Skip to content

[bot] Merge 26.7 to develop #661

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
github-actions merged 4 commits into from
Jul 8, 2026
Merged

[bot] Merge 26.7 to develop #661

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
57b13f1
Address reported security issues in the panoramapublic module (#655)
vagisha Jul 2, 2026
25e2a00
Address reported security issues in the testresults module (#654)
vagisha Jul 2, 2026
bf07c79
Merge 26.3 to 26.7
cnathe Jul 7, 2026
ec34e9f
Merge 26.7 to develop
labkey-teamcity Jul 8, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
20 changes: 17 additions & 3 deletions panoramapublic/src/org/labkey/panoramapublic/PanoramaPublicController.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -32,6 +32,7 @@
import org.labkey.api.action.FormHandlerAction;
import org.labkey.api.action.FormViewAction;
import org.labkey.api.action.LabKeyError;
import org.labkey.api.action.MutatingApiAction;
import org.labkey.api.action.ReadOnlyApiAction;
import org.labkey.api.action.ReturnUrlForm;
import org.labkey.api.action.SimpleErrorView;
Expand Down Expand Up @@ -11219,34 +11220,47 @@ public static ActionURL getCatalogImageDownloadUrl(ExperimentAnnotations expAnno

// ======================== Support actions for Selenium tests ========================

// These actions swap the process-wide NCBI publication search service to a mock so that Selenium tests
// run without calling the live NCBI API. They must never be reachable on a production server (non-dev-mode)
private static void requireDevModeForMockNcbiService()
{
if (!AppProps.getInstance().isDevMode())
{
throw new NotFoundException("Mock NCBI publication search service actions are only available on a server running in dev mode.");
}
}

@RequiresSiteAdmin
public static class SetupMockNcbiServiceAction extends ReadOnlyApiAction<Object>
public static class SetupMockNcbiServiceAction extends MutatingApiAction<Object>
{
@Override
public Object execute(Object form, BindException errors)
{
requireDevModeForMockNcbiService();
NcbiPublicationSearchServiceImpl.setInstance(new MockNcbiPublicationSearchService());
return new ApiSimpleResponse("mock", true);
}
}

@RequiresSiteAdmin
public static class RestoreNcbiServiceAction extends ReadOnlyApiAction<Object>
public static class RestoreNcbiServiceAction extends MutatingApiAction<Object>
{
@Override
public Object execute(Object form, BindException errors)
{
requireDevModeForMockNcbiService();
NcbiPublicationSearchServiceImpl.setInstance(new NcbiPublicationSearchServiceImpl());
return new ApiSimpleResponse("restored", true);
}
}

@RequiresSiteAdmin
public static class RegisterMockPublicationAction extends ReadOnlyApiAction<RegisterMockPublicationForm>
public static class RegisterMockPublicationAction extends MutatingApiAction<RegisterMockPublicationForm>
{
@Override
public Object execute(RegisterMockPublicationForm form, BindException errors)
{
requireDevModeForMockNcbiService();
NcbiPublicationSearchService service = NcbiPublicationSearchServiceImpl.getInstance();
if (!(service instanceof MockNcbiPublicationSearchService mock))
{
Expand Down
57 changes: 0 additions & 57 deletions ...amapublic/src/org/labkey/panoramapublic/proteomexchange/ExperimentModificationGetter.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -345,8 +345,6 @@ public PxIsotopicMod(String skylineName, long dbModId, UnimodModification uMod,

public static class TestCase extends Assert
{
private static final boolean debug = false;

@Test
public void testBuildIsotopeModFormula()
{
Expand Down Expand Up @@ -701,8 +699,6 @@ public void testStructuralMods() throws IOException
{
PxModification pxMod = getStructuralUnimodMod(mod, uMods);

printStructuralMod(mod, pxMod);

