9a83298f18860ef6d05232bf7e10f2df3c1c2b1d
braney
  Sat Aug 22 10:26:22 2026 -0700
hgc: route inline javascript through the standard helpers

Three places in hgc wrote script markup by hand instead of using the
helpers the rest of the tree uses.

printIframe now emits its script block the way hgIntegrator does. The
wiki track create-item form builds its function with jsInlineF, so the
function lands in the same block as the handler that calls it.
showSomePartialDnaAlignment sets the body frame's start position through
the frame URL, which is how the sibling index links already address that
frame, and matches showSomeAlignment just above it.

No change to what any of the three pages contain.

diff --git src/hg/hgc/wikiTrack.c src/hg/hgc/wikiTrack.c
index 5f2337581f5..c10adb8b746 100644
--- src/hg/hgc/wikiTrack.c
+++ src/hg/hgc/wikiTrack.c
@@ -256,42 +256,43 @@
     webPrintLinkCellEnd();
     webPrintLinkTableEnd();
 
     hPrintf("For more extensive edits, please edit the ");
     hPrintf("wiki article <A HREF=\"%s/index.php/%s\" TARGET=_blank>%s</A> "
        "in the wiki editing system.<BR>", url, item->descriptionKey,
 	    item->descriptionKey);
     webIncludeHelpFile("wikiTrackAddCommentHelp", TRUE);
     webIncludeHelpFile("wikiTrack", TRUE);
     }
 }	/*	displayItem()	*/
 
 void outputJavaScript()
 /* java script functions used in the create item form */
 {
-hPrintf("<SCRIPT TYPE=\"text/javascript\">\n");
-
-hPrintf("function updateColorSelectBox() {\n"
+// Emitted through jsInlineF so it lands in the nonce-tagged script block.  A
+// hand-written <SCRIPT> tag here never ran: our CSP puts a nonce in script-src,
+// which makes browsers ignore 'unsafe-inline', so updateColorSelectBox was
+// undefined and the jsOnEventById handler above did nothing.
+jsInlineF("function updateColorSelectBox() {\n"
 " var form = document.getElementById(\"createItem\");\n"
 " document.createItem.colorPullDown.style.display='inline';\n"
 " document.createItem.colorPullDown.select();\n"
 " document.createItem.colorPullDown.style.display='none';\n"
 " form.%s.style.background = form.%s[form.%s.selectedIndex].value;\n"
 " form.%s.style.color = form.%s[form.%s.selectedIndex].value;\n"
 "}\n", NEW_ITEM_COLOR, NEW_ITEM_COLOR, NEW_ITEM_COLOR,
 	NEW_ITEM_COLOR, NEW_ITEM_COLOR, NEW_ITEM_COLOR);
-hPrintf("</SCRIPT>\n");
 }
 
 void doWikiTrack(char *wikiItemId, char *chrom, int winStart, int winEnd)
 /* handle item clicks on wikiTrack - may create new items */
 {
 char *userName = NULL;
 
 if (wikiTrackEnabled(database, &userName) && sameWord("0", wikiItemId))
     {
     cartWebStart(cart, database, "%s", "User Annotation Track: Create new item");
     if (NULL == userName)
 	{
         if (! wikiTrackReadOnly() ) /* read-only option 2012-06-25 */
             {
             offerLogin(0, "add new items to", WIKI_TRACK_TABLE);