August 2015 - galaxy-dev - lists.galaxyproject.org

default value for param type "color"
by Wolfgang Maier 16 Aug '15

16 Aug '15

Hi, I've started to explore the relatively new "color" parameter type, which is not explained in the ToolConfigSyntax section of the Wiki yet. It's a pretty neat new feature, but I haven't found a way to specify a default color yet (the color selection is always set to a very light orange initially). Is this possible yet? If not I think it should really be added. Best, Wolfgang

2 1

Problem with ChemicalToolBox dependencies
by Léo Biscassi 13 Aug '15

13 Aug '15

Hello everyone! I have a Problem when installing the tool ChemicalToolBox. The error occurs in eigen3 dependence: CMake Error: The following variables are used in this project, but They are set to NOTFOUND. PLEASE SET Them or make sure They are set and tested Correctly in the CMake files: GLUT_Xi_LIBRARY (ADVANCED) linked by target "openglsupport" in directory /home/leobiscassi/programs/galaxy/database/tmp/tmp-toolshed-mtdvbBrUS/eigen-eigen-2249f9c22fe8/unsupported/test GLUT_Xmu_LIBRARY (ADVANCED) linked by target "openglsupport" in directory /home/leobiscassi/programs/galaxy/database/tmp/tmp-toolshed-mtdvbBrUS/eigen-eigen-2249f9c22fe8/unsupported/test I'm with the prerequisites installed: * Python 2.6 or 2.7 * Standard C compiler, C ++ and Fortran compiler * Autotools * CMake * Cairo development files (used for PNG depictions) * Python development files * Libblas and liblapack development files * Java Runtime Environment (JRE, used by opsin and NPLs) And the packages installed according to the instructions on github [1]: Debian based systems: apt-get install build-essential cmake gfortran mercurial libcairo2-dev python-dev And the OpenGL package: apt-get install freeglut3-dev [1] https://github.com/bgruening/galaxytools/tree/master/chemicaltoolbox Has anyone had a similar experience? I am using ubuntu 14.04 Att. -- *Léo Biscassi* Facebook - https://pt-br.facebook.com/lbiscassi Linkedin - https://br.linkedin.com/in/leobiscassi Skype - biscassi.leo Twitter - https://twitter.com/leobiscassi -

2 1

Galaxy Tool Shed Security Vulnerability - Repository uploads
by Nate Coraor 12 Aug '15

12 Aug '15

*DESCRIPTION* A security vulnerability was recently discovered by Peter Cock at the James Hutton Institute that would allow a malicious actor to upload new versions to repositories on which they have not been granted access. *AFFECTED VERSIONS* This issue affects versions of the Tool Shed beginning with 15.01. Earlier versions are not affected. *IMPACT* Because the Tool Shed is used to install software in Galaxy, if exploited, the impact could result in arbitrary code execution on Galaxy servers if a malicious tool is uploaded to a previously trusted repository, and that compromised version is subsequently installed by a Galaxy administrator. As such, Tool Shed administrators are strongly encouraged to update immediately. *INSTRUCTIONS* To apply the fix, first identify your current Galaxy release version using the `git branch` or `hg branch` commands. If you are on a 'release_YY.MM' branch, you can update with: % git pull or: % hg pull -u The process above can also be used to update to the 15.07 release if you are on the 'master' git branch or the 'stable' hg branch. If you are on the 'master'/'stable' branch and wish to remain on your current Galaxy major release, check the 'lib/galaxy/version.py' file to determine your major release version, then update to the appropriate branch: % git checkout -b release_YY.MM origin/release_YY.MM % git pull or: % hg pull % hg update release_YY.MM For the changes to take effect, YOU MUST RESTART ALL TOOL SHED SERVER PROCESSES. On behalf of the Galaxy Committers, --nate

1 0

Galaxy Security Vulnerability - Reflected XSS
by Nate Coraor 12 Aug '15

12 Aug '15

*DESCRIPTION* A security vulnerability was recently discovered by Scott B. Szakonyi at The Center for Research Computing at the University of Notre Dame that would allow a malicious actor to exploit the workflow import form to cause a user's browser to execute javascript not originating from within Galaxy. This could allow the malicious actor to gain unauthorized access to Galaxy accounts or client data. *AFFECTED VERSIONS* This issue affects all known versions of Galaxy. In early 2015, the Galaxy Team performed a large XSS audit, the results of which were applied to versions 14.10 and later. Using Galaxy versions earlier than 14.10 is not advisable. *IMPACT* Exploitation of reflected XSS vulnerabilities typically requires some coordination, but the consequences of exploitation can result in data or account exposure, so the risk of leaving the issue unfixed is moderate. Administrators of affected servers are encouraged to update immediately. *INSTRUCTIONS* To apply the fix, first identify your current Galaxy release version using the `git branch` or `hg branch` commands. If you are on a 'release_YY.MM' branch, you can update with: % git pull or: % hg pull -u The process above can also be used to update to the 15.07 release if you are on the 'master' git branch or the 'stable' hg branch. If you are on the 'master'/'stable' branch and wish to remain on your current Galaxy major release, check the 'lib/galaxy/version.py' file to determine your major release version, then update to the appropriate branch: % git checkout -b release_YY.MM origin/release_YY.MM % git pull or: % hg pull % hg update release_YY.MM For the changes to take effect, YOU MUST RESTART ALL GALAXY SERVER PROCESSES. On behalf of the Galaxy Committers, --nate

