Merge remote-tracking branch 'origin/release26.7-SNAPSHOT' into 26.7_fb_pg14_mutlitabMetric

Author: labkey-jeckels

api/src/org/labkey/api/data/DataColumn.java

@@ -191,6 +191,12 @@ protected ColumnInfo getDisplayField(@NotNull ColumnInfo col, boolean withLookup
         return null==display ? col : display;
     }
 
+    @Override
+    public void setWithLookup(boolean withLookup)
+    {
+        _displayColumn = withLookup ? getDisplayField(_boundColumn, true) : _boundColumn;
+    }
+
     @Override
     public String toString()
     {

api/src/org/labkey/api/data/DisplayColumn.java

@@ -1232,6 +1232,11 @@ public void setRequiresHtmlFiltering(boolean requiresHtmlFiltering)
         _requiresHtmlFiltering = requiresHtmlFiltering;
     }
 
+    public void setWithLookup(boolean withLookup)
+    {
+        // subclasses override as needed
+    }
+
     public void setLinkTarget(String linkTarget)
     {
         _linkTarget = linkTarget;

api/src/org/labkey/api/data/dialect/SqlDialect.java

@@ -59,6 +59,7 @@
 import org.labkey.api.module.ModuleLoader;
 import org.labkey.api.query.FieldKey;
 import org.labkey.api.util.ExceptionUtil;
+import org.labkey.api.util.HtmlString;
 import org.labkey.api.util.MemTracker;
 import org.labkey.api.util.StringUtilsLabKey;
 import org.labkey.api.util.SystemMaintenance;
@@ -80,6 +81,8 @@
 import java.sql.SQLException;
 import java.sql.Statement;
 import java.sql.Types;
+import java.time.Duration;
+import java.time.LocalDateTime;
 import java.util.ArrayList;
 import java.util.Arrays;
 import java.util.Calendar;
@@ -95,6 +98,7 @@
 import java.util.regex.Pattern;
 
 import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertFalse;
 import static org.junit.Assert.assertThrows;
 import static org.junit.Assert.assertTrue;
 
@@ -168,7 +172,7 @@ public String getOtherDatabaseThreads()
     {
         StringBuilder sb = new StringBuilder();
 
-        // Per 18789, also include threads without db connections.
+        // Per Issue 18789, also include threads without db connections.
         List<Thread> dbThreads = new ArrayList<>();
 
         for (Map.Entry<Thread, StackTraceElement[]> entry : Thread.getAllStackTraces().entrySet())
@@ -863,25 +867,25 @@ public SQLFragment getNumericCast(SQLFragment expression)
      * @param arguments Arguments passed from the LK SQL
      * @return the dialect equivalent SQLFragrment
      */
-    public SQLFragment getGreatestAndLeastSQL(String method, SQLFragment... arguments)
-    {
-        throw new UnsupportedOperationException(getClass().getSimpleName() + " does not implement");
-    }
-
-    public boolean supportsIsNumeric()
-    {
-        return false;
-    }
-
-    public SQLFragment isNumericExpr(SQLFragment expression)
-    {
-        throw new UnsupportedOperationException(getClass().getSimpleName() + " does not implement");
-    }
-
-    public void handleCreateDatabaseException(SQLException e) throws ServletException
-    {
-        throw(new ServletException("Can't create database", e));
-    }
+    public SQLFragment getGreatestAndLeastSQL(String method, SQLFragment... arguments)
+    {
+        throw new UnsupportedOperationException(getClass().getSimpleName() + " does not implement");
+    }
+
+    public boolean supportsIsNumeric()
+    {
+        return false;
+    }
+
+    public SQLFragment isNumericExpr(SQLFragment expression)
+    {
+        throw new UnsupportedOperationException(getClass().getSimpleName() + " does not implement");
+    }
+
+    public void handleCreateDatabaseException(SQLException e) throws ServletException
+    {
+        throw(new ServletException("Can't create database", e));
+    }
 
