From 8093dc062df7798090d42ad145396fdf5a72c89b Mon Sep 17 00:00:00 2001
From: davelopez <46503462+davelopez@users.noreply.github.com>
Date: Fri, 15 Sep 2023 16:49:57 +0200
Subject: [PATCH 1/6] Fix Chart legend not scrollable

---
 .../Visualizations/Charts/BarChart.vue        | 23 ++++++++++++-------
 1 file changed, 15 insertions(+), 8 deletions(-)

diff --git a/client/src/components/User/DiskUsage/Visualizations/Charts/BarChart.vue b/client/src/components/User/DiskUsage/Visualizations/Charts/BarChart.vue
index 94015c3716ed..d1809d4eb1f8 100644
--- a/client/src/components/User/DiskUsage/Visualizations/Charts/BarChart.vue
+++ b/client/src/components/User/DiskUsage/Visualizations/Charts/BarChart.vue
@@ -2,7 +2,6 @@
 import { BCard } from "bootstrap-vue";
 import { computed, onMounted, ref, watch } from "vue";
 import * as d3 from "d3";
-
 import type { DataValuePoint } from ".";
 
 interface BarChartProps {
@@ -184,6 +183,17 @@ function createLegend() {
         .attr("fill", "black")
         .text((d) => props.labelFormatter(d));
 
+    // Set the width of the SVG to the width of the widest entry
+    let maxWidth = 0;
+    for (const node of entries.nodes()) {
+        const width = (node as HTMLElement).getBoundingClientRect().width;
+        maxWidth = Math.max(maxWidth, width);
+    }
+    const svg = container.node()?.closest("svg");
+    if (svg) {
+        svg.setAttribute("width", `${maxWidth}`);
+    }
+
     return entries;
 }
 
@@ -294,7 +304,7 @@ function setTooltipPosition(mouseX: number, mouseY: number): void {
 </script>
 
 <template>
-    <b-card class="mb-3 mx-3">
+    <b-card class="mb-3">
         <template v-slot:header>
             <h3 class="text-center my-1">
                 <slot name="title">
@@ -337,7 +347,7 @@ function setTooltipPosition(mouseX: number, mouseY: number): void {
 }
 
 .bar-chart {
-    float: right;
+    float: left;
 
     &:deep(svg) {
         overflow: visible;
@@ -349,12 +359,9 @@ function setTooltipPosition(mouseX: number, mouseY: number): void {
 }
 
 .legend {
-    float: left;
+    float: right;
     height: 400px;
-
-    &:deep(svg) {
-        overflow: visible;
-    }
+    overflow: auto;
 
     &:deep(.legend-item) {
         font-size: 14px;

From 635ec57bf2702bebbafaa620015d8bd5434e5644 Mon Sep 17 00:00:00 2001
From: mvdbeek <m.vandenbeek@gmail.com>
Date: Tue, 19 Sep 2023 14:54:45 +0200
Subject: [PATCH 2/6] Add missing join condition in job search

Fixes https://help.galaxyproject.org/t/i-tried-to-run-a-new-workflow-but-it-stopped-scheduling-at-some-point-seems-like-a-better-error-message-is-in-order/10719
---
 lib/galaxy/managers/jobs.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/galaxy/managers/jobs.py b/lib/galaxy/managers/jobs.py
index 9a0da71b5003..d59daf5fd91e 100644
--- a/lib/galaxy/managers/jobs.py
+++ b/lib/galaxy/managers/jobs.py
@@ -513,7 +513,7 @@ def replace_dataset_ids(path, key, value):
                     e = aliased(model.HistoryDatasetAssociation)
                     query = query.add_columns(a.dataset_collection_element_id)
                     query = (
-                        query.join(a)
+                        query.join(a, a.job_id == model.Job.id)
                         .join(b, b.id == a.dataset_collection_element_id)
                         .join(
                             c,

From 1eabd6709ecd05a1c516345ac6ff2c7aceb77024 Mon Sep 17 00:00:00 2001
From: mvdbeek <m.vandenbeek@gmail.com>
Date: Wed, 20 Sep 2023 21:00:28 +0200
Subject: [PATCH 3/6] Fix job search query

We need to add the dataset_id to the select here (just like in the cases
below) ... just calling query.add_columns() doesn't change the query in
place.

