From 0d8fa2012c0f95e82590a51930c9cd7177c33b97 Mon Sep 17 00:00:00 2001
From: Greg Von Kuster <greg@bx.psu.edu>
Date: Wed, 18 Dec 2013 19:03:05 -0500
Subject: [PATCH 1/6] Fix for determining a guid in the install_manager.

---
 .../galaxy_install/install_manager.py         | 19 +++++++++----------
 1 file changed, 9 insertions(+), 10 deletions(-)

diff --git a/lib/tool_shed/galaxy_install/install_manager.py b/lib/tool_shed/galaxy_install/install_manager.py
index 302fe351c10..a15eb000769 100644
--- a/lib/tool_shed/galaxy_install/install_manager.py
+++ b/lib/tool_shed/galaxy_install/install_manager.py
@@ -244,21 +244,20 @@ class InstallManager( object ):
 
     def get_guid( self, repository_clone_url, relative_install_dir, tool_config ):
         if self.shed_config_dict.get( 'tool_path' ):
-            relative_install_dir = os.path.join( self.shed_config_dict['tool_path'], relative_install_dir )
-        found = False
+            relative_install_dir = os.path.join( self.shed_config_dict[ 'tool_path' ], relative_install_dir )
+        tool_config_filename = suc.strip_path( tool_config )
         for root, dirs, files in os.walk( relative_install_dir ):
             if root.find( '.hg' ) < 0 and root.find( 'hgrc' ) < 0:
                 if '.hg' in dirs:
                     dirs.remove( '.hg' )
                 for name in files:
-                    if name == tool_config:
-                        found = True
-                        break
-            if found:
-                break
-        full_path = str( os.path.abspath( os.path.join( root, name ) ) )
-        tool = self.toolbox.load_tool( full_path )
-        return suc.generate_tool_guid( repository_clone_url, tool )
+                    filename = suc.strip_path( name )
+                    if filename == tool_config_filename:
+                        full_path = str( os.path.abspath( os.path.join( root, name ) ) )
+                        tool = self.toolbox.load_tool( full_path )
+                        return suc.generate_tool_guid( repository_clone_url, tool )
+        # Not quite sure what should happen here, throw an exception or what?
+        return None
 
     def get_prior_install_required_dict( self, tool_shed_repositories, repository_dependencies_dict ):
         """

From 549461d4d93419f6c91dcdee8ab9a65272c5c2a1 Mon Sep 17 00:00:00 2001
From: Dannon Baker <dannon.baker@gmail.com>
Date: Thu, 19 Dec 2013 14:38:03 -0500
Subject: [PATCH 2/6] Fix workflow import url XSS.

---
 templates/webapps/galaxy/workflow/import.mako | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/templates/webapps/galaxy/workflow/import.mako b/templates/webapps/galaxy/workflow/import.mako
index fc50d54df9b..411f1ffb750 100644
--- a/templates/webapps/galaxy/workflow/import.mako
+++ b/templates/webapps/galaxy/workflow/import.mako
@@ -31,7 +31,7 @@
             <form name="import_workflow" id="import_workflow" action="${h.url_for( controller='workflow', action='import_workflow' )}" enctype="multipart/form-data" method="POST">
                 <div class="form-row">
                     <label>Galaxy workflow URL:</label> 
-                    <input type="text" name="url" value="${url}" size="40">
+                    <input type="text" name="url" value="${url | h}" size="40">
                     <div class="toolParamHelp" style="clear: both;">
                         If the workflow is accessible via a URL, enter the URL above and click <b>Import</b>.
                     </div>

From 28123bdde5de26e3eea7aa6acdc9df99f2bf3a70 Mon Sep 17 00:00:00 2001
From: Aysam Guerler <aysam.guerler@gmail.com>
Date: Thu, 2 Jan 2014 23:25:22 -0500
Subject: [PATCH 3/6] Fix XSS issue in former grids code

---
 templates/grid_base.mako | 19 ++++++++++++++-----
 1 file changed, 14 insertions(+), 5 deletions(-)

diff --git a/templates/grid_base.mako b/templates/grid_base.mako
index f6e8f8661d7..9bb5fd1dfb9 100644
--- a/templates/grid_base.mako
+++ b/templates/grid_base.mako
@@ -56,6 +56,14 @@
     ${h.js("libs/jquery/jquery.autocomplete", "galaxy.autocom_tagging", "libs/jquery/jquery.rating", "galaxy.grids" )}
     ${handle_refresh_frames()}
     
+    <%
+        self.grid_options = {
+            'sort_key' : sort_key,
+            'use_async' : grid.use_async,
+            'cur_page_num' : cur_page_num,
+            'num_pages' : num_pages
+        }
+    %>
     <script type="text/javascript">
         
         // Needed URLs for grid history searching.
@@ -65,6 +73,7 @@
         //
         // Create grid object.
         //
+        var grid_options = ${ h.to_json_string(self.grid_options) };
 
         // Operations that are async (AJAX) compatible.
         var async_ops = [];
@@ -83,20 +92,20 @@
 
         /** Returns true if string denotes true. */
         var is_true = function(s) { return _.indexOf(['True', 'true', 't'], s) !== -1; };
-
+        
         // Create grid.
         var grid = new Grid({
             url_base: '${trans.request.path_url}',
-            async: is_true('${grid.use_async}'),
+            async: is_true(grid_options.use_async),
             async_ops: async_ops,
             categorical_filters: categorical_filters,
             filters: ${h.to_json_string( cur_filter_dict )},
-            sort_key: '${sort_key}',
+            sort_key: grid_options.sort_key,
             show_item_checkboxes: is_true('${context.get('show_item_checkboxes', False)}'),
-            cur_page: ${cur_page_num},
+            cur_page: grid_options.cur_page_num,
             // persistent page="all"
             //cur_page: ('${cur_page_num}' === 'all')?('all'):(Number('${cur_page_num}')),
-            num_pages: ${num_pages}
+            num_pages: grid_options.num_pages
         });
 
         // Initialize grid objects on load.

From a46668624af144c29d8002d53631e7e33a4974fe Mon Sep 17 00:00:00 2001
From: Dannon Baker <dannon.baker@gmail.com>
Date: Tue, 7 Jan 2014 09:47:37 -0500
Subject: [PATCH 4/6] Update cloudlaunch default AMI

---
 lib/galaxy/config.py     | 2 +-
 universe_wsgi.ini.sample | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/lib/galaxy/config.py b/lib/galaxy/config.py
index fac71ed9ec6..9f8bdeba11f 100644
--- a/lib/galaxy/config.py
+++ b/lib/galaxy/config.py
@@ -299,7 +299,7 @@ class Configuration( object ):
         self.datatypes_config = kwargs.get( 'datatypes_config_file', 'datatypes_conf.xml' )
         # Cloud configuration options
         self.enable_cloud_launch = string_as_bool( kwargs.get( 'enable_cloud_launch', False ) )
-        self.cloudlaunch_default_ami = kwargs.get( 'cloudlaunch_default_ami', 'ami-118bfc78' )
+        self.cloudlaunch_default_ami = kwargs.get( 'cloudlaunch_default_ami', 'ami-a7dbf6ce' )
         # Galaxy messaging (AMQP) configuration options
         self.amqp = {}
         try:
diff --git a/universe_wsgi.ini.sample b/universe_wsgi.ini.sample
index 60af760ef9d..ade958bb95f 100644
--- a/universe_wsgi.ini.sample
+++ b/universe_wsgi.ini.sample
@@ -419,7 +419,7 @@ static_robots_txt = %(here)s/static/robots.txt
 # Cloud Launch
 
 #enable_cloud_launch = False
-#cloudlaunch_default_ami = ami-118bfc78
+#cloudlaunch_default_ami = ami-a7dbf6ce
 
 # -- Advanced proxy features
 

From d871db645663fc6607e591eb0e376f24779bb517 Mon Sep 17 00:00:00 2001
From: Daniel Blankenberg <dan@bx.psu.edu>
Date: Mon, 2 Dec 2013 14:48:30 -0500
Subject: [PATCH 5/6] Fix for missing eggs.require in
 lib/galaxy/exceptions/__init__.py.

---
 lib/galaxy/exceptions/__init__.py | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/lib/galaxy/exceptions/__init__.py b/lib/galaxy/exceptions/__init__.py
index 6fd4deb7a0f..c3bd4bde319 100644
--- a/lib/galaxy/exceptions/__init__.py
+++ b/lib/galaxy/exceptions/__init__.py
@@ -1,6 +1,10 @@
 """
 Custom exceptions for Galaxy
 """
+
+from galaxy import eggs
+eggs.require( "Paste" )
+
 from paste import httpexceptions
 
 class MessageException( Exception ):

From 5a8c6457b9f2062c90453a70a3c9c10fe3c1504f Mon Sep 17 00:00:00 2001
From: Nate Coraor <nate@bx.psu.edu>
Date: Thu, 9 Jan 2014 10:46:01 -0500
Subject: [PATCH 6/6] Fix username argument to PostgreSQL connection in
 pgcleanup.py

---
 scripts/cleanup_datasets/pgcleanup.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/scripts/cleanup_datasets/pgcleanup.py b/scripts/cleanup_datasets/pgcleanup.py
index fb4a2a106be..03bc5a07eb2 100755
--- a/scripts/cleanup_datasets/pgcleanup.py
+++ b/scripts/cleanup_datasets/pgcleanup.py
@@ -105,7 +105,7 @@ class Cleanup(object):
         url = make_url(self.config.database_connection)
 
         log.info('Connecting to database with URL: %s' % url)
-        args = url.translate_connect_args()
+        args = url.translate_connect_args( username='user' )
         args.update(url.query)
 
         assert url.get_dialect().name == 'postgresql', 'This script can only be used with PostgreSQL.'