Brian's review comment: a new warning on the track config page makes hubs
that used to work look broken to whoever opens them, and the browser is the
wrong place to nag about it. Revert the hui.c warning and do the check in
hubCheck instead, where the hub author is the one reading the output.
The check now looks only at settings declared on the stanza itself, so an
orphaned filterByRange on a composite parent is reported once rather than
repeated for every subtrack. The filter.<field> lookup still walks up the
parent chain, so a subtrack that inherits its default range stays quiet.
- src/hg/utils/hubCheck/hubCheck.c - lines changed 40, context: html, text, full: html, text
81d7cff6cb6665feb772b1339b6298273a3c49be Thu Aug 6 08:24:38 2026 -0700
- hgBlat new results page: table redesign, rename modal, share link, and an XSS fix
Iterates on the new hgBlat "table" results page (rendered by hg/js/hgBlat.js from
JSON emitted by hgBlat.c) per feedback on #37893:
- Columns: "Open in Genome Browser" (position link + new-tab icon), "Show"
(base alignment), Query coverage moved before Locus, score-scaled bar in the
Score column, Identity as plain %, comma-formatted Span. Locus is plain text,
clipped with a CSS ellipsis (full value in title).
- Tooltips on every action link and every column header (via the existing
convertTitleTagsToMouseovers mechanism).
- "Rename BLAT Track": a real modal dialog (replaces the old inline toggle form),
reusing the existing hgc buildBigPsl call via a new window.blatRenameCt() helper;
it no longer depends on a generic page-global. New cfg fields canRename /
trackName / trackDescription drive it.
- "Share a link": trash-backed stable URL toggle, with a share-nodes icon.
- Security: cgiEncode the query name in the htcUserAli detailsUrl (its sibling
already did), and htmlEncode every URL before it goes into an href in hgBlat.js,
so a crafted query/sequence name can't break out of the attribute (XSS).
- Shared htmlEncode() moved into hg/js/utils.js for reuse instead of a per-file
escaper.
- hg.conf: blatNewPageBanner (invite banner, default off), blatOldTracks
(keep/hide/delete previous BLAT tracks at creation) documented in ex.hg.conf;
hgc.c tags BLAT tracks with blatResult=on and clears prior ones per blatOldTracks.
refs #37893
- src/hg/hgBlat/hgBlat.c - lines changed 163, context: html, text, full: html, text
- src/product/ex.hg.conf - lines changed 10, context: html, text, full: html, text
dc2ff84f13d687001a9ac35324bff11f3f5835e7 Thu Aug 6 08:32:55 2026 -0700
- updating mirror docs, no redmine
- src/hg/htdocs/goldenPath/help/mirrorManual.html - lines changed 14, context: html, text, full: html, text
- src/product/mirrorManual.txt - lines changed 11, context: html, text, full: html, text
6a96b29dc052f9edc8af110b5751dae667620938 Thu Aug 6 09:10:47 2026 -0700
- hg38 cactus447way makeDoc: document the fix2 length-bug rebuild
#Preview2 week - bugs introduced now will need a build patch to fix
Record the fix2 rebuild of cactus447way (corrected published Zoonomia MAF,
per-chrom slice + mafAddIRows + bigMaf, -cat stitch, and the summary bb built
with the fixed hgLoadMafSummary): commands, verification (old chrY 94 bad
blocks -> 0; summary 446 clean species names), and the reversible genome-test
staging that still awaits the public push.
refs #37841
- src/hg/makeDb/doc/hg38/cactus447.txt - lines changed 66, context: html, text, full: html, text
e81efb1074d9786436ed8cdb626fc3bdeb6ac14c Thu Aug 6 09:20:30 2026 -0700
- hgLogin: fix the social-login/email-link code review issues from #38008
#Preview2 week - bugs introduced now will need a build patch to fix
Brian, thanks for the thorough review - every one of these was real. Here is what
I changed for the six items that stayed on the ticket (the pre-existing XSS and the
site-wide httpsCertCheck default went to #38011 and #38012).