List<UnimodModification> matches = unimodMatches.get(pxMod.getSkylineName());
if (matches.isEmpty())
{
Expand All @@ -727,32 +723,6 @@ else if (matches.size() == 1)
}
}

private void printStructuralMod(Modification mod, PxModification pxMod)
{
if (!debug)
{
return;
}

if (pxMod.hasUnimodId())
{
String term = mod.getTerminus() == null ? "" : (mod.getTerminus().equals("N") ? "N-term" : "C-term");
String modInfo = pxMod.getSkylineName() + ", " + Formula.normalizeFormula(mod.getFormula()) + ", " + mod.getAminoAcid() + ", TERM: " + term;
System.out.print("Skyline: " + modInfo);
System.out.println(" --- " + pxMod.getUnimodId() + ", " + pxMod.getName());
}
if (pxMod.hasPossibleUnimods())
{
String term = mod.getTerminus() == null ? "" : (mod.getTerminus().equals("N") ? "N-term" : "C-term");
String modInfo = pxMod.getSkylineName() + ", " + Formula.normalizeFormula(mod.getFormula()) + ", " + mod.getAminoAcid() + ", TERM: " + term;
System.out.println("Skyline: " + modInfo);
for (UnimodModification umod: pxMod.getPossibleUnimodMatches())
{
System.out.println(" --- List.of(new UnimodModification(" + umod.getId() + ", \"" + umod.getName() + "\", null))");
}
}
}

@Test
public void testIsotopicMods() throws IOException
{
Expand Down Expand Up @@ -899,8 +869,6 @@ public void testIsotopicMods() throws IOException
}
PxModification pxMod = getIsotopicUnimodMod(mod, uMods);

printIsotopicMod(mod, pxMod);

List<UnimodModification> expectedMatches = matches.get(pxMod.getSkylineName());

if (expectedMatches.isEmpty())
Expand All @@ -926,31 +894,6 @@ else if (expectedMatches.size() > 1)
}
}

private void printIsotopicMod(IsotopeModification mod, PxModification pxMod)
{
if (!debug)
{
return;
}
if (pxMod.hasUnimodId())
{
String term = mod.getTerminus() == null ? "" : (mod.getTerminus().equals("N") ? "N-term" : "C-term");
String modInfo = pxMod.getSkylineName() + ", " + Formula.normalizeFormula(mod.getFormula()) + ", " + mod.getAminoAcid() + ", TERM: " + term;
System.out.print("Skyline: " + modInfo);
System.out.println(" --- " + pxMod.getUnimodId() + ", " + pxMod.getName());
}
if (pxMod.hasPossibleUnimods())
{
String term = mod.getTerminus() == null ? "" : (mod.getTerminus().equals("N") ? "N-term" : "C-term");
String modInfo = pxMod.getSkylineName() + ", " + Formula.normalizeFormula(mod.getFormula()) + ", " + mod.getAminoAcid() + ", TERM: " + term;
System.out.println("Skyline: " + modInfo);
for (UnimodModification umod: pxMod.getPossibleUnimodMatches())
{
System.out.println(" --- List.of(new UnimodModification(" + umod.getId() + ", \"" + umod.getName() + "\", null))");
}
}
}