     /**
      * Wrap one or more INSERT statements to allow explicit specification
@@ -1990,12 +1994,61 @@ public final Collection<String> getExecutionPlan(DbScope scope, SQLFragment sql,
     // Add any database configuration warnings (e.g., missing aggregate function or deprecated database server version)
     // to display in the page header for administrators. This will be called:
     // - Only on the LabKey DataSource's dialect instance (not external data sources)
-    // - After the core module has been upgraded and the dialect has been prepared for the last time, meaning the dialect
+    // - After the core module has been upgraded, and the dialect has been prepared for the last time, meaning the dialect
     //   should reflect the final database configuration
     public void addAdminWarningMessages(Warnings warnings, boolean showAllWarnings)
     {
     }
 
+    public static final long TIME_DIFFERENCE_WARNING_SECONDS = 10;
+
+    public static ServerDatabaseTimeDifference getServerDatabaseTimeDifference(DbScope scope)
+    {
+        // Compare LocalDateTime to capture any difference in server and database times (skew or timezone).
+        LocalDateTime serverTime = LocalDateTime.now();
+        LocalDateTime databaseTime = new SqlSelector(scope, "SELECT CURRENT_TIMESTAMP").getObject(LocalDateTime.class);
+
+        return new ServerDatabaseTimeDifference(serverTime, databaseTime);
+    }
+
+    public record ServerDatabaseTimeDifference(LocalDateTime serverTime, LocalDateTime databaseTime)
+    {
+        public long getSeconds()
+        {
+            return Math.abs(Duration.between(serverTime, databaseTime).toSeconds());
+        }
+
+        public boolean exceedsWarningThreshold()
+        {
+            return getSeconds() > TIME_DIFFERENCE_WARNING_SECONDS;
+        }
+    }
+
+    // GH Issue #1223: Add a site configuration warning for administrators if the server and database clocks differ.
+    protected void addTimeDifferenceWarning(Warnings warnings, boolean showAllWarnings)
+    {
+        try
+        {
+            ServerDatabaseTimeDifference difference = getServerDatabaseTimeDifference(DbScope.getLabKeyScope());
+
+            if (difference.exceedsWarningThreshold())
+                warnings.add(getTimeDifferenceWarning(difference.getSeconds()));
+            else if (showAllWarnings)
+                warnings.add(getTimeDifferenceWarning(TIME_DIFFERENCE_WARNING_SECONDS + 1));
+        }
+        catch (Exception e)
+        {
+            LOG.warn("Unable to compare web server and database server times", e);
+        }
+    }
+
+    private HtmlString getTimeDifferenceWarning(long seconds)
+    {
+        return HtmlString.of("The web server and database server times differ by " + seconds + " seconds. " +
+            "LabKey Server often relies on comparing timestamps stored in the database with timestamps generated by " +
+            "the web server, so this difference can lead to data integrity issues. Synchronize the clocks on these servers.");
+    }
+
     public abstract List<SQLFragment> getChangeStatements(TableChange change);
 
     public abstract void purgeTempSchema(Map<String, TempTableTracker> createdTableNames);
@@ -2017,7 +2070,7 @@ protected void trackTempTables(Map<String, TempTableTracker> createdTableNames)
     // Defragment an index, if necessary
     public void defragmentIndex(DbSchema schema, String tableSelectName, String indexName)
     {
-        // By default do nothing
+        // By default, do nothing
     }
 
     public boolean isTableExists(DbScope scope, String schema, String name)
@@ -2045,7 +2098,7 @@ public boolean hasTriggers(DbSchema scope, String schema, String tableName)
 