1. Reflected XSS in the account chooser and the other new pages. Every address and
username now goes through htmlEncode() before it lands in the HTML or an attribute
(chooseAccountPage, completeAccountPage, emailLinkPage, changeEmailPage and the
confirmation pages). I also gated the email-link side of the chooser on
emailLinkEnabled(), so your chooseAccount + emailLogin_email=<img ...> URL now
renders the tag as text and does nothing at all where the feature is off.
2. Registering someone else's address to steal their social login. The two OAuth
email-match queries (resolveIdentity and chooseAccount) now require
accountActivated='Y', so an unactivated row someone planted with a victim's address
can no longer be matched or linked. completeAccount only marks the new account
activated when the provider actually verified the address and the user kept it;
otherwise it creates the account inactive and sends the usual confirmation mail, so
an unverified address can never be planted as a trusted one.
3. OAuth requests not enforcing the server certificate. Rather than poke the env var,
I added a small library knob, httpsSetCertCheck() in lib/https.c, that pins the
cert-check mode for the rest of the process and is not overwritten by openSslInit()
or hg.conf. hgLogin's httpRequest() calls it with "abort", so those requests refuse
a bad certificate no matter how the site is configured, and it no longer depends on
being the first HTTPS connection.
4. The pending-identity signature. It now also covers the hguid (which survives the
provider redirect, unlike the hgsid) and the time it was minted, with a 15-minute
expiry, and it is cleared on the failure paths too. A signature that leaks into a
saved or shared session is now useless to another browser and dies quickly anyway.
5. changeEmail. It now asks for the current password where the account has one, and it
no longer changes the address on the spot - it emails a one-time signed confirmation
link to the new address and only applies the change when that link is opened. When the
change lands it also mails the OLD address to say the account's email was changed and
who to contact if that wasn't them, so a hijack gets noticed. One honest caveat: an
account with no password (social-only) still can't be re-checked before the change, so
a stolen cookie could still start it - but the old-address alert now gives the owner a
way to catch it. Expiring login cookies is the deeper fix and feels like its own ticket.
6. isalnum() on a signed char in suggestUsername - now cast to unsigned char.
Build is clean, no new warnings. Set back to you for another look.
refs #38008
- src/hg/hgLogin/hgLogin.c - lines changed 243, context: html, text, full: html, text
- src/hg/hgLogin/oauthLogin.c - lines changed 9, context: html, text, full: html, text
bc236ffceb9ddc8632c872168c92c229206989af Mon Aug 10 08:25:30 2026 -0700
- hgc BLAT alignment viewer: consistent headings, section reorder, friendlier expired-link message, refs #37893
- Sidebar links and section headings are now all sentence case, and each
sidebar link matches its heading (the Side-by-side heading is relabeled too).
- Reorder the modern single-page view to Query, Side-by-side, Genome so the
per-block jump links sit under Only genome sequence, where their anchors
actually are, rather than under Side-by-side; tighten the block-link spacing.
The reorder is done server-side (capture the shared library output via
open_memstream, emit the sections in the new order) so the page does not
reflow after it loads.
- htcUserAli now shows a friendly 'no longer available, run a new BLAT search'
message when the search's trash files have aged out, instead of a raw
file-open error.
- Free the open_memstream buffer with libc free(), not kent freeMem().
b5a4ddd8543a87f46988a60069148b0f2e1a8031 Mon Aug 10 08:37:29 2026 -0700
- hgBlat/hgPcr: show the chrUn info note (fix swapped startsWith args), refs #37893
The chrUn branch of the sequence-type note used startsWith(name, "chrUn"),
but startsWith(start, string) tests whether string begins with start, so it
asked whether "chrUn" begins with the sequence name and never matched. As a
result chrUn (unplaced) sequences got no info icon on the new BLAT results
page, and no note on the classic results page or in hgPcr, while _alt/_fix/
_random (which use endsWith) worked. Fix the argument order in all three.
