beb596d6144e0deb9ce96c5955c71e6d5f4eaec9
braney
  Sat Sep 26 13:01:02 2026 -0700
trackHub: add an hg.conf switch for hub description page handling, refs #38126

hubHtmlSanitizeOn() in trackHub.c reads the hg.conf setting hubHtmlSanitize,
default off, and the description page code in lib and cgilib asks it.  With
the setting off, that code behaves as it did in v503.  hubCheck follows the
same setting.

diff --git src/hg/lib/hgFind.c src/hg/lib/hgFind.c
index b47433c062b..5149b27905f 100644
--- src/hg/lib/hgFind.c
+++ src/hg/lib/hgFind.c
@@ -4369,32 +4369,37 @@
 		  trackHubSkipHubName(database),
 		  hgTracksName(), cartSessionVarName(), cartSessionId(cart));
 
 if (htmlPath != NULL) 
     {
     if (fileExists(htmlPath))
 	readInGulp(htmlPath, &htmlString, &htmlStrLength);
     else if (   startsWith("http://" , htmlPath) ||
 		startsWith("https://", htmlPath) ||
 		startsWith("ftp://"  , htmlPath))
 	{
 	struct lineFile *lf = udcWrapShortLineFile(htmlPath, NULL, 256*1024);
 	char *fetched = lineFileReadAll(lf);
 	lineFileClose(&lf);
 	/* This one came in over the network from a hub, so print only what we allow. */
+	if (hubHtmlSanitizeOn())
+	    {
 	    htmlString = htmlSanitize(fetched);
 	    freeMem(fetched);
+	    }
+	else
+	    htmlString = fetched;
 	htmlStrLength = (htmlString == NULL ? 0 : strlen(htmlString));
 	}
     }
 
 if (htmlStrLength > 0)
     {
     puts(htmlString);
     freeMem(htmlString);
     freeMem(htmlPath);
     }
 else
     {
     printf("<H2>%s</H2>\n", trackHubSkipHubName(organism));
     if (htmlPath == NULL || htmlPath[0] == 0)
 	printf("\n<!-- No dbDb.htmlPath for %s -->\n", database);