Skip to content

[bot] Fast-forward for 25.11.20 #306

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
github-actions merged 7 commits into from
Jul 20, 2026
Merged

[bot] Fast-forward for 25.11.20 #306

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
7 commits
Select commit Hold shift + click to select a range
5a5bd07
Scope laboratory assay protocol lookups to the request container (#286)
labkey-martyp Jun 22, 2026
ab2575e
Escape HTML in LDKController to prevent XSS (#288)
labkey-martyp Jun 22, 2026
ab59619
LaboratoryController: Use java DOM API instead of StringBuilder
labkey-alan Jun 22, 2026
9bca4ec
LaboratoryController: Use java DOM API instead of StringBuilder (#289)
labkey-alan Jun 23, 2026
47ca924
Merge 25.7 to 25.11
labkey-tchad Jun 26, 2026
c9c4f6f
Use UpdateService instead of raw DbSchema layer for assay_template ed…
bbimber Jun 29, 2026
c74963f
Merge 25.7 to 25.11
labkey-teamcity Jul 3, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 4 additions & 3 deletions LDK/src/org/labkey/ldk/LDKController.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -92,6 +92,7 @@
import java.util.Map;
import java.util.Set;
import java.util.function.Predicate;
import java.util.stream.Collectors;

public class LDKController extends SpringActionController
{
Expand Down Expand Up @@ -439,9 +440,9 @@ public ModelAndView getView(Object form, BindException errors) throws Exception
List<String> messages = service.validateContainerScopedTables(false);

String sb = "This page is designed to inspect all registered container scoped tables and report any tables with duplicate keys in the same container. This should be enforced by the user schema; however, direct DB inserts will bypass this check.<p>" +
StringUtils.join(messages, "<br>");
messages.stream().map(PageFlowUtil::filter).collect(Collectors.joining("<br>"));

return new HtmlView(HtmlString.of(sb));
return new HtmlView(HtmlString.unsafe(sb));
}

@Override
Expand Down Expand Up @@ -912,7 +913,7 @@ public ModelAndView getView(Object form, BindException errors) throws Exception
}
catch (URISyntaxException e)
{
return new HtmlView(HtmlString.unsafe("Invalid redirect URL set: " + urlString));
return new HtmlView(HtmlString.of("Invalid redirect URL set: " + urlString));
}
}
}
Expand Down
55 changes: 41 additions & 14 deletions laboratory/api-src/org/labkey/api/laboratory/assay/DefaultAssayParser.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,18 +20,19 @@
import org.apache.commons.beanutils.ConversionException;
import org.apache.commons.lang3.StringUtils;
import org.apache.logging.log4j.Level;
import org.apache.logging.log4j.Logger;
import org.apache.logging.log4j.LogManager;
import org.apache.logging.log4j.Logger;
import org.apache.poi.openxml4j.exceptions.InvalidFormatException;
import org.json.JSONArray;
import org.json.JSONObject;
import org.labkey.api.assay.AssayProvider;
import org.labkey.api.assay.AssayService;
import org.labkey.api.collections.CaseInsensitiveHashMap;
import org.labkey.api.data.Container;
import org.labkey.api.data.ContainerManager;
import org.labkey.api.data.ContainerType;
import org.labkey.api.data.ConvertHelper;
import org.labkey.api.data.DbSchema;
import org.labkey.api.data.RuntimeSQLException;
import org.labkey.api.data.SimpleFilter;
import org.labkey.api.data.Table;
import org.labkey.api.data.TableInfo;
import org.labkey.api.data.TableSelector;
import org.labkey.api.exp.PropertyDescriptor;
Expand All @@ -44,14 +45,14 @@
import org.labkey.api.laboratory.LaboratoryService;
import org.labkey.api.query.BatchValidationException;
import org.labkey.api.query.FieldKey;
import org.labkey.api.query.QueryService;
import org.labkey.api.query.UserSchema;
import org.labkey.api.query.ValidationException;
import org.labkey.api.reader.ColumnDescriptor;
import org.labkey.api.reader.ExcelFactory;
import org.labkey.api.reader.Readers;
import org.labkey.api.reader.TabLoader;
import org.labkey.api.security.User;
import org.labkey.api.assay.AssayProvider;
import org.labkey.api.assay.AssayService;
import org.labkey.api.util.FileType;
import org.labkey.api.util.JsonUtil;
import org.labkey.api.util.Pair;
Expand Down Expand Up @@ -466,10 +467,16 @@ protected void saveTemplate(ViewContext ctx, int templateId, long runId) throws
{
try
{
//validate the template exists
TableInfo ti = DbSchema.get("laboratory").getTable("assay_run_templates");
//validate the template exists. Note: this should always act against the current container, even if the container is a workbook (e.g., it should not allow cross-workbook actions)
UserSchema us = QueryService.get().getUserSchema(ctx.getUser(), ctx.getContainer(), "laboratory");
if (us == null)
{
throw new IllegalStateException("The laboratory schema is not available in container: " + ctx.getContainer().getPath());
}

