Merge branch 'release26.3-SNAPSHOT' into 26.3_fb_register_later

labkey-danield · labkey-danield · commit f6e14df483ff · 2026-04-09T09:54:52.000-07:00
diff --git a/api/src/org/labkey/api/exp/property/AbstractDomainKind.java b/api/src/org/labkey/api/exp/property/AbstractDomainKind.java
@@ -206,7 +206,7 @@ protected boolean getBlanksSql(Domain domain, DomainProperty prop, SQLFragment b
         else
         {
             // Issue 29047
-            blankRowsSQL.appendIdentifier(columnId).append(" IS NOT NULL");
+            blankRowsSQL.appendIdentifier(columnId).append(" IS NULL");
         }
         if (prop.isMvEnabled())
         {
diff --git a/api/src/org/labkey/api/query/QueryService.java b/api/src/org/labkey/api/query/QueryService.java
@@ -16,18 +16,38 @@
 
 package org.labkey.api.query;
 
+import jakarta.servlet.http.HttpSession;
 import org.apache.commons.collections4.SetValuedMap;
 import org.jetbrains.annotations.NotNull;
 import org.jetbrains.annotations.Nullable;
 import org.json.JSONObject;
 import org.labkey.api.audit.AuditHandler;
 import org.labkey.api.audit.DetailedAuditTypeEvent;
+import org.labkey.api.data.ColumnHeaderType;
+import org.labkey.api.data.ColumnInfo;
+import org.labkey.api.data.CompareType;
+import org.labkey.api.data.Container;
+import org.labkey.api.data.ContainerFilter;
+import org.labkey.api.data.DbSchema;
+import org.labkey.api.data.DisplayColumn;
+import org.labkey.api.data.Filter;
+import org.labkey.api.data.JdbcType;
+import org.labkey.api.data.MethodInfo;
+import org.labkey.api.data.MutableColumnInfo;
+import org.labkey.api.data.ParameterDescription;
+import org.labkey.api.data.ParameterDescriptionImpl;
+import org.labkey.api.data.QueryLogging;
+import org.labkey.api.data.Results;
+import org.labkey.api.data.SQLFragment;
+import org.labkey.api.data.Sort;
+import org.labkey.api.data.SqlSelector;
+import org.labkey.api.data.TableInfo;
+import org.labkey.api.data.TableSelector;
+import org.labkey.api.data.dialect.SqlDialect;
 import org.labkey.api.gwt.client.model.GWTPropertyDescriptor;
+import org.labkey.api.module.Module;
 import org.labkey.api.pipeline.PipelineJob;
 import org.labkey.api.query.column.ColumnInfoTransformer;
-import org.labkey.api.data.*;
-import org.labkey.api.data.dialect.SqlDialect;
-import org.labkey.api.module.Module;
 import org.labkey.api.query.column.ConceptURIColumnInfoTransformer;
 import org.labkey.api.query.snapshot.QuerySnapshotDefinition;
 import org.labkey.api.security.User;
@@ -41,7 +61,6 @@
 import org.labkey.data.xml.TableType;
 import org.springframework.web.servlet.mvc.Controller;
 
-import jakarta.servlet.http.HttpSession;
 import java.io.IOException;
 import java.sql.ResultSet;
 import java.sql.SQLException;
@@ -653,6 +672,13 @@ default MutableColumnInfo applyColumnTransformer(MutableColumnInfo col)
     @Nullable
     ContainerFilter getContainerFilterForLookups(Container container, User user);
 
+    /**
+     * Provides the configured ContainerFilter to utilize when requesting data that is being read
+     * within a folder context. Equivalent to the client side function in @labkey/components
+     */
+    @Nullable
+    ContainerFilter getContainerFilterForFolder(Container container, User user);
+
 
     interface SelectBuilder
     {
diff --git a/api/src/org/labkey/api/util/XmlBeansUtil.java b/api/src/org/labkey/api/util/XmlBeansUtil.java
@@ -132,6 +132,7 @@ public static void addComment(XmlTokenSource doc, String comment)
     public static final SAXParserFactory SAX_PARSER_FACTORY_ALLOWING_DOCTYPE;
     public static final XMLInputFactory XML_INPUT_FACTORY;
     public static final DocumentBuilderFactory DOCUMENT_BUILDER_FACTORY;
+    public static final DocumentBuilderFactory DOCUMENT_BUILDER_FACTORY_ALLOWING_DOCTYPE;
 
     static
     {
@@ -145,16 +146,9 @@ public static void addComment(XmlTokenSource doc, String comment)
             SAX_PARSER_FACTORY = saxParserFactory(false);
             SAX_PARSER_FACTORY_ALLOWING_DOCTYPE = saxParserFactory(true);
 
