Skip to content

[bot] Merge 26.7 to develop #1173

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
github-actions wants to merge 6 commits into
base: develop
Choose a base branch
from
+20 −10
Open

[bot] Merge 26.7 to develop #1173

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
21d8347
Fix stored XSS in billing notification charge summary report (#1159)
labkey-martyp Jul 22, 2026
d7a1917
Merge 25.7 to 25.11
labkey-teamcity Jul 23, 2026
03c87a5
Only wrap ehr_lookups tables whose pseudo-PK differs from the real PK…
labkey-martyp Jul 23, 2026
307719c
Merge 25.11 to 26.3
labkey-teamcity Jul 24, 2026
5a81bc4
Merge 26.3 to 26.7
labkey-teamcity Jul 27, 2026
c44f580
Merge 26.7 to develop
labkey-teamcity Jul 28, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
16 changes: 13 additions & 3 deletions ehr/src/org/labkey/ehr/query/EHRLookupsUserSchema.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -212,10 +212,20 @@ else if (EHRSchema.TABLE_LOOKUP_SETS.equalsIgnoreCase(name))

// By default, any hard tables in the ehr_lookups schema not accounted for above will fall into one of the
// two categories below. Both of these will add a check that makes sure the user has EHRDataAdminPermission
// in order to insert/update/delete on the table. The ContainerScopedTable case is for those tables that
// have a true DB PK or rowid but a User pseudoPK that should be accounted for at the container level.
// in order to insert/update/delete on the table. The ContainerScopedTable case is for tables whose
// user-facing key (promoted via isKeyField in ehr_lookups.xml) differs from the true DB PK: the PK
// constraint does not enforce uniqueness of the pseudo-PK, so the wrapper enforces it per container and
// resolves the pseudo-PK to the real PK on update. Tables whose user-facing key is the true PK
// (e.g. project_types) get CustomPermissionsTable instead: the PK constraint already enforces uniqueness,
// and container-scoping such a table made its key column non-insertable in the UI.
String pkColName = getPkColName(ti);
if (pkColName != null && !"rowid".equalsIgnoreCase(pkColName) && ti.getColumn("container") != null)
List<String> realPk = ti instanceof FilteredTable<?> ft
? ft.getRealTable().getPkColumnNames()
: _dbSchema.getTable(name).getPkColumnNames();
boolean singleColumnPks = pkColName != null && realPk.size() == 1;
boolean realPkMatchesPseudoPk = singleColumnPks && realPk.get(0).equalsIgnoreCase(pkColName);

if (singleColumnPks && !realPkMatchesPseudoPk && ti.getColumn("container") != null)
return getContainerScopedTable(name, cf, pkColName, EHRDataAdminPermission.class);
else
return getCustomPermissionTable(createSourceTable(name), cf, EHRDataAdminPermission.class);
Expand Down
14 changes: 7 additions & 7 deletions ehr_billing/src/org/labkey/ehr_billing/notification/BillingNotification.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -464,8 +464,8 @@ protected void createChargeSummaryReport(final StringBuilder msg, Date lastInvoi

String baseUrl = createURL(containerMap.get(category), centerSpecificBillingSchema, categoryToQuery.get(category), null) + "&query.param.StartDate=" + getDateFormat(c).format(start.getTime()) + "&query.param.EndDate=" + getDateFormat(c).format(endDate.getTime());
String projUrl = baseUrl + ("None".equals(tokens[1]) ? "&query.project~isblank" : "&query.project~eq=" + tokens[1]);
msg.append("<tr><td>" + financialAnalyst + "</td>"); //the FA
msg.append("<td><a href='" + projUrl + "'>" + tokens[1] + "</a></td>");
msg.append("<tr><td>" + PageFlowUtil.filter(financialAnalyst) + "</td>"); //the FA
msg.append("<td><a href='" + PageFlowUtil.filter(projUrl) + "'>" + PageFlowUtil.filter(tokens[1]) + "</a></td>");

String accountUrl = null;
Container financeContainer = EHR_BillingManager.get().getBillingContainer(containerMap.get(category));
Expand All @@ -476,22 +476,22 @@ protected void createChargeSummaryReport(final StringBuilder msg, Date lastInvoi

if (accountUrl != null)
{
msg.append("<td><a href='" + accountUrl + "'>" + tokens[2] + "</a></td>");
msg.append("<td><a href='" + PageFlowUtil.filter(accountUrl) + "'>" + PageFlowUtil.filter(tokens[2]) + "</a></td>");
}
else
{
msg.append("<td>" + (tokens[2]) + "</td>");
msg.append("<td>" + PageFlowUtil.filter(tokens[2]) + "</td>");
}

msg.append("<td>" + (tokens[3]) + "</td>");
msg.append("<td>" + category + "</td>");
msg.append("<td>" + PageFlowUtil.filter(tokens[3]) + "</td>");
msg.append("<td>" + PageFlowUtil.filter(category) + "</td>");

for (FieldDescriptor fd : foundCols)
{
if (totals.containsKey(fd.getFieldName()))
{
String url = projUrl + fd.getFilter();
msg.append("<td" + (fd.isShouldHighlight() ? " style='background-color: yellow;'" : "") + "><a href='" + url + "'>" + totals.get(fd.getFieldName()) + "</a></td>");
msg.append("<td" + (fd.isShouldHighlight() ? " style='background-color: yellow;'" : "") + "><a href='" + PageFlowUtil.filter(url) + "'>" + totals.get(fd.getFieldName()) + "</a></td>");
}
else
{
Expand Down