Also, on the new results page, check the sequence's aliases and not just its
single display name, so a hit whose displayed label is an accession but which
has a chrUn/alt/fix alias (e.g. a GenArk hub) still gets the note.
- src/hg/hgBlat/hgBlat.c - lines changed 20, context: html, text, full: html, text
0043d5ee22db1de1ec305eadb8442bd5a59fe5d7 Mon Aug 10 08:55:00 2026 -0700
- hgc: route non-BLAT alignment clicks to the modern single-page view, refs #37893
Behind a new modernAlignPage hg.conf gate (default off), ordinary alignment
details -- mRNA/EST (htcCdnaAli), PSL/bigPsl, protein, cross-species and the
other showSomeAlignment callers -- now render in the modern single-page
alignment instead of the classic two-frame <frameset>, matching hgBlat's new
results page.
- Generalize showSomeAlignmentModern with a blatContext flag: TRUE keeps the
hgBlat chrome (title 'BLAT Base Alignment', 'Back to results', 'Share a
link'); FALSE is a plain track click, which has no BLAT results to return to
or share, so the title is just 'Base Alignment' and those buttons are omitted.
- alnModernStart() starts modern chrome and arms a flag when modernAlignPage is
set; showSomeAlignment() then renders the modern body, else the classic
frameset. htmlFramesetStart() is left untouched (it is shared with transMap,
retro and pubs click pages), so only the converted callers change.
- The window-restricted (showSomePartialDnaAlignment) and Lowe-Lab
(showSomeAlignment2) renderers are left classic for now.
- Register modernAlignPage in hgConfCatalog.
- src/hg/utils/hgConfCatalog/hgConfCatalog.py - lines changed 6, context: html, text, full: html, text
44027478d0f745cc34c843717bee4a6a397b6022 Mon Aug 10 09:05:32 2026 -0700
- hgc: route transMap, retrogene and literature alignments to the modern view too, refs #37893
These three click pages live in their own files (transMapClick.c, retroClick.c,
pubs.c) and called htmlFramesetStart directly, so they were missed when the other
alignment handlers moved to the modern single-page view. They all render through
showSomeAlignment, so exporting alnModernStart (was static) and swapping their
htmlFramesetStart call for it is enough: with modernAlignPage set they now show
the modern page (neutral, non-BLAT chrome), and the classic frameset otherwise.
- src/hg/hgc/retroClick.c - lines changed 1, context: html, text, full: html, text
- src/hg/hgc/transMapClick.c - lines changed 1, context: html, text, full: html, text
d3d46ec513c57c6f94c97faa8f5cfcbdd644da22 Mon Aug 10 09:30:56 2026 -0700
- hgc: add a 'Back to Genome Browser' button to the non-BLAT alignment pages, refs #37893
The modern alignment page in its neutral (non-BLAT) form had an empty title bar
on the right and no obvious way back to the browser. Add a 'Back to Genome
Browser >' button that returns to hgTracks at this alignment's own location
(db + chrom:start-end + hgsid) - the plain-track-click counterpart of the
hgBlat context's 'Back to results'.
bb3f3f9c420a366835a93d0073a5db3668282349 Mon Aug 10 09:50:47 2026 -0700
- hgLogin: close the two remaining social-login account gaps, refs #38037
Fold the email-verified flag into the signed pending-identity string so it
can no longer be flipped by adding &oauth_pending_email_verified=1 to the
completeAccount request, which decided whether a new account was written
activated (trusted for future auto-linking).
Require accountActivated='Y' in the four passwordless email-link queries
(sendEmailLink, emailLogin, and the two email-mode chooser queries), so the
login link no longer signs anyone into an unactivated account that a stranger
created with their address. Password login and the OAuth queries already did
this.
- src/hg/hgLogin/hgLogin.c - lines changed 15, context: html, text, full: html, text
switch to files view, user index