-            //noinspection XMLInputFactory
-            DOCUMENT_BUILDER_FACTORY = DocumentBuilderFactory.newInstance();
-            DOCUMENT_BUILDER_FACTORY.setNamespaceAware(true);
-            DOCUMENT_BUILDER_FACTORY.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
-            DOCUMENT_BUILDER_FACTORY.setFeature("http://xml.org/sax/features/external-general-entities", false);
-            DOCUMENT_BUILDER_FACTORY.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
-            DOCUMENT_BUILDER_FACTORY.setFeature("http://apache.org/xml/features/nonvalidating/load-external-dtd", false);
-            DOCUMENT_BUILDER_FACTORY.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true);
-            DOCUMENT_BUILDER_FACTORY.setXIncludeAware(false);
-            DOCUMENT_BUILDER_FACTORY.setExpandEntityReferences(false);
+            DOCUMENT_BUILDER_FACTORY = documentBuilderFactory(false);
+            // Use the ALLOWING_DOCTYPE variant when parsing XML that contains a <!DOCTYPE> declaration (e.g. NCBI's eSummary responses)
+            DOCUMENT_BUILDER_FACTORY_ALLOWING_DOCTYPE = documentBuilderFactory(true);
         }
         catch (ParserConfigurationException | SAXException e)
         {
@@ -181,4 +175,26 @@ private static SAXParserFactory saxParserFactory(boolean allowDocType) throws SA
         result.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true);
         return result;
     }
+
+    private static DocumentBuilderFactory documentBuilderFactory(boolean allowDocType) throws ParserConfigurationException
+    {
+        //noinspection XMLInputFactory
+        DocumentBuilderFactory result = DocumentBuilderFactory.newInstance();
+        result.setNamespaceAware(true);
+
+        // Disable features that could lead to XXE or other vulnerabilities.
+        // When allowDocType is true the DOCTYPE declaration is permitted. External entity
+        // resolution remains disabled, so XXE protection is still in effect.
+        if (!allowDocType)
+        {
+            result.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
+        }
+        result.setFeature("http://xml.org/sax/features/external-general-entities", false);
+        result.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
+        result.setFeature("http://apache.org/xml/features/nonvalidating/load-external-dtd", false);
+        result.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true);
+        result.setXIncludeAware(false);
+        result.setExpandEntityReferences(false);
+        return result;
+    }
 }
diff --git a/assay/package-lock.json b/assay/package-lock.json
diff --git a/assay/package.json b/assay/package.json
@@ -12,7 +12,7 @@
     "clean": "rimraf resources/web/assay/gen && rimraf resources/views/gen && rimraf resources/web/gen"
   },
   "dependencies": {
-    "@labkey/components": "7.21.0"
+    "@labkey/components": "7.21.4"
   },
   "devDependencies": {
     "@labkey/build": "8.9.0",
diff --git a/core/package-lock.json b/core/package-lock.json
diff --git a/core/package.json b/core/package.json
@@ -53,7 +53,7 @@
     }
   },
   "dependencies": {
-    "@labkey/components": "7.21.0",
+    "@labkey/components": "7.21.4",
     "@labkey/themes": "1.7.0"
   },
   "devDependencies": {
diff --git a/experiment/package-lock.json b/experiment/package-lock.json
diff --git a/experiment/package.json b/experiment/package.json
@@ -13,7 +13,7 @@
     "test-integration": "cross-env NODE_ENV=test jest --ci --runInBand -c test/js/jest.config.integration.js"
   },
   "dependencies": {
-    "@labkey/components": "7.21.0"
+    "@labkey/components": "7.21.4"
   },
   "devDependencies": {
     "@labkey/build": "8.9.0",
diff --git a/pipeline/package-lock.json b/pipeline/package-lock.json
diff --git a/pipeline/package.json b/pipeline/package.json
@@ -14,7 +14,7 @@
     "build-prod": "npm run clean && cross-env NODE_ENV=production PROD_SOURCE_MAP=source-map webpack --config node_modules/@labkey/build/webpack/prod.config.js --color --progress --profile"
   },
   "dependencies": {
-    "@labkey/components": "7.21.0"
+    "@labkey/components": "7.21.4"
   },
   "devDependencies": {
     "@labkey/build": "8.9.0",
diff --git a/query/src/org/labkey/query/QueryServiceImpl.java b/query/src/org/labkey/query/QueryServiceImpl.java
@@ -3516,6 +3516,40 @@ public ContainerFilter getContainerFilterForLookups(Container container, User us
         return type.create(container, user);
     }
 
