Commits for max
switch to files view, user index
v502_base to v503_preview (2026-08-10 to 2026-08-17) v503
Show details
a29276ca751e3fa5f0fc03784014b56e74aa840a Tue Aug 11 05:03:46 2026 -0700
- adding makedoc for cactus447 update, refs #37841
- src/hg/makeDb/doc/hg38/cactus447.txt - lines changed 40, context: html, text, full: html, text
663d6e61cc7cbd60100bbe9ae89a4c876530348b Tue Aug 11 05:10:02 2026 -0700
- hgLogin: make the change-email confirm link single-use and record lastUse on the email-link chooser sign-in, refs #37929
Two issues Gerardo found in QA:
(i) The change-email confirmation link was stateless (signature + expiry only),
so opening it again within the hour re-applied the change -- and a stale link
could silently override a newer email change. Fold the account's current email
into the signed string: confirmChangeEmail recomputes the signature from the
address currently on the account, so once the change is applied the address is
no longer the one the link was signed against and the link stops validating.
No new column or stored token needed.
(ii) chooseAccount's email-link branch (the multi-account case) signed the user
in without updating gbMembers.lastUse, unlike the single-account emailLogin
path. Add the lastUse update for the chosen account.
- src/hg/hgLogin/hgLogin.c - lines changed 32, context: html, text, full: html, text
516b59c2d55af8ec1d71f43c06e545f5633b4cd3 Tue Aug 11 06:15:09 2026 -0700
- hgLogin: fix two social-login gaps found in v502 code review, refs #38037
#1 The OAuth account-chooser query listed accounts the action would then
refuse: it lacked the accountActivated='Y' filter that chooseAccount() and
resolveIdentity() both apply, so the page could offer an unactivated row (and
expose the username anyone could have created with the victim's address). Add
the filter so the page and the action agree.
#2 oauthReturn() removed oauth_state but never oauth_provider, and it acted on
the error parameter before checking state. So after one social login a later
hgLogin?error=<text> re-entered the flow and printed the (escaped) provider
text on the login page, and a crafted error link could consume the state nonce
of a login in flight. Validate state first, then clear both oauth_state and
oauth_provider, so the flow ends cleanly and a stray code/error link is ignored.
Found in the v502 final-build code review, refs #38069.
- src/hg/hgLogin/hgLogin.c - lines changed 24, context: html, text, full: html, text
e08ae97dc288749c2454fd98a10dc79f06e27cb5 Tue Aug 11 06:16:20 2026 -0700
- hgBlat/hgc: fixes from the v502 code review of the BLAT results pages, refs #37893
#4 blatOldTracks now falls back to "keep" (with a warning) on any value other
than keep/hide/delete, instead of dropping into the destructive delete branch,
so a typo in hg.conf can never silently discard a user's earlier BLAT tracks.
#5 htmlEncode() (js/utils.js) now also escapes " and ', which the browser's
text->markup conversion leaves alone. Every hgBlat caller puts the result in a
double-quoted attribute, so an unescaped quote in the cart position string could
break out of the attribute; the shared helper now honors its documented contract.
#6 The non-BLAT alignment title no longer starts with a stray space.
#7 open_memstream() is checked for NULL: on that failure the alignment renders
straight to stdout instead of writing to a NULL FILE and calling fclose(NULL).
The section reorder keys on the literal "<H4><A NAME=genomic>"/"<H4><A NAME=ali>"
strings, so a note was added in fuzzyShow.c and pslShow.c to keep them intact.
Found in the v502 final-build code review, refs #38069.
948d0399a8d2e1f294fb04c82c8d2fbec735707a Tue Aug 11 07:33:13 2026 -0700
- edw: fix heap overflow (edwWebXSendFile) and submit command injection (edwLib)
edwWebXSendFile tokenValid()/getFullFileName() used strcat onto exact-sized
cloneString buffers, overrunning the heap; tokenValid() does this before the
auth token is checked, so it is reachable without valid credentials. Build the
strings in right-sized buffers instead.
edwAddSubmitJob() interpolated a user-supplied submission URL into a shell
command later run by edwRunDaemon; a single quote broke out of the single-quote
context and injected commands. Reject quotes/newlines in url and userEmail and
single-quote both values in the command.