     /**
      *
-     * @return true If the dialect is one supported for the backend LabKey database. ie, Postgres or SQL Server
+     * @return true If the dialect is one supported for the backend LabKey database. i.e., Postgres or SQL Server
      */
     public boolean isLabKeyDbDialect()
     {
@@ -2419,5 +2472,37 @@ public void testProcedureIdentifierQuoting()
             // A dotted name is rejected: schema and procedure are separate parameters, so a '.' in a single component is an ambiguous schema-qualified reference
             assertThrows(IllegalArgumentException.class, () -> dialect.buildProcedureCall(core.getName(), "a.b", 0, false, false, scope));
         }
+
+        // GH Issue #1223: Verify the server/database clock-skew arithmetic and warning threshold
+        @Test
+        public void testServerDatabaseTimeDifference()
+        {
+            LocalDateTime base = LocalDateTime.of(2026, 7, 6, 12, 0, 0);
+
+            // Identical times: zero difference, no warning
+            ServerDatabaseTimeDifference equal = new ServerDatabaseTimeDifference(base, base);
+            assertEquals(0, equal.getSeconds());
+            assertFalse(equal.exceedsWarningThreshold());
+
+            // Comfortably below the threshold: no warning
+            ServerDatabaseTimeDifference below = new ServerDatabaseTimeDifference(base, base.plusSeconds(5));
+            assertEquals(5, below.getSeconds());
+            assertFalse(below.exceedsWarningThreshold());
+
+            // Exactly at the threshold: no warning (comparison is strictly greater-than)
+            ServerDatabaseTimeDifference atThreshold = new ServerDatabaseTimeDifference(base, base.plusSeconds(TIME_DIFFERENCE_WARNING_SECONDS));
+            assertEquals(TIME_DIFFERENCE_WARNING_SECONDS, atThreshold.getSeconds());
+            assertFalse(atThreshold.exceedsWarningThreshold());
+
+            // Just past the threshold: warning
+            ServerDatabaseTimeDifference over = new ServerDatabaseTimeDifference(base, base.plusSeconds(TIME_DIFFERENCE_WARNING_SECONDS + 1));
+            assertEquals(TIME_DIFFERENCE_WARNING_SECONDS + 1, over.getSeconds());
+            assertTrue(over.exceedsWarningThreshold());
+
+            // Difference is absolute: database clock behind the web server is treated the same as ahead
+            ServerDatabaseTimeDifference behind = new ServerDatabaseTimeDifference(base, base.minusSeconds(TIME_DIFFERENCE_WARNING_SECONDS + 1));
+            assertEquals(TIME_DIFFERENCE_WARNING_SECONDS + 1, behind.getSeconds());
+            assertTrue(behind.exceedsWarningThreshold());
+        }
     }
 }

api/src/org/labkey/api/security/AuthFilter.java

@@ -55,7 +55,6 @@ public class AuthFilter implements Filter
     private static final Object FIRST_REQUEST_LOCK = new Object();
 
     public static final String STRICT_TRANSPORT_SECURITY_HEADER_NAME = "Strict-Transport-Security";
-    public static final String X_FRAME_OPTIONS_HEADER_NAME = "X-Frame-Options";
     public static final String X_CONTENT_TYPE_OPTIONS_HEADER_NAME = "X-Content-Type-Options";
     public static final String REFERRER_POLICY_HEADER_NAME = "Referrer-Policy";
     public static final String SERVER_HEADER_NAME = "Server";
@@ -87,8 +86,6 @@ public void doFilter(ServletRequest request, ServletResponse response, FilterCha
 
         if (ModuleLoader.getInstance().isStartupComplete())
         {
-            if (!"ALLOW".equals(AppProps.getInstance().getXFrameOption()))
-                resp.setHeader(X_FRAME_OPTIONS_HEADER_NAME, AppProps.getInstance().getXFrameOption());
             resp.setHeader(X_CONTENT_TYPE_OPTIONS_HEADER_NAME, "nosniff");
             resp.setHeader(REFERRER_POLICY_HEADER_NAME, "origin-when-cross-origin" );
 

api/src/org/labkey/api/settings/AppProps.java

@@ -211,11 +211,6 @@ static WriteableAppProps getWriteableInstance()
 