1 0

Galaxy Security Vulnerability - Authentication framework with LDAP
by Nate Coraor 12 Aug '15

12 Aug '15

*DESCRIPTION* A security vulnerability was recently discovered by Nicola Soranzo at The Genome Analysis Centre that would allow unauthorized access to Galaxy accounts on Galaxy servers using the LDAP authentication framework plugin. This is due to the fact that LDAP may be configured to allow anonymous binds, and the LDAP plugin does not check that binding with the provided username/password was not anonymous. *AFFECTED VERSIONS* The authentication framework is a new feature as of the 15.05 Galaxy release, so earlier versions are not affected. In versions 15.05 and later, the LDAP plugin is not used by default, so only Galaxy servers which have been configured to use this new functionality are affected. Galaxy servers using upstream delegated authentication (where authentication is performed by the proxy server, e.g. Apache or nginx) are not affected. *IMPACT* Administrators of affected servers are STRONGLY encouraged to update immediately, as the vulnerability allows unauthorized access to Galaxy accounts. *INSTRUCTIONS* To apply the fix, first identify your current Galaxy release version using the `git branch` or `hg branch` commands. If you are on a 'release_YY.MM' branch, you can update with: % git pull or: % hg pull -u The process above can also be used to update to the 15.07 release if you are on the 'master' git branch or the 'stable' hg branch. If you are on the 'master'/'stable' branch and wish to remain on your current Galaxy major release, check the 'lib/galaxy/version.py' file to determine your major release version, then update to the appropriate branch: % git checkout -b release_YY.MM origin/release_YY.MM % git pull or: % hg pull % hg update release_YY.MM For the changes to take effect, YOU MUST RESTART ALL GALAXY SERVER PROCESSES. On behalf of the Galaxy Committers, --nate

1 0

Slow repsonses viewing histories
by Poole, Richard 12 Aug '15

12 Aug '15

Hi all, I am having trouble right now with my own personal account on my production server. Grid refreshes are taking a huge amount of time (e.g. when viewing ‘saved histories’ or even generating the dataset list for a single history). My account is very full of data (1TB), could it be this? There are no obvious messages in the logs though so I am a bit stumped as to why.I do not have the same trouble when impersonating other users with fairly full accounts. Perhaps a database issue (I do not know how to ‘cleanup’ the database or indeed Galaxy user accounts). Any thoughts? Thanks, Richard Richard J Poole PhD Wellcome Trust Fellow Department of Cell and Developmental Biology University College London 21 University Street, London WC1E 6DE Office (518 Rockefeller): +44 20 7679 6577 (int. 46577) Lab (529 Rockefeller): +44 20 7679 6133 (int. 46133)

6 15

[Galaxy-dev] user authentication (NIS)
by Floreline TOUCHARD 12 Aug '15

12 Aug '15

Hi, I read the doc about external authentication but I'm not sure to understand all of it (I'm a newbie). I would like to use both capacities of NIS : - the use of Linux login and password for access to Galaxy - and exploit the system user accounts to the restricted access on file/directory.Importing data would only be possible for an authorized Linux user. Same thing for running tools on data. I found this old post https://biostar.usegalaxy.org/p/554/ which is about what I intend to do, but is it possible now ? Will it change the way Galaxy stores the output of a tool ? For now my Galaxy instance stores the output in database/files/ in a new directory and probably use the job id to name it. With this authentication will Galaxy create a directory with the user's name and then a subdirectory for each tool output ? Thank you in advance, FT

2 1

bcftools 1.2 wrappers
by Eric Rasche 11 Aug '15

11 Aug '15

Howdy Tool Developers, I'm not seeing any wrappers for bcftools 1.2 in the toolsheds, figured I'd ask around in case someone else had progress on wrapping them. If not I'll generate wrappers this week. Cheers, Eric -- Eric Rasche Programmer II Center for Phage Technology Rm 312A, BioBio Texas A&M University College Station, TX 77843 404-692-2048 esr(a)tamu.edu

1 0

Security issues
by Scott Szakonyi 11 Aug '15

11 Aug '15

Hello all, In testing our servers for security vulnerabilities, we've detected some cross site scripting and SQL injection problem on our Galaxy server. Is that something that should be reported as a bug/problem? I did search the Trello board but didn't find any open security related items. Thanks! -- Scott B. Szakonyi Research Programmer *Center for Research Computing* 107 Information Technology Center Notre Dame, IN 46556 http://crc.nd.edu

2 2

Galaxy instance with multiple partitions
by Raymond Wan 11 Aug '15

11 Aug '15

Dear all, We are in the middle of setting up a local Galaxy instance on CentOS, but we have a problem with disk space. In particular, we do not have a single large disk partition but, instead, many medium sized ext4 partitions. Thus, we were wondering if it would be possible for Galaxy to use multiple disk partitions instead of a single one for data and intermediate files. Ideally, it would be great if we could allocate users to various groups, which in turn are allocated separate disk partitions. Less ideal, but still something we could work with, is to ask users to copy/move to/from the other partitions while one remains the "working one" for Galaxy. Another idea which I think wouldn't work since it would interfere with Galaxy is to move files (i.e., via a cron job) to another partition when a job is complete and then add a symbolic link to it from the "working" partition. Are there any suggestions on how I can get around this? Or are we stuck with either a single partition or somehow reformatting it and merging the partitions (using an xfs file system, etc.) Thank you! Ray

2 3