554396e44745165ee4baf5214aa771f2b17b3be6
braney
  Mon Aug 17 16:04:26 2026 -0700
hgPcr, cart: screen the PCR result file names read back out of the cart, refs #37623

The hgPcrResult_<db> cart variable holds two file names and an optional target
name in one value.  The cart.c arrays compare a whole value against
isServerUserFilePath(), so none of them fit that shape.  Add a fourth array for
it and check the first two words.  hgPcrResult_targetStyle shares the prefix and
is a display setting, so it is excluded by name.

Check both names where they are used as well, in pcrResultParseCart() and in
hgPcr's append path, the way dupTrack.c already does.

Two other things in writePcrResultTrack().  pcrFiles[2] was read without ever
being set whenever the value held only two words, which is the usual case.  And
the saved-session test was a plain prefix compare that missed sessionDataDirOld;
it now asks whether the file is in the trash instead.

hg/utils/cartFileVarCatalog knows about the new array and has a row for
hgPcrResult_<db> saying why its scan cannot see this one.

diff --git src/hg/cgilib/pcrResult.c src/hg/cgilib/pcrResult.c
index ff9961f7d0d..4a69012c33f 100644
--- src/hg/cgilib/pcrResult.c
+++ src/hg/cgilib/pcrResult.c
@@ -1,27 +1,28 @@
 /* pcrResult -- support for internal track of hgPcr results. */
 
 /* Copyright (C) 2014 The Regents of the University of California 
  * See kent/LICENSE or http://genome.ucsc.edu/license/ for licensing information. */
 
 #include "common.h"
 #include "hdb.h"
 #include "hui.h"
 #include "obscure.h"
 #include "targetDb.h"
 #include "pcrResult.h"
 #include "trackHub.h"
+#include "trashDir.h"
 
 
 char *pcrResultCartVar(char *db)
 /* Returns the cart variable name for PCR result track info for db. 
  * Don't free the result! */
 {
 static char buf[1024];
 safef(buf, sizeof(buf), "%s_%s", PCR_RESULT_TRACK_NAME, db);
 return buf;
 }
 
 #define setPtIfNotNull(pt, val) if (pt != NULL) *pt = val
 
 boolean pcrResultParseCart(char *db, struct cart *cart, char **retPslFile,
 			   char **retPrimerFile,
@@ -42,31 +43,35 @@
     }
 static char buf[2048];
 char *words[3];
 int wordCount;
 safecpy(buf, sizeof(buf), hgPcrResult);
 wordCount = chopLine(buf, words);
 if (wordCount < 2)
     errAbort("Badly formatted hgPcrResult variable: %s", hgPcrResult);
 char *pslFile = words[0];
 char *primerFile = words[1];
 char *targetName = (wordCount > 2) ? words[2] : NULL;
 struct targetDb *target = NULL;
 if (!trackHubDatabase(db))
     target = targetDbLookup(db, targetName);
 
-if (!fileExists(pslFile) || !fileExists(primerFile) ||
+/* Both names came back out of the cart, and the files are opened and echoed to the user
+ * below, so make sure they name files the server made for this user rather than some other
+ * file on the machine.  Refs #37623. */
+if (!isServerUserFilePath(pslFile) || !isServerUserFilePath(primerFile) ||
+    !fileExists(pslFile) || !fileExists(primerFile) ||
     (wordCount > 2 && target == NULL))
     {
     cartRemove(cart, cartVar);
     setPtIfNotNull(retPslFile, NULL);
     setPtIfNotNull(retPrimerFile, NULL);
     setPtIfNotNull(retTarget, NULL);
     return FALSE;
     }
 setPtIfNotNull(retPslFile, cloneString(pslFile));
 setPtIfNotNull(retPrimerFile, cloneString(primerFile));
 setPtIfNotNull(retTarget, target);
 if (retTarget == NULL)
     targetDbFreeList(&target);
 return TRUE;
 }