refs #38055, refs #38060
- src/hg/encode3/encodeDataWarehouse/edwWebXSendFile/edwWebXSendFile.c - lines changed 13, context: html, text, full: html, text
- src/hg/encode3/encodeDataWarehouse/lib/edwLib.c - lines changed 10, context: html, text, full: html, text
5c35098ff0bc6319b3c771ee8d683d2145fd75ac Tue Aug 11 08:02:17 2026 -0700
- genark: write contrib data into the GenArk build directory, not the served symlink trees
addContrib was creating contrib/<name>/ symlink dirs and trackDb under
assemblyDir(acc) = asmHubs/GCA/.../<acc>, which (like /gbdb/genark/<acc>) is
only a tree of symlinks the GenArk build system regenerates, so the contrib
files got clobbered. Replace assemblyDir() with buildDir(), which resolves the
real build directory under asmHubs/{genbankBuild,refseqBuild}/... (GCA ->
genbankBuild, GCF -> refseqBuild), globbing the accession to pick up the
assembly-name suffix. contrib symlinks, the per-assembly trackDb, and the
hub.txt wiring (now the build dir's <asmId>.singleFile.hub.txt) all land in the
build directory. refs #35415
- src/utils/genark/genark - lines changed 48, context: html, text, full: html, text
1a7b4e1d39c69f33d6d78d1f3ca61b783d2ded40 Tue Aug 11 08:08:50 2026 -0700
- hgLogin: escape reflected values on the older login/account form pages (XSS)
The pre-social-login pages printed cart and CGI values into HTML with a
plain %s. Since every CGI parameter becomes a cart variable, a crafted URL
could reflect script into the page, and the login cookie is written by
JavaScript (not HttpOnly), so injected script could read it. Wrap the
reflected values in htmlEncode() at the point of output, matching the
existing encXxx pattern in the file. Covers displayLoginPage,
displayAccHelpPage, changePasswordPage, signupPage, displayMailSuccess and
displayMailSuccessPwd.
refs #38011
- src/hg/hgLogin/hgLogin.c - lines changed 13, context: html, text, full: html, text
cee097b75fe4d1b29f0debd8af938ba6bf729d53 Tue Aug 11 08:18:42 2026 -0700
- hgBlat: new client-rendered BLAT search form and sortable results page, refs #37893
An opt-in modern alternative to the classic hyperlink output, gated by the
blatNewForm / blatNewPage hg.conf flags. hgBlat.c emits the hit data and form
config as inline JSON (hgBlatData / hgBlatFormData) into empty containers, and
hgBlat.js builds the UI: the search form, a sortable/filterable DataTable with
identity and query-coverage bars, a docked per-hit detail panel, a FASTA query
viewer, and share-link and rename-track modals.
- hgBlat.css: all styling for both pages, loaded via webIncludeResourceFile
(not injected from JS); layout uses CSS classes rather than inline styles.
- utils.js: setupGenomeSelector, the combobox genome picker the form uses.
- hgc.c: blatOldTracks / blatKeepResults - the "Keep results" checkbox lets a
user accumulate BLAT result tracks instead of each search replacing the last.
- hgConfCatalog: register the blatNewForm / blatNewFormBanner gates.
- blatExample.fa: the example query the form loads on demand.
Markup is built in JS (escaped values via htmlEncode, everything else set through
DOM properties); no HTML strings in the C or a template engine.
- src/hg/hgBlat/hgBlat.c - lines changed 187, context: html, text, full: html, text
- src/hg/htdocs/goldenPath/help/blatExample.fa - lines changed 279, context: html, text, full: html, text
- src/hg/htdocs/style/hgBlat.css - lines changed 210, context: html, text, full: html, text
- src/hg/htdocs/style/makefile - lines changed 1, context: html, text, full: html, text
- src/hg/utils/hgConfCatalog/hgConfCatalog.py - lines changed 23, context: html, text, full: html, text
afff541e7fd736cc48695ecf2442bea316120582 Tue Aug 11 08:35:42 2026 -0700
- update to the noyvertSv docs, page, based on email from author
- src/hg/makeDb/trackDb/human/noyvertSv.html - lines changed 31, context: html, text, full: html, text
db7af49112d007eea8d9c0bccbac3f42ec7a8591 Tue Aug 11 08:50:55 2026 -0700
- hgBlat: results table follows the form the search came from, refs #37893
The results-page default now tracks which input form the search came from: a
submission from the new form lands on the new sortable table, one from the
classic form lands on the classic results table (which keeps its banner
advertising the new one). Previously the new-form path set blatNewPage=TRUE but
nothing set it back, so a user who switched to the classic form - or had opted
into the new table earlier - still got the new table. Set blatNewPage to the
form's own new/old choice in both directions.