private Modification createMod(String name, String formula, String sites, String terminus)
{
Modification mod = new Modification();
Expand Down
8 changes: 4 additions & 4 deletions panoramapublic/test/src/org/labkey/test/tests/panoramapublic/PublicationSearchTest.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,7 +20,7 @@
import org.junit.experimental.categories.Category;
import org.labkey.remoteapi.CommandException;
import org.labkey.remoteapi.Connection;
import org.labkey.remoteapi.SimpleGetCommand;
import org.labkey.remoteapi.SimplePostCommand;
import org.labkey.remoteapi.query.Filter;
import org.labkey.remoteapi.query.SelectRowsCommand;
import org.labkey.remoteapi.query.SelectRowsResponse;
Expand Down Expand Up @@ -356,7 +356,7 @@ private void initMockNcbiService()
try
{
Connection connection = createDefaultConnection();
SimpleGetCommand command = new SimpleGetCommand("panoramapublic", "setupMockNcbiService");
SimplePostCommand command = new SimplePostCommand("panoramapublic", "setupMockNcbiService");
command.execute(connection, "/");
_useMockNcbi = true;
log("Using mock NCBI service");
Expand Down Expand Up @@ -432,7 +432,7 @@ private void registerMockPublication(String database, String id, String searchKe
try
{
Connection connection = createDefaultConnection();
SimpleGetCommand command = new SimpleGetCommand("panoramapublic", "registerMockPublication");
SimplePostCommand command = new SimplePostCommand("panoramapublic", "registerMockPublication");
Map<String, Object> params = new HashMap<>();
params.put("database", database);
params.put("id", id);
Expand Down Expand Up @@ -462,7 +462,7 @@ private void restoreNcbiService()
try
{
Connection connection = createDefaultConnection();
SimpleGetCommand command = new SimpleGetCommand("panoramapublic", "restoreNcbiService");
SimplePostCommand command = new SimplePostCommand("panoramapublic", "restoreNcbiService");
command.execute(connection, "/");
log("Restored real NCBI service");
}
Expand Down
8 changes: 4 additions & 4 deletions testresults/src/org/labkey/testresults/SendTestResultsEmail.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -238,7 +238,7 @@ public Pair<String, String> getHTMLEmail(org.labkey.api.security.User from)
.append("\n<td style='padding: 6px; " + (highlightDuration ? style : "") + "'>" + run.getDuration() + (run.getHang() != null ? " (hang)" : "") + "</td>")
.append("\n<td style='padding: 6px; " + (run.getFailedtests() > 0 ? getBackgroundStyle(BackgroundColor.error) : "") + "'>" + run.getFailedtests() + "</td>")
.append("\n<td style='padding: 6px; " + (run.getLeaks().length > 0 ? getBackgroundStyle(BackgroundColor.error) : "") + "'>" + run.getLeaks().length + "</td>")
.append("\n<td style='padding: 6px;'> " + run.getGitHash() + "</td>")
.append("\n<td style='padding: 6px;'> " + PageFlowUtil.filter(run.getGitHash()) + "</td>")
.append("</tr>");
}
}
Expand All @@ -252,7 +252,7 @@ public Pair<String, String> getHTMLEmail(org.labkey.api.security.User from)
for (User u : missingUsers)
{
message.append("<tr style='border-bottom: 1px solid grey;'>")
.append("\n<td style='" + getBackgroundStyle(BackgroundColor.error) + " padding: 6px;' colspan='7'>Missing " + u.getUsername() + "</td>")
.append("\n<td style='" + getBackgroundStyle(BackgroundColor.error) + " padding: 6px;' colspan='7'>Missing " + PageFlowUtil.filter(u.getUsername()) + "</td>")
.append("</tr>");
}
message.append("<tr>")
Expand Down Expand Up @@ -282,13 +282,13 @@ public Pair<String, String> getHTMLEmail(org.labkey.api.security.User from)
"</td>");
RunDetail[] problemRuns = problems.getRuns();
for (RunDetail run : problemRuns)
message.append("\n<td style='max-width: 60px; width: 60px; overflow: hidden; text-overflow: ellipsis; padding: 3px; border: 1px solid #ccc;'>" + run.getUserName() + "</td>");
message.append("\n<td style='max-width: 60px; width: 60px; overflow: hidden; text-overflow: ellipsis; padding: 3px; border: 1px solid #ccc;'>" + PageFlowUtil.filter(run.getUserName()) + "</td>");
message.append("\n</tr>");