     // configurable http security settings
 
-    /**
-     * @return "SAMEORIGIN" or "DENY" or "ALLOW"
-     */
-    String getXFrameOption();
-
     String getStaticFilesPrefix();
 
     boolean isWebfilesRootEnabled();

api/src/org/labkey/api/settings/AppPropsImpl.java

@@ -554,13 +554,6 @@ public boolean isAllowSessionKeys()
         return lookupBooleanValue(allowSessionKeys, false);
     }
 
-    @Override
-    public String getXFrameOption()
-    {
-        return lookupStringValue(XFrameOption, "SAMEORIGIN");
-    }
-
-
     private static final String not_init = "";
     private String staticFilesPrefix = not_init;
 

api/src/org/labkey/api/settings/SiteSettingsProperties.java

@@ -178,14 +178,6 @@ public void setValue(WriteableAppProps writeable, String value)
             writeable.setAdminOnlyMessage(value);
         }
     },
-    XFrameOption("Controls whether or not a browser may render a server page in a <frame> , <iframe> or <object>. Valid values: [SAMEORIGIN, ALLOW]")
-    {
-        @Override
-        public void setValue(WriteableAppProps writeable, String value)
-        {
-            writeable.setXFrameOption(value);
-        }
-    },
     navAccessOpen("Always include inaccessible parent folders in project menu when child folder is accessible")
     {
         @Override

api/src/org/labkey/api/settings/WriteableAppProps.java

@@ -225,11 +225,6 @@ public void setAllowSessionKeys(boolean b)
         storeBooleanValue(allowSessionKeys, b);
     }
 
-    public void setXFrameOption(String option)
-    {
-        storeStringValue(XFrameOption, option);
-    }
-
     public void setExternalRedirectHosts(@NotNull Collection<String> externalRedirectHosts)
     {
         setAllowList(externalRedirectHostURLs, externalRedirectHosts);

api/src/org/labkey/api/util/ExceptionUtil.java

@@ -833,7 +833,6 @@ static ActionURL handleException(@NotNull HttpServletRequest request, @NotNull H
                         ContentSecurityPolicyFilter.ContentSecurityPolicyType.Enforce.getHeaderName(),
                         ContentSecurityPolicyFilter.ContentSecurityPolicyType.Report.getHeaderName(),
                         AuthFilter.STRICT_TRANSPORT_SECURITY_HEADER_NAME,
-                        AuthFilter.X_FRAME_OPTIONS_HEADER_NAME,
                         AuthFilter.X_CONTENT_TYPE_OPTIONS_HEADER_NAME,
                         AuthFilter.REFERRER_POLICY_HEADER_NAME,
                         AuthFilter.SERVER_HEADER_NAME))
@@ -1106,7 +1105,6 @@ private static void renderErrorPage(Throwable ex, int responseStatus, String mes
             else
             {
                 pageConfig.setTemplate(originalConfig.getTemplate());
-                pageConfig.setFrameOption(originalConfig.getFrameOption());
             }
 
             HttpView<?> errorView = null;

api/src/org/labkey/api/util/PageFlowUtil.java

@@ -2696,6 +2696,16 @@ private static boolean shouldEscapeForExport(@NotNull String value)
         return StringUtils.containsAny(value,",\"");
     }
 
+    /// Generate one row of tab-delimited output using RFC 4180 quoting rules.
+    /// Fields containing tabs, newlines, or double quotes are enclosed in double quotes,
+    /// with embedded double quotes escaped by doubling.
+    public static String joinValuesWithTabs4180(@NotNull List<String> values)
+    {
+        return values.stream()
+                .map(value -> null == value ? "" : StringUtils.containsAny(value, "\t\n\r\"") ? "\"" + Strings.CS.replace(value, "\"", "\"\"") + "\"" : value)
+                .collect(Collectors.joining("\t"));
+    }
+
 
     static final String FIELD_ENCODED_PREFIX = "%_";