Fixes the new error @bwlang ran into in https://help.galaxyproject.org/t/i-tried-to-run-a-new-workflow-but-it-stopped-scheduling-at-some-point-seems-like-a-better-error-message-is-in-order/10719
---
 lib/galaxy/managers/jobs.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/galaxy/managers/jobs.py b/lib/galaxy/managers/jobs.py
index d59daf5fd91e..e76208ce91d2 100644
--- a/lib/galaxy/managers/jobs.py
+++ b/lib/galaxy/managers/jobs.py
@@ -420,7 +420,7 @@ def replace_dataset_ids(path, key, value):
                     c = aliased(model.HistoryDatasetAssociation)
                     d = aliased(model.JobParameter)
                     e = aliased(model.HistoryDatasetAssociationHistory)
-                    query.add_columns(a.dataset_id)
+                    query = query.add_columns(a.dataset_id)
                     used_ids.append(a.dataset_id)
                     query = query.join(a, a.job_id == model.Job.id)
                     stmt = select([model.HistoryDatasetAssociation.id]).where(

From 7321492971dfe44498d7d494a880333cac46eef1 Mon Sep 17 00:00:00 2001
From: davelopez <46503462+davelopez@users.noreply.github.com>
Date: Thu, 21 Sep 2023 13:57:29 +0200
Subject: [PATCH 4/6] Makes sure collection_id is encoded

---
 lib/galaxy/managers/hdcas.py | 1 +
 1 file changed, 1 insertion(+)

diff --git a/lib/galaxy/managers/hdcas.py b/lib/galaxy/managers/hdcas.py
index c3136f03d941..cd288a1c45a7 100644
--- a/lib/galaxy/managers/hdcas.py
+++ b/lib/galaxy/managers/hdcas.py
@@ -314,6 +314,7 @@ def add_serializers(self):
             "contents_url": self.generate_contents_url,
             "job_state_summary": self.serialize_job_state_summary,
             "elements_datatypes": self.serialize_elements_datatypes,
+            "collection_id": self.serialize_id,
         }
         self.serializers.update(serializers)
 

From 1f068f3a5d80a58b73af3448cbd05ec0f4a89e55 Mon Sep 17 00:00:00 2001
From: davelopez <46503462+davelopez@users.noreply.github.com>
Date: Thu, 21 Sep 2023 14:03:02 +0200
Subject: [PATCH 5/6] Update json test samples

---
 .../providers/test/json/DatasetCollection.error.json          | 2 +-
 .../src/components/providers/test/json/DatasetCollection.json | 4 ++--
 .../providers/test/json/DatasetCollection.processing.json     | 4 ++--
 3 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/client/src/components/providers/test/json/DatasetCollection.error.json b/client/src/components/providers/test/json/DatasetCollection.error.json
index 4765b3b67952..71e6a8864546 100644
--- a/client/src/components/providers/test/json/DatasetCollection.error.json
+++ b/client/src/components/providers/test/json/DatasetCollection.error.json
@@ -11,7 +11,7 @@
     "name": "abcdef",
     "create_time": "2020-07-02T17:33:56.567412",
     "populated_state": "new",
-    "collection_id": 44,
+    "collection_id": "b887d74393f85b6d",
     "hid": 2,
     "job_source_id": "3da1fe6d8d16a505",
     "type_id": "dataset_collection-ba03619785539f8c",
diff --git a/client/src/components/providers/test/json/DatasetCollection.json b/client/src/components/providers/test/json/DatasetCollection.json
index 85b9cada9fd6..83957be08738 100644
--- a/client/src/components/providers/test/json/DatasetCollection.json
+++ b/client/src/components/providers/test/json/DatasetCollection.json
@@ -35,5 +35,5 @@
     "deleted": false,
     "populated": true,
     "update_time": "2020-06-26T14:22:58.435348",
-    "collection_id": 23
-}
\ No newline at end of file
+    "collection_id": "f09437b8822035f7"
+}
diff --git a/client/src/components/providers/test/json/DatasetCollection.processing.json b/client/src/components/providers/test/json/DatasetCollection.processing.json
index 890176225d11..423cca99d161 100644
--- a/client/src/components/providers/test/json/DatasetCollection.processing.json
+++ b/client/src/components/providers/test/json/DatasetCollection.processing.json
@@ -19,7 +19,7 @@
     "tags": [],
     "hid": 2,
     "url": "/api/histories/f7bb1edd6b95db62/contents/dataset_collections/ba03619785539f8c",
-    "collection_id": 44,
+    "collection_id": "b887d74393f85b6d",
     "job_state_summary": {
         "running": 3,
         "waiting": 0,
@@ -36,4 +36,4 @@
         "new": 0
     },
     "name": "Unzip on data 1"
-}
\ No newline at end of file
+}