for (String test : problems.getTestNames())
{
message.append("\n<tr>")
.append("\n<td style='overflow: hidden; text-overflow: ellipsis; padding: 3px; border: 1px solid #ccc;'>" + test + "</td>");
.append("\n<td style='overflow: hidden; text-overflow: ellipsis; padding: 3px; border: 1px solid #ccc;'>" + PageFlowUtil.filter(test) + "</td>");
for (RunDetail run : problemRuns)
{
message.append("\n<td style='width: 60px; overflow: hidden; padding: 3px; border: 1px solid #ccc;'>");
Expand Down
47 changes: 26 additions & 21 deletions testresults/src/org/labkey/testresults/TestResultsController.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -69,7 +69,6 @@
import org.labkey.api.view.JspView;
import org.labkey.api.view.NavTree;
import org.labkey.api.view.WebPartView;
import org.labkey.testresults.model.GlobalSettings;
import org.labkey.testresults.model.RunDetail;
import org.labkey.testresults.model.TestFailDetail;
import org.labkey.testresults.model.TestHandleLeakDetail;
Expand Down Expand Up @@ -451,7 +450,7 @@ public static void ensureRunDataCached(RunDetail[] runs, boolean keepObjData) {
}
catch (IOException e)
{
e.printStackTrace();
_log.error("Failed to encode run pass summary", e);
}
int avgMem = 0;
if (passes.length != 0)
Expand Down Expand Up @@ -1174,7 +1173,7 @@ public void setFlag(Boolean flag)
/**
* action to show all flagged runs flagged.jsp
*/
@RequiresNoPermission
@RequiresPermission(ReadPermission.class)
public static class ShowFlaggedAction extends SimpleViewAction<Object>
{
@Override
Expand Down Expand Up @@ -1229,23 +1228,26 @@ public Object execute(BoundariesForm form, BindException errors) throws Exceptio
return new ApiSimpleResponse(res);
}

GlobalSettings settings = new GlobalSettings(warningB, errorB);
DbScope.Transaction transaction = TestResultsSchema.getSchema().getScope().ensureTransaction();
SQLFragment sqlFragment = new SQLFragment();
sqlFragment.append("select exists(select 1 from " + TestResultsSchema.getTableInfoGlobalSettings() + ") ");
SqlSelector sqlSelector = new SqlSelector(TestResultsSchema.getSchema(), sqlFragment);
List<Boolean> values = new ArrayList<>();
sqlSelector.forEach(rs -> values.add(rs.getBoolean(1)));

if (values.getFirst()) {
SQLFragment sqlFragmentDelete = new SQLFragment();
sqlFragmentDelete.append("DELETE FROM " + TestResultsSchema.getTableInfoGlobalSettings());
new SqlExecutor(TestResultsSchema.getSchema()).execute(sqlFragmentDelete);
try (DbScope.Transaction transaction = TestResultsSchema.getSchema().getScope().ensureTransaction())
{
SQLFragment sqlFragment = new SQLFragment();
sqlFragment.append("select exists(select 1 from " + TestResultsSchema.getTableInfoGlobalSettings() + ") ");
SqlSelector sqlSelector = new SqlSelector(TestResultsSchema.getSchema(), sqlFragment);
List<Boolean> values = new ArrayList<>();
sqlSelector.forEach(rs -> values.add(rs.getBoolean(1)));