+    @Override
+    @Nullable
+    public ContainerFilter getContainerFilterForFolder(Container container, User user)
+    {
+        // Check to see if product folders support is enabled.
+        if (container == null || !container.isProductFoldersEnabled())
+            return null;
+
+        if (isProductFoldersDataListingScopedToProject())
+        {
+            // When requesting data from a top-level folder context the ContainerFilter filters
+            // "down" the folder hierarchy for data.
+            if (container.isProject())
+            {
+                if (isProductFoldersAllFolderScopeEnabled())
+                    return ContainerFilter.Type.AllInProjectPlusShared.create(container, user);
+                return ContainerFilter.Type.CurrentAndSubfoldersPlusShared.create(container, user);
+            }
+
+            // When listing data in a folder scope return data scoped to the current
+            // folder when the experimental feature is enabled.
+            return ContainerFilter.Type.Current.create(container, user);
+        }
+
+        // When requesting data from a top-level folder context the ContainerFilter filters
+        // "down" the folder hierarchy for data.
+        if (container.isProject())
+            return ContainerFilter.Type.CurrentAndSubfoldersPlusShared.create(container, user);
+
+        // When requesting data from a sub-folder context the ContainerFilter filters
+        // "up" the folder hierarchy for data.
+        return ContainerFilter.Type.CurrentPlusProjectAndShared.create(container, user);
+    }
+
     @Override
     @Nullable
     public ContainerFilter.Type getContainerFilterTypeForLookups(Container container)
diff --git a/study/src/org/labkey/study/assay/StudyPublishManager.java b/study/src/org/labkey/study/assay/StudyPublishManager.java
@@ -1126,6 +1126,11 @@ public void autoLinkDerivedSamples(ExpSampleType sampleType, List<Long> keys, Co
                 qs.setQueryName(sampleType.getName());
                 qs.setBaseFilter(new SimpleFilter().addInClause(FieldKey.fromParts("RowId"), keys));
 
+                // GitHub Issue #901 : lineage sourced subject or timepoint information are not resolving in cross folder configurations
+                ContainerFilter cf = QueryService.get().getContainerFilterForFolder(container, user);
+                if (cf != null)
+                    qs.setContainerFilterName(cf.getType().name());
+
                 Map<StudyPublishService.LinkToStudyKeys, FieldKey> fieldKeyMap = StudyPublishService.get().getSamplePublishFieldKeys(user, container, sampleType, qs);
                 UserSchema userSchema = QueryService.get().getUserSchema(user, container, SamplesSchema.SCHEMA_NAME);
                 QueryView view = new QueryView(userSchema, qs, null);
@@ -1231,15 +1236,18 @@ public void autoLinkSamples(ExpSampleType sampleType, List<Map<FieldKey, Object>
                             for (Map<FieldKey, Object> row : results)
                             {
                                 Object timePointValue = getTimepointValue(row, publishKeys, visitBased, translateMap);
-                                if (row.containsKey(publishKeys.get(LinkToStudyKeys.ParticipantId)) && timePointValue != null)
+                                Object subjectId = row.get(publishKeys.get(LinkToStudyKeys.ParticipantId));
+                                if (subjectId != null  && timePointValue != null)
                                 {
                                     dataMaps.add(Map.of(
-                                            LinkToStudyKeys.ParticipantId.name(), row.get(publishKeys.get(LinkToStudyKeys.ParticipantId)),
+                                            LinkToStudyKeys.ParticipantId.name(), subjectId,
                                             timePointPropName, timePointValue,
                                             StudyPublishService.ROWID_PROPERTY_NAME, row.get(FieldKey.fromParts(StudyPublishService.ROWID_PROPERTY_NAME)),
                                             StudyPublishService.SOURCE_LSID_PROPERTY_NAME, sampleType.getLSID()
                                     ));
                                 }
+                                else
+                                    LOG.error("Failed to auto link samples to study for folder {}. Timepoint and subject ID were both not resolved.", container.getPath());
                             }
                         }
 

Original file line number	Diff line number	Diff line change
`@@ -206,7 +206,7 @@ protected boolean getBlanksSql(Domain domain, DomainProperty prop, SQLFragment b`
`206`	`206`	`else`
`207`	`207`	`{`
`208`	`208`	`// Issue 29047`
`209`		`- blankRowsSQL.appendIdentifier(columnId).append(" IS NOT NULL");`
	`209`	`+ blankRowsSQL.appendIdentifier(columnId).append(" IS NULL");`
`210`	`210`	`}`
`211`	`211`	`if (prop.isMvEnabled())`
`212`	`212`	`{`
Original file line number	Diff line number	Diff line change
`@@ -53,7 +53,7 @@`
`53`	`53`	`}`
`54`	`54`	`},`
`55`	`55`	`"dependencies": {`
`56`		`- "@labkey/components": "7.21.0",`
	`56`	`+ "@labkey/components": "7.21.4",`
`57`	`57`	`"@labkey/themes": "1.7.0"`
`58`	`58`	`},`
`59`	`59`	`"devDependencies": {`