09f26ed9a7dcc52b03b4d3e5b2f97c5177cd9334
max
  Mon Sep 21 06:00:40 2026 -0700
Drop the ${hgsid} trackDb variable; add session ids to links in the browser instead

A description page's links can carry the session id without the page itself holding
one.  addHgsidToLinks() in utils.js walks the rendered page and appends hgsid to every
<a href> that stays on this host and points into the same cgi-bin directory: a relative
CGI link gets one, a static .html, a link to another host, a mailto and a plain #anchor
do not, and a link that already names a session is left alone.  hgc and hgTrackUi call
it through a new jsAddHgsidToLinks(), and hgTracks.js calls it on the track description
popup once the ajax content is in.  A link written with a literal $hgsid is rewritten
rather than skipped, so the description pages already deployed in the GenArk hubs work
again.

hVarSubst no longer knows about hgsid: it is out of the trackDb variable list, so
hVarSubstTrackDbHtml is a hub-only pass again and needs no cart, and hVarSubstWithCart
and webIncludeHelpFileSubst, which existed only to resolve it, are gone.  The variable
is taken out of the trackDb README and out of the twenty-odd description pages that
used it.

refs #38380

diff --git src/hg/inc/jsHelper.h src/hg/inc/jsHelper.h
index adb135ffc30..1d81aae568b 100644
--- src/hg/inc/jsHelper.h
+++ src/hg/inc/jsHelper.h
@@ -153,30 +153,36 @@
 
 void jsBeginCollapsibleSectionFontSize(struct cart *cart, char *track, char *section,
 				       char *sectionTitle, boolean isOpenDefault, char *fontSize);
 /* Make the hidden input, collapse/expand button and <TR id=...> needed for utils.js's
  * setTableRowVisibility().  Caller needs to have already created a <TABLE> and <FORM>. */
 
 void jsBeginCollapsibleSectionOldStyle(struct cart *cart, char *track, char *section,
 				       char *sectionTitle, boolean isOpenDefault);
 /* Make the hidden input, collapse/expand button and <TR id=...> needed for utils.js's
  * setTableRowVisibility().  Caller needs to have already created a <TABLE> and <FORM>. 
  * With support for varying font size */
 
 void jsEndCollapsibleSection();
 /* End the collapsible <TR id=...>. */
 
+void jsAddHgsidToLinks();
+/* Emit the javascript that gives every link on this page to one of our own CGIs the current
+ * session id.  See addHgsidToLinks() in utils.js: a track description page comes from
+ * whoever wrote the track or the hub, so the session id cannot be substituted into it on
+ * the server without also handing it to an <img> that points somewhere else. */
+
 void jsReloadOnBackButton(struct cart *cart);
 /* Add some javascript to detect that the back button (or reload) has been pressed,
  * and to resubmit in that case to redraw the page with the latest cart contents. */
 
 // --- Genome browser specific json stuff - see also inc/json.h for more generic stuff 
 
 void jsonDyStringPrint(struct dyString *dy, struct jsonElement *json, char *name, int indentLevel);
 // dyStringPrint out a jsonElement, indentLevel -1 means no indenting
 
 void jsonPrint(struct jsonElement *json, char *name, int indentLevel);
 // print out a jsonElement and children using hPrintf, and for indentLevel >=0
 // bracketing with comments.  See also jsonPrintToFile.
 
 void jsonErrPrintf(struct dyString *ds, char *format, ...)
 //  Printf a json error to a dyString for communicating with ajax code; format is: