From a2850d1b6b105e893d6264a32490fca2272bd21f Mon Sep 17 00:00:00 2001
From: MontrealSergiy <sergeboroday@gmail.com>
Date: Tue, 1 Apr 2025 19:01:09 -0400
Subject: [PATCH 01/11] confirm trust of file

---
 .../userfiles/html_file/views/_html.html.erb  | 24 +++++++++---
 BrainPortal/public/javascripts/cbrain.js      | 39 +++++++++++++++++++
 2 files changed, 58 insertions(+), 5 deletions(-)

diff --git a/BrainPortal/cbrain_plugins/cbrain-plugins-base/userfiles/html_file/views/_html.html.erb b/BrainPortal/cbrain_plugins/cbrain-plugins-base/userfiles/html_file/views/_html.html.erb
index 37a386454..61c86e896 100644
--- a/BrainPortal/cbrain_plugins/cbrain-plugins-base/userfiles/html_file/views/_html.html.erb
+++ b/BrainPortal/cbrain_plugins/cbrain-plugins-base/userfiles/html_file/views/_html.html.erb
@@ -36,15 +36,29 @@
     ) %>
 <% end %>
 <br>
-The HTML document previewed in the frame below is not part of CBRAIN. <em> You should <strong>not</strong> open it or
+The HTML document previewed in the frame below is not part of CBRAIN. <em> You should <strong>not</strong> browse  or
 interact with it unless you fully trust it. </em> Forms and external links are disabled.
 <br>
-<iframe sandbox="allow-scripts allow-same-origin"
-    src="<%= stream_userfile_path(@userfile, :disposition => 'inline')%>"
-    class="full-frame"
+
+<% if params[:new_tab].blank? %>
+     <div class="trust-file-btn"> <%= link_to 'Open in the frame below', "#" %></div>
+<% end %>
+<br>
+
+
+</div>
+<div class="iframe-container">
+  <iframe sandbox="allow-scripts allow-same-origin"
+    data-frame-url="<%= stream_userfile_path(@userfile, :disposition => 'inline') %>"
+    <% if params[:new_tab].present? %>
+      src="<%= stream_userfile_path(@userfile, :disposition => 'inline') %>"
+    <% end %>
+    data-ids="<%= "#{@userfile.id}-#{@userfile.user.id}" %>"
+    class="full-frame html-viewer"
     <% if params[:new_tab].present? # workaround to wide frame in a new tab %>
       style="height: 100%; width: 100%;"
     <% end %>
  >
     HTML Viewer
-</iframe>
+  </iframe>
+</div>
diff --git a/BrainPortal/public/javascripts/cbrain.js b/BrainPortal/public/javascripts/cbrain.js
index bba95fcd8..8cc0b2194 100644
--- a/BrainPortal/public/javascripts/cbrain.js
+++ b/BrainPortal/public/javascripts/cbrain.js
@@ -759,6 +759,45 @@
       form.submit();
     });
 
+    $(document).delegate(".trust-file-btn", "click", function (event) {
+      let trustBtn = $("body").find(".trust-file-btn");
+      let iframe = $("body").find('.html-viewer');
+      let iframeContainer = $("body").find('.iframe-container');
+      iframe.attr('src', iframe.data('frame-url'));
+      trustBtn.hide();
+      iframeContainer.show();
+
+    });
+
+    // confirm button for html viewer iframe
+    $('.trust-file-btn').each(function() {
+      let trustBtn = $(this);
+      let fileIds = trustBtn.data('ids');
+      let iframe = trustBtn.closest('iframe').find('.html-viewer');
+      let iframeContainer = trustBtn.closest('div').find('.iframe-container');
+
+      // If there's a valid fileId, proceed
+      if (fileIds) {
+        const trustKey = "trusted_file_" + fileIds;
+        const fileUrl = iframe.data('frame-url');
+
+        // Check if trust is already saved
+        if (localStorage.getItem(trustKey) === "true") {
+          iframe.attr('src', fileUrl);
+          trustBtn.hide();
+          iframeContainer.show();
+        }
+
+        // Click event for trusting the file
+        trustBtn.click(function() {
+          localStorage.setItem(trustKey, "true"); // Save trust for file id todo expire in 3 h?
+          iframe.attr('src', fileUrl);
+          $(this).hide();
+          iframeContainer.show();
+        });
+      }
+    });
+
 
     //html_tool_tip_code based on xstooltip provided by
     //http://www.texsoft.it/index.php?%20m=sw.js.htmltooltip&c=software&l=it

From 2ad06d42643660017f08be5c1caf38d219d3726a Mon Sep 17 00:00:00 2001
From: MontrealSergiy <sergeboroday@gmail.com>
Date: Wed, 2 Apr 2025 09:47:10 -0400
Subject: [PATCH 02/11] mark redundant lines

---
 .../userfiles/html_file/views/_html.html.erb                 | 1 +
 BrainPortal/public/javascripts/cbrain.js                     | 5 +++--
 2 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/BrainPortal/cbrain_plugins/cbrain-plugins-base/userfiles/html_file/views/_html.html.erb b/BrainPortal/cbrain_plugins/cbrain-plugins-base/userfiles/html_file/views/_html.html.erb
index 61c86e896..48a829e29 100644
--- a/BrainPortal/cbrain_plugins/cbrain-plugins-base/userfiles/html_file/views/_html.html.erb
+++ b/BrainPortal/cbrain_plugins/cbrain-plugins-base/userfiles/html_file/views/_html.html.erb
@@ -53,6 +53,7 @@ interact with it unless you fully trust it. </em> Forms and external links are d
     <% if params[:new_tab].present? %>
       src="<%= stream_userfile_path(@userfile, :disposition => 'inline') %>"
     <% end %>
+    <%# todo drop caching trust with ids? %>
     data-ids="<%= "#{@userfile.id}-#{@userfile.user.id}" %>"
     class="full-frame html-viewer"
     <% if params[:new_tab].present? # workaround to wide frame in a new tab %>
diff --git a/BrainPortal/public/javascripts/cbrain.js b/BrainPortal/public/javascripts/cbrain.js
index 8cc0b2194..44f06d246 100644
--- a/BrainPortal/public/javascripts/cbrain.js
+++ b/BrainPortal/public/javascripts/cbrain.js
@@ -769,7 +769,8 @@
 
     });
 
-    // confirm button for html viewer iframe
+    // todo delete this one or preceditng confirm button for html viewer iframe
+    // this one caches trust info in local storage
     $('.trust-file-btn').each(function() {
       let trustBtn = $(this);
       let fileIds = trustBtn.data('ids');
@@ -790,7 +791,7 @@
 
         // Click event for trusting the file
         trustBtn.click(function() {
-          localStorage.setItem(trustKey, "true"); // Save trust for file id todo expire in 3 h?
+          localStorage.setItem(trustKey, "true"); // Save trust for file/owner id todo expire in 3 h?
           iframe.attr('src', fileUrl);
           $(this).hide();
           iframeContainer.show();

From 28182af0aa32f933a0fa65c0b14eb7d7154fdbaa Mon Sep 17 00:00:00 2001
From: MontrealSergiy <sergeboroday@gmail.com>
Date: Tue, 8 Apr 2025 14:32:39 -0400
Subject: [PATCH 03/11] minor html improvement

---
 .../userfiles/html_file/views/_html.html.erb      | 15 ++++++++++-----
 1 file changed, 10 insertions(+), 5 deletions(-)

diff --git a/BrainPortal/cbrain_plugins/cbrain-plugins-base/userfiles/html_file/views/_html.html.erb b/BrainPortal/cbrain_plugins/cbrain-plugins-base/userfiles/html_file/views/_html.html.erb
index 48a829e29..50a293d72 100644
--- a/BrainPortal/cbrain_plugins/cbrain-plugins-base/userfiles/html_file/views/_html.html.erb
+++ b/BrainPortal/cbrain_plugins/cbrain-plugins-base/userfiles/html_file/views/_html.html.erb
@@ -40,19 +40,24 @@ The HTML document previewed in the frame below is not part of CBRAIN. <em> You s
 interact with it unless you fully trust it. </em> Forms and external links are disabled.
 <br>
 
-<% if params[:new_tab].blank? %>
-     <div class="trust-file-btn"> <%= link_to 'Open in the frame below', "#" %></div>
+<%# -- for other user's files ask confirmation %>
+<% if params[:new_tab].blank? && current_user.id != @userfile.user_id %>
+   <div class="trust-file-btn"> <%= link_to 'Browse this file in the frame below', "#iframe-container" %></div>
 <% end %>
 <br>
 
-
 </div>
-<div class="iframe-container">
+<div class="iframe-container" id="iframe-container">
   <iframe sandbox="allow-scripts allow-same-origin"
     data-frame-url="<%= stream_userfile_path(@userfile, :disposition => 'inline') %>"
-    <% if params[:new_tab].present? %>
+    <% unless params[:new_tab].blank? && current_user.id != @userfile.user_id %>
+
+
       src="<%= stream_userfile_path(@userfile, :disposition => 'inline') %>"
+
     <% end %>
+    class="full-frame html-viewer"
+
     <%# todo drop caching trust with ids? %>
     data-ids="<%= "#{@userfile.id}-#{@userfile.user.id}" %>"
     class="full-frame html-viewer"

From 8f8e518ec5d6e369c65dbb085c1a63ca632cac3f Mon Sep 17 00:00:00 2001
From: MontrealSergiy <sergeboroday@gmail.com>
Date: Wed, 16 Apr 2025 17:09:30 -0400
Subject: [PATCH 04/11] make frame hidden

---
 .../userfiles/html_file/views/_html.html.erb  | 20 ++++++++++---------
 BrainPortal/public/javascripts/cbrain.js      | 13 ++++++++++--
 2 files changed, 22 insertions(+), 11 deletions(-)

diff --git a/BrainPortal/cbrain_plugins/cbrain-plugins-base/userfiles/html_file/views/_html.html.erb b/BrainPortal/cbrain_plugins/cbrain-plugins-base/userfiles/html_file/views/_html.html.erb
index 50a293d72..56d663071 100644
--- a/BrainPortal/cbrain_plugins/cbrain-plugins-base/userfiles/html_file/views/_html.html.erb
+++ b/BrainPortal/cbrain_plugins/cbrain-plugins-base/userfiles/html_file/views/_html.html.erb
@@ -36,25 +36,27 @@
     ) %>
 <% end %>
 <br>
-The HTML document previewed in the frame below is not part of CBRAIN. <em> You should <strong>not</strong> browse  or
-interact with it unless you fully trust it. </em> Forms and external links are disabled.
+This HTML document is not part of CBRAIN. <em> You should <strong>not</strong> view or
+interact with it unless you fully trust it. </em> (Forms and external links are disabled.)
 <br>
 
 <%# -- for other user's files ask confirmation %>
-<% if params[:new_tab].blank? && current_user.id != @userfile.user_id %>
-   <div class="trust-file-btn"> <%= link_to 'Browse this file in the frame below', "#iframe-container" %></div>
+<% hide_frame = params[:new_tab].blank? && current_user.id != @userfile.user_id %>
+<% if hide_frame %>
+   <div class="trust-file-btn"> <%= link_to 'Show this HTML file below anyway', "#iframe-container" %></div>
 <% end %>
 <br>
 
 </div>
-<div class="iframe-container" id="iframe-container">
+<div class="iframe-container" id="iframe-container"
+  <% if hide_frame %>
+    hidden
+  <% end %>
+ >
   <iframe sandbox="allow-scripts allow-same-origin"
     data-frame-url="<%= stream_userfile_path(@userfile, :disposition => 'inline') %>"
-    <% unless params[:new_tab].blank? && current_user.id != @userfile.user_id %>
-
-
+    <% unless hide_frame %>
       src="<%= stream_userfile_path(@userfile, :disposition => 'inline') %>"
-
     <% end %>
     class="full-frame html-viewer"
 
diff --git a/BrainPortal/public/javascripts/cbrain.js b/BrainPortal/public/javascripts/cbrain.js
index 44f06d246..16ce7ddbf 100644
--- a/BrainPortal/public/javascripts/cbrain.js
+++ b/BrainPortal/public/javascripts/cbrain.js
@@ -765,8 +765,7 @@
       let iframeContainer = $("body").find('.iframe-container');
       iframe.attr('src', iframe.data('frame-url'));
       trustBtn.hide();
-      iframeContainer.show();
-
+      iframeContainer.show();  // css trumps html
     });
 
     // todo delete this one or preceditng confirm button for html viewer iframe
@@ -799,6 +798,16 @@
       }
     });
 
+    // show html on click only
+    $(document).delegate(".trust-file-btn", "click", function (event) {
+      let trustBtn = $("body").find(".trust-file-btn");
+      let iframe = $("body").find('.html-viewer');
+      let iframeContainer = $("body").find('.iframe-container');
+      iframe.attr('src', iframe.data('frame-url'));
+      trustBtn.hide();
+      iframeContainer.show();
+    });
+
 
     //html_tool_tip_code based on xstooltip provided by
     //http://www.texsoft.it/index.php?%20m=sw.js.htmltooltip&c=software&l=it

From 63eb1c83bb7095290a67cf2119ddaecc1d966a7d Mon Sep 17 00:00:00 2001
From: MontrealSergiy <sergeboroday@gmail.com>
Date: Tue, 22 Apr 2025 09:14:19 -0400
Subject: [PATCH 05/11] store in session file trust

---
 .../app/controllers/userfiles_controller.rb   | 28 +++++++++++++
 .../userfiles/html_file/html_file.rb          |  2 +-
 .../userfiles/html_file/views/_html.html.erb  | 31 ++++++++++++---
 BrainPortal/config/routes.rb                  |  2 +
 BrainPortal/public/javascripts/cbrain.js      | 39 +------------------
 5 files changed, 58 insertions(+), 44 deletions(-)

diff --git a/BrainPortal/app/controllers/userfiles_controller.rb b/BrainPortal/app/controllers/userfiles_controller.rb
index 49ec78f2f..2789a91de 100644
--- a/BrainPortal/app/controllers/userfiles_controller.rb
+++ b/BrainPortal/app/controllers/userfiles_controller.rb
@@ -440,6 +440,34 @@ def show #:nodoc:
     end
   end
 
+  # established trust in all the other files of a creator of this file for the duration of the session
+  # used to render html userfiles or collection elements
+  def trust_creator
+    @userfile