9b6210bc4e86c38aff5a505b3c40cb90e3a4b9b8
hiram
  Fri Jul 31 13:37:13 2026 -0700
pass relay secret string in http headers instead of in the URL and fixup a bare SQL injection refs #31811

diff --git src/hg/hubApi/dataApi.h src/hg/hubApi/dataApi.h
index 3bb4646e414..2bf8deeed56 100644
--- src/hg/hubApi/dataApi.h
+++ src/hg/hubApi/dataApi.h
@@ -86,31 +86,30 @@
 #define argStatus "status"
 #define argLevel "level"
 #define argLiftable "liftable"
 #define argFromGenome "fromGenome"
 #define argToGenome "toGenome"
 /* used by liftRequest */
 #define argEmail "email"
 #define argComment "comment"
 #define argReturnTo "returnTo"
 /* used by assemblyRequest */
 #define argAsmId "asmId"
 #define argName "name"
 #define argBetterName "betterName"
 /* used by the internal /submitOttoRequest relay endpoint */
 #define argRequestType "requestType"
-#define argRelaySecret "relaySecret"
 /* used in liftOver 'listExisting' function to filter the result */
 #define argFilter "filter"
 /* used in list/files to show only certain file types */
 #define argFileType "fileType"
 /* used by /blat */
 #define argUserSeq "userSeq"
 #define argApiKey "apiKey"
 
 /* valid argument listings to verify extraneous arguments
  *  initialized in hubApi.c
  */
 extern char *argListPublicHubs[];
 extern char *argListUcscGenomes[];
 extern char *argListGenarkGenomes[];
 extern char *argListHubGenomes[];
@@ -306,32 +305,33 @@
 char *submitOttoRequest(char *requestType, char *fromDb, char *toDb, char *email, char *comment);
 /* Record a row in the ottoRequest table via hConnectCentral(), applying the
  * liftOver duplicate/daily-rate guards when requestType is "liftOver", or a
  * plain insert when requestType is "assembly".  Returns a status string:
  * "disabled", "duplicate", "rateLimited", "accepted", or "error".  Never
  * apiErrAbort()s -- used both for direct local calls (this host has
  * hgcentral write grants) and to answer relaySubmitOttoRequest() calls. */
 
 char *relaySubmitOttoRequest(char *requestType, char *fromDb, char *toDb, char *email, char *comment);
 /* Relay an ottoRequest submission to genome.ucsc.edu's /submitOttoRequest
  * endpoint, for hosts that lack local hgcentral write grants.  Returns the
  * same status vocabulary as submitOttoRequest(). */
 
 void apiSubmitOttoRequest(char *words[MAX_PATH_INFO]);
 /* Internal server-to-server endpoint backing relaySubmitOttoRequest():
- * authenticates via the shared hg.conf secret 'hubApi.relaySecret', then
- * calls submitOttoRequest() locally and returns its status as JSON. */
+ * authenticates via the shared hg.conf secret 'hubApi.relaySecret', sent as
+ * the 'X-Relay-Secret' request header, then calls submitOttoRequest()
+ * locally and returns its status as JSON. */
 
 /* ######################################################################### */
 /*  functions in getData.c */
 
 void apiGetData(char *words[MAX_PATH_INFO]);
 /* 'getData' function, words[1] is the subCommand */
 
 /* ######################################################################### */
 /*  functions in list.c */
 
 void apiList(char *words[MAX_PATH_INFO]);
 /* 'list' function words[1] is the subCommand */
 
 /* ######################################################################### */
 /*  functions in search.c */