0bd565e053abc8c74475f352bedfd37e41312fd2 Wed Aug 12 02:15:40 2026 -0700
- lrSv: update noyvertSv docs and align merged-track source labels, refs #37888
Follow-up to author (Boris Noyvert) feedback on the Noyvert/Boehringer
long-read SV dataset.
noyvertSv.html:
- restore neutral wording about the shared 1000G ONT reads; drop the
"independent reprocessing" phrasing and the call-level overlap
interpretation the authors objected to
- note that singletons (SVs in a single sample) were excluded, so the
panel is not exhaustive for the rarest variants
- add the medRxiv preprint link alongside the eLife reference
Give each dataset one consistent name across its subtrack and the merged
(lrSvAll) source filter (databases.tsv + lrSvAll.ra + lrSv.ra):
Noyvert 888 (1000G ONT) -> 1KG ONT Boehringer 888
1KG ONT Vienna 1,019 -> 1KG ONT 1019
1KG ONT 100 (Gustafson) -> 1KG ONT UW 100
The gustafsonSv subtrack short/long labels read 97 samples; the paper and
our track docs report 100 (Gustafson et al. 2024, PMID 39358015), so those
are corrected to 100 as well.
Rebuilt lrSvAll.bb with lrSvMergeAll.py; item count unchanged (2,582,278).
- src/hg/makeDb/scripts/lrSv/databases.tsv - lines changed 3, context: html, text, full: html, text
- src/hg/makeDb/trackDb/human/lrSv.ra - lines changed 2, context: html, text, full: html, text
- src/hg/makeDb/trackDb/human/lrSvAll.ra - lines changed 1, context: html, text, full: html, text
- src/hg/makeDb/trackDb/human/noyvertSv.html - lines changed 11, context: html, text, full: html, text
e11bc091d6678467768adaa1b2f05c0296ae4352 Wed Aug 12 08:42:06 2026 -0700
- hgTracks: add "Delete Custom Track" to the track right-click menu
Custom tracks can now be deleted from the track right-click menu, the same
way they are deleted by the trash-can icon in the track list. Both paths call
the same deleteCustomTrack() helper, so there is one deletion code path. The
menu item is shown only for custom tracks (id starts with "ct_"), reuses the
trash SVG inlined from printTrashIcon(), and removes the track from the image
in place via hideTracks() rather than reloading the page.
refs #38087
a1354aabe7a5ccdc84bf559fcb97047df817e29a Thu Aug 13 04:34:43 2026 -0700
- hgTracks: trash-icon custom-track delete also removes it from the image
The trash icon in the track list now calls hideTracks() after the delete, the
same cleanup as the right-click "Delete Custom Track" path, so a deleted custom
track disappears from the image and hgTracks.trackDb right away instead of
lingering until the next page reload. Guarded on the track being present in
hgTracks.trackDb, since hideTracks()/tdbFindChildless() assume that and a hidden
custom track can be deleted from the list while not drawn.
