4165c886d31e4e347d85e0fc134fc085af2bf31f
galt
  Mon Nov 24 13:51:31 2025 -0800
Fixes the concern where externally loaded non-local-hubs might want to use protected local bigDataUrls such as /gbdb/hg38/bbi/hgmd.bb, which will now be forbidden when loading the tracks. Tells the user which setting has the invalid url and that such usage is not allowed. It also supports udc.localDir setting for GBIB and mirrors. As usual that should be set carefully as mentioned in the ticket, and also provides a way to test with and without udc.localDir allowing paths. refs #34544

diff --git src/hg/lib/trackHub.c src/hg/lib/trackHub.c
index 38ddf88a7e9..1878b8a9b0f 100644
--- src/hg/lib/trackHub.c
+++ src/hg/lib/trackHub.c
@@ -898,30 +898,41 @@
     struct trackDb *tdb, char *setting)
 /* Abort if forbidden setting found. */
 {
 if (trackDbSetting(tdb, setting))
     errAbort("Forbidden setting '%s' in hub %s genome %s track %s", setting,
         hub->url, genome->name, tdb->track);
 }
 
 static void expandOneUrl(struct hash *settingsHash, char *hubUrl, char *variable)
 {
 struct hashEl *hel = hashLookup(settingsHash, variable);
 if (hel != NULL)
     {
     char *oldVal = hel->val;
     hel->val = trackHubRelativeUrl(hubUrl, oldVal);
+    char *newPath = (char *) hel->val;
+    
+    if (strchr(hubUrl, ':') && (!strchr(newPath, ':')))
+	{
+	// allow local url with udc.localDir path prefix
+	char *prefix = cfgOption("udc.localDir");
+	if (!(prefix && startsWith(prefix, newPath)))
+	    {
+	    errAbort("setting %s local URL %s not allowed with non-local host URL %s", variable, newPath, hubUrl);
+	    }
+	}
     freeMem(oldVal);
     }
 }
 
 static void expandBigDataUrl(struct trackHub *hub, struct trackHubGenome *genome,
 	struct trackDb *tdb)
 /* Expand bigDataUrls so that no longer relative to genome->trackDbFile */
 {
 struct hashEl *hel;
 struct hashCookie cookie = hashFirst(tdb->settingsHash);
 while ((hel = hashNext(&cookie)) != NULL)
     {
     char *name = hel->name;
     if (trackSettingIsFile(name))
 	expandOneUrl(tdb->settingsHash, genome->trackDbFile, name);