From 5ff729d910a218ecfb26befae23c7503d7405d08 Mon Sep 17 00:00:00 2001
From: Dannon Baker <dannon.baker@gmail.com>
Date: Wed, 30 Aug 2023 16:38:11 -0400
Subject: [PATCH 6/6] Constrain http filesource by fetch_url_allowlist while
 still following redirects

---
 lib/galaxy/files/__init__.py     | 6 ++++++
 lib/galaxy/files/sources/http.py | 8 +++++++-
 2 files changed, 13 insertions(+), 1 deletion(-)

diff --git a/lib/galaxy/files/__init__.py b/lib/galaxy/files/__init__.py
index 20dc7d78d1f5..a16843d4a3fe 100644
--- a/lib/galaxy/files/__init__.py
+++ b/lib/galaxy/files/__init__.py
@@ -215,13 +215,16 @@ class ConfiguredFileSourcesConfig:
     def __init__(
         self,
         symlink_allowlist=None,
+        fetch_url_allowlist=None,
         library_import_dir=None,
         user_library_import_dir=None,
         ftp_upload_dir=None,
         ftp_upload_purge=True,
     ):
         symlink_allowlist = symlink_allowlist or []
+        fetch_url_allowlist = fetch_url_allowlist or []
         self.symlink_allowlist = symlink_allowlist
+        self.fetch_url_allowlist = fetch_url_allowlist
         self.library_import_dir = library_import_dir
         self.user_library_import_dir = user_library_import_dir
         self.ftp_upload_dir = ftp_upload_dir
@@ -233,6 +236,7 @@ def from_app_config(config):
         # for this component.
         kwds = {}
         kwds["symlink_allowlist"] = getattr(config, "user_library_import_symlink_allowlist", [])
+        kwds["fetch_url_allowlist"] = getattr(config, "fetch_url_allowlist", [])
         kwds["library_import_dir"] = getattr(config, "library_import_dir", None)
         kwds["user_library_import_dir"] = getattr(config, "user_library_import_dir", None)
         kwds["ftp_upload_dir"] = getattr(config, "ftp_upload_dir", None)
@@ -242,6 +246,7 @@ def from_app_config(config):
     def to_dict(self):
         return {
             "symlink_allowlist": self.symlink_allowlist,
+            "fetch_url_allowlist": self.fetch_url_allowlist,
             "library_import_dir": self.library_import_dir,
             "user_library_import_dir": self.user_library_import_dir,
             "ftp_upload_dir": self.ftp_upload_dir,
@@ -252,6 +257,7 @@ def to_dict(self):
     def from_dict(as_dict):
         return ConfiguredFileSourcesConfig(
             symlink_allowlist=as_dict["symlink_allowlist"],
+            fetch_url_allowlist=as_dict["fetch_url_allowlist"],
             library_import_dir=as_dict["library_import_dir"],
             user_library_import_dir=as_dict["user_library_import_dir"],
             ftp_upload_dir=as_dict["ftp_upload_dir"],
diff --git a/lib/galaxy/files/sources/http.py b/lib/galaxy/files/sources/http.py
index 83ecd3b0b9e2..e3f2bcc8a0f4 100644
--- a/lib/galaxy/files/sources/http.py
+++ b/lib/galaxy/files/sources/http.py
@@ -9,6 +9,7 @@
 
 from typing_extensions import Unpack
 
+from galaxy.files.uris import validate_non_local
 from galaxy.util import (
     DEFAULT_SOCKET_TIMEOUT,
     get_charset_from_http_headers,
@@ -45,6 +46,10 @@ def __init__(self, **kwd: Unpack[FilesSourceProperties]):
         self._url_regex = re.compile(self._url_regex_str)
         self._props = props
 
+    @property
+    def _allowlist(self):
+        return self._file_sources_config.fetch_url_allowlist
+
     def _realize_to(
         self, source_path: str, native_path: str, user_context=None, opts: Optional[FilesSourceOptions] = None
     ):
@@ -52,10 +57,11 @@ def _realize_to(
         extra_props: HTTPFilesSourceProperties = cast(HTTPFilesSourceProperties, opts.extra_props or {} if opts else {})
         headers = props.pop("http_headers", {}) or {}
         headers.update(extra_props.get("http_headers") or {})
-
         req = urllib.request.Request(source_path, headers=headers)
 
         with urllib.request.urlopen(req, timeout=DEFAULT_SOCKET_TIMEOUT) as page:
+            # Verify url post-redirects is still allowlisted
+            validate_non_local(page.geturl(), self._allowlist)
             f = open(native_path, "wb")  # fd will be .close()ed in stream_to_open_named_file
             return stream_to_open_named_file(
                 page, f.fileno(), native_path, source_encoding=get_charset_from_http_headers(page.headers)