refs #38087
44c00f07b0e94306e09f30c84ea6ab0f044e1a29 Fri Aug 14 05:09:12 2026 -0700
- adding lin et al long-read SV subtrack, refs #38099
- src/hg/makeDb/doc/hg38/lrSv.txt - lines changed 26, context: html, text, full: html, text
- src/hg/makeDb/scripts/lrSv/databases.tsv - lines changed 4, context: html, text, full: html, text
- src/hg/makeDb/trackDb/human/hprc2v21Sv.html - lines changed 5, context: html, text, full: html, text
- src/hg/makeDb/trackDb/human/lrSv.html - lines changed 371, context: html, text, full: html, text
- src/hg/makeDb/trackDb/human/lrSv.ra - lines changed 41, context: html, text, full: html, text
- src/hg/makeDb/trackDb/human/lrSv1kLin.html - lines changed 89, context: html, text, full: html, text
- src/hg/makeDb/trackDb/human/lrSvAll.ra - lines changed 2, context: html, text, full: html, text
e11e10c01c975653b7f0102601cabd52967d2c80 Fri Aug 14 05:58:23 2026 -0700
- lrSv: author-provided noyvertSv description, Vienna ONT naming, hs1 Lin update, refs #38099
- noyvertSv.html: replace the Description with the author-provided text
(imputation purpose, singletons excluded, subset-of-Vienna relationship)
- rename "1KG ONT Vienna" -> "1KG Vienna ONT" to match the subtrack and
merged-track labels (noyvertSv.html and the hs1 lrSv page)
- hs1 lrSv page: add the 1KG Lin merged subtrack (now native on T2T-CHM13,
614,522 SVs) and reorder the summary table and detail sections to match
the track (priority) order
- lrSv1kLin.html: link the source Lin et al. dataset on GitHub
- src/hg/makeDb/trackDb/human/hs1/html/lrSv.html - lines changed 42, context: html, text, full: html, text
- src/hg/makeDb/trackDb/human/lrSv1kLin.html - lines changed 4, context: html, text, full: html, text
- src/hg/makeDb/trackDb/human/noyvertSv.html - lines changed 22, context: html, text, full: html, text
7e0dfcdd7ebd1eb552c2d7a367ac02b997e74026 Fri Aug 14 07:54:16 2026 -0700
- longReadVariants: add Boehringer ONT 888 callset to 1000 Genomes table, reword table intro
- src/hg/makeDb/trackDb/human/lrSv.html - lines changed 10, context: html, text, full: html, text
a1d7c07c50f1d895337de121680ea672b261c058 Mon Aug 17 02:26:36 2026 -0700
- escape reflected/echoed user input across several CGIs (XSS), refs #38057
Route user-, DB- and hub-derived values through htmlEncode (HTML/attribute text),
cgiEncode (values composed into URLs), jsonStringEscape (values placed in a JS string
literal inside an inline script) or, for hgMirror, the existing mustBeClean sanitizer.
Covers hgHubConnect, hgUserSuggestion, hgLiftOver, hgBlat, hgc pubs, hgVisiGene,
hgSession, hgTrackUi, hgGenome, phyloPng, hgFileSearch, hgLinkIn, hgPal, hui,
hgPhyloPlace, hgMirror, hgCustom and hgSearch.
- src/hg/hgCustom/hgCustom.c - lines changed 5, context: html, text, full: html, text
- src/hg/hgFileSearch/hgFileSearch.c - lines changed 1, context: html, text, full: html, text
- src/hg/hgGenome/browseRegions.c - lines changed 2, context: html, text, full: html, text
- src/hg/hgGenome/configure.c - lines changed 4, context: html, text, full: html, text
- src/hg/hgGenome/correlate.c - lines changed 3, context: html, text, full: html, text
- src/hg/hgGenome/import.c - lines changed 3, context: html, text, full: html, text
- src/hg/hgGenome/mainPage.c - lines changed 1, context: html, text, full: html, text
- src/hg/hgGenome/sortGenes.c - lines changed 3, context: html, text, full: html, text
- src/hg/hgHubConnect/hgHubConnect.c - lines changed 4, context: html, text, full: html, text
- src/hg/hgLiftOver/hgLiftOver.c - lines changed 6, context: html, text, full: html, text
- src/hg/hgLinkIn/hgLinkIn.c - lines changed 2, context: html, text, full: html, text
- src/hg/hgMirror/hgMirror - lines changed 1, context: html, text, full: html, text
- src/hg/hgPhyloPlace/phyloPlace.c - lines changed 1, context: html, text, full: html, text
- src/hg/hgSearch/hgSearch.c - lines changed 7, context: html, text, full: html, text
- src/hg/hgSession/hgSession.c - lines changed 3, context: html, text, full: html, text
- src/hg/hgTrackUi/hgTrackUi.c - lines changed 2, context: html, text, full: html, text
- src/hg/hgUserSuggestion/hgUserSuggestion.c - lines changed 4, context: html, text, full: html, text