TableInfo ti = us.getTable("assay_run_templates");
TableSelector ts = new TableSelector(ti, new SimpleFilter(FieldKey.fromString("rowid"), templateId), null);
if (ts.getRowCount() == 0)
if (!ts.exists())
{
throw new BatchValidationException(Collections.singletonList(new ValidationException("Unknown template: " + templateId)), null);
}
Expand All @@ -478,11 +485,15 @@ protected void saveTemplate(ViewContext ctx, int templateId, long runId) throws
row.put("runid", runId);
row.put("status", "Complete");

Table.update(ctx.getUser(), ti, row, templateId);
ti.getUpdateService().updateRows(ctx.getUser(), ctx.getContainer(), Arrays.asList(row), Arrays.asList(Map.of("rowid", templateId)), null, null);
}
catch (BatchValidationException e)
{
throw e;
}
catch (RuntimeSQLException e)
catch (Exception e)
{
throw new BatchValidationException(Collections.singletonList(new ValidationException(e.getSQLException().getMessage())), null);
throw new BatchValidationException(Collections.singletonList(new ValidationException(e.getMessage())), null);
}
}

Expand Down Expand Up @@ -584,8 +595,12 @@ protected Map<String, Map<String, Object>> getTemplateRowMap(ImportContext conte
if (templateId == null)
return ret;

TableInfo ti = DbSchema.get("laboratory").getTable("assay_run_templates");

UserSchema us = QueryService.get().getUserSchema(context.getViewContext().getUser(), context.getViewContext().getContainer().getContainerFor(ContainerType.DataType.tabParent), "laboratory");
if (us == null)
{
throw new IllegalStateException("Could not find the laboratory schema in container: " + context.getViewContext().getContainer().getContainerFor(ContainerType.DataType.tabParent).getPath());
}
TableInfo ti = us.getTable("assay_run_templates");
TableSelector ts = new TableSelector(ti, new SimpleFilter(FieldKey.fromString("rowid"), templateId), null);
Map<String, Object>[] maps = ts.getMapArray();
if (maps.length == 0)
Expand All @@ -595,6 +610,18 @@ protected Map<String, Map<String, Object>> getTemplateRowMap(ImportContext conte

Map<String, Object> map = maps[0];
JSONObject templateJson = new JSONObject((String)map.get("json"));

// This enforces that the request and existing record are from the same container, including for workbook/parents:
Container rowContainer = ContainerManager.getForId(String.valueOf(map.get("container")));
if (rowContainer == null)
{
throw new IllegalStateException("Unable to determine the container for template: " + templateId);
}
else if (!rowContainer.equals(context.getViewContext().getContainer()))
{
throw new IllegalStateException("Template is from the wrong container: " + templateId);
}

JSONArray rows = templateJson.getJSONArray("ResultRows");
for (JSONObject row : JsonUtil.toJSONObjectList(rows))
{
Expand Down
Loading
Loading