if (values.get(0)) {
SQLFragment sqlFragmentDelete = new SQLFragment();
sqlFragmentDelete.append("DELETE FROM " + TestResultsSchema.getTableInfoGlobalSettings());
new SqlExecutor(TestResultsSchema.getSchema()).execute(sqlFragmentDelete);
}
SQLFragment sqlFragmentInsert = new SQLFragment();
sqlFragmentInsert.append("INSERT INTO " + TestResultsSchema.getTableInfoGlobalSettings() + " (warningb, errorb) VALUES (?, ?)");
sqlFragmentInsert.add(warningB);
sqlFragmentInsert.add(errorB);
new SqlExecutor(TestResultsSchema.getSchema()).execute(sqlFragmentInsert);
transaction.commit();
}
SQLFragment sqlFragmentInsert = new SQLFragment();
sqlFragmentInsert.append("INSERT INTO " + TestResultsSchema.getTableInfoGlobalSettings() + " (warningb, errorb) VALUES (" + warningB + ", " + errorB +")");
new SqlExecutor(TestResultsSchema.getSchema()).execute(sqlFragmentInsert);
transaction.commit();
res.put("Message", "success!");
return new ApiSimpleResponse(res);
}
Expand Down Expand Up @@ -1780,6 +1782,8 @@ else if (xml.isEmpty())
_log.info("Attempting to save file for a future post attempt");
res.put(KEY_SUCCESS, false);
res.put("Message", "Error Parsing XML attempting to save the XML file... " + NIGHTLY_POSTER.SaveXML(file, getContainer()));
// The stack trace is intentionally returned to the caller (SkylineTester) so posting
// failures can be diagnosed from the client without server log access.
res.put("Exception", e + NIGHTLY_POSTER.getStackTraceText(e));
return new ApiSimpleResponse(res);
}
Expand Down Expand Up @@ -1849,6 +1853,8 @@ public Object execute(Object o, BindException errors)
f.delete();
res.put(f.getName(), "Success!");
} catch (Exception e) {
// The stack trace is intentionally returned to the caller so a failed re-post can be
// diagnosed from the client without server log access.
res.put(f.getName(), Arrays.toString(e.getStackTrace()));
}
}
Expand Down Expand Up @@ -1898,8 +1904,7 @@ private static String SaveXML(MultipartFile file, Container c) {
}
catch (IOException e)
{
_log.error("Failed to save {}.", fileName);
e.printStackTrace();
_log.error("Failed to save {}.", fileName, e);
return "Failed to save the file.";
}
return "File saved to system.";
Expand Down
6 changes: 5 additions & 1 deletion testresults/src/org/labkey/testresults/TestResultsModule.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,13 +16,15 @@

package org.labkey.testresults;

import org.apache.logging.log4j.Logger;
import org.jetbrains.annotations.NotNull;
import org.jetbrains.annotations.Nullable;
import org.labkey.api.data.Container;
import org.labkey.api.module.DefaultModule;
import org.labkey.api.module.ModuleContext;
import org.labkey.api.security.Directive;
import org.labkey.api.security.SecurityManager;
import org.labkey.api.util.logging.LogHelper;
import org.labkey.filters.ContentSecurityPolicyFilter;
import org.labkey.api.view.WebPartFactory;
import org.quartz.JobKey;
Expand All @@ -41,6 +43,8 @@

public class TestResultsModule extends DefaultModule
{
private static final Logger LOG = LogHelper.getLogger(TestResultsModule.class, "Test results module");

public static final WebPartFactory _testResultsFactory = new TestResultsWebPart();
public static final String JOB_NAME = "TestResultsEmailTrigger";
public static final String JOB_GROUP = "TestResultsGroup";
Expand Down Expand Up @@ -124,7 +128,7 @@ public void startBackgroundThreads()
}
catch (SchedulerException e)
{
e.printStackTrace();
LOG.error("Failed to start the test results email scheduler", e);
}

}
Expand Down
6 changes: 5 additions & 1 deletion testresults/src/org/labkey/testresults/TestResultsWebPart.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,8 +15,10 @@
*/
package org.labkey.testresults;

import org.apache.logging.log4j.Logger;
import org.jetbrains.annotations.NotNull;
import org.labkey.api.data.Container;
import org.labkey.api.util.logging.LogHelper;
import org.labkey.api.view.BaseWebPartFactory;
import org.labkey.api.view.JspView;
import org.labkey.api.view.Portal;
Expand All @@ -30,6 +32,8 @@

public class TestResultsWebPart extends BaseWebPartFactory
{
private static final Logger LOG = LogHelper.getLogger(TestResultsWebPart.class, "Test results web part");

public TestResultsWebPart()
{
super("Test Results", true, false, WebPartFactory.LOCATION_BODY);
Expand All @@ -46,7 +50,7 @@ public WebPartView<?> getWebPartView(@NotNull ViewContext portalCtx, Portal.@Not
}
catch (ParseException | IOException e)
{
e.printStackTrace();
LOG.error("Failed to build the test results web part data", e);
}
JspView<TestsDataBean> view = new JspView<>("/org/labkey/testresults/view/rundown.jsp", bean);
view.setTitle("Test Results");
Expand Down
Loading
Loading