- src/hg/phyloPng/phyloPng.c - lines changed 2, context: html, text, full: html, text
- src/hg/visiGene/hgVisiGene/hgVisiGene.c - lines changed 2, context: html, text, full: html, text
800bc2ec4d548b450cd21f0bd8bd5b160a353607 Mon Aug 17 02:32:06 2026 -0700
- hgc: fix RetroGenes alignment crash from reading unset 'table' cart var
retroShowCdnaAli() read a cart variable "table" that no code path sets;
only "aliTable" is passed to the hgcRetroCdnaAli handler, so cartString()
aborted with hashMustFindVal: 'table' not found. Use the aliTable value
(already read into 'track') for mappingInfoNew(), the same table name
retroClickHandler passes. refs #38114
- src/hg/hgc/retroClick.c - lines changed 2, context: html, text, full: html, text
29c46a47cbb40f44c06103e8294e8864d82256a7 Mon Aug 17 05:56:59 2026 -0700
- lrSv: fix typos and HTML consistency in track description pages
GitHub capitalization, Continuous, missing article/period in HPRC2 row, 1000 Genomes capitalization, quote target/id attributes
- src/hg/makeDb/trackDb/human/lrSv.html - lines changed 4, context: html, text, full: html, text
- src/hg/makeDb/trackDb/human/lrSv1kLin.html - lines changed 1, context: html, text, full: html, text
f48fc325d72424177878c4849096c77e06c2d3b0 Mon Aug 17 07:34:42 2026 -0700
- BLAT results: own track group, Delete-all button, clearer names, refs #38086
Behind hg.conf blatResultsGroup (default off, a release gate):
- BLAT result custom tracks go into their own "BLAT Results" track group
instead of the generic Custom Tracks group.
- That group's header gets a "Delete all" button that removes every BLAT
result track at once, so users are not stuck deleting them one by one.
- Headerless queries are named by query size + the top hit's gene, e.g.
"360bp SOD1", instead of the useless "blat YourSeq"; the date goes in
the longLabel.
hgBlat.c getCustomName naming + blatDateStamp/topHitLocusLabel helpers
hgc.c buildBigPsl tags the results track group=blat
customFactory.c checkGroup accepts the synthetic "blat" group
hgTracks.c synthesize the BLAT Results group; Delete-all button; keep
the per-track delete icon for the new group
hgTracks.js deleteAllBlatTracks()
hgCustom.c hgct_do_delete_blat action (removes all blatResult=on tracks)
hgConfCatalog.py register blatResultsGroup as a release gate
- src/hg/hgBlat/hgBlat.c - lines changed 98, context: html, text, full: html, text
- src/hg/hgCustom/hgCustom.c - lines changed 24, context: html, text, full: html, text
- src/hg/hgTracks/hgTracks.c - lines changed 30, context: html, text, full: html, text
- src/hg/lib/customFactory.c - lines changed 5, context: html, text, full: html, text
- src/hg/utils/hgConfCatalog/hgConfCatalog.py - lines changed 9, context: html, text, full: html, text
cf3880c50c550e4deb61c9664f4f994e13ab6dd8 Mon Aug 17 08:05:58 2026 -0700
- hgc/hgTracks: fix three items from the v502 code review, refs #38106
Shared BLAT alignment links (hgc g=htcBlatAlign) drew the page and then
exit(0), which skips main's cartCheckout, so the loaded session was never
written back and the recipient's cart ended up nearly empty. Add
cartCheckout(&cart) before all four exit(0) calls that follow webEndGb(),
including the two early error returns.
squishCodonFont() decided FreeType was active with a looser test than
maybeNewFonts(), missing the requirement that the font name match a row in
freeTypeFonts[]; when they disagreed the bitmap engine got a cell height it
cannot render. Factor the engine decision into freeTypeFontActive() and use
it in both places.
Query name, chrom and a hub's organism string went raw into single-quoted JS
string literals and page titles on the modern alignment page; the shared-link
path reads the query name back out of a bigPsl, so it is not covered by
hgBlat's whitelist. javaScriptLiteralEncode the JS arguments and htmlEncode
the HTML labels.
Also add "u"/"s" (the shared-link session selectors) to hgc excludeVars so
they are not left in the reader's cart.
- src/hg/hgTracks/config.c - lines changed 9, context: html, text, full: html, text
- src/hg/hgTracks/hgTracks.h - lines changed 5, context: html, text, full: html, text
- src/hg/hgTracks/simpleTracks.c - lines changed 8, context: html, text, full: html, text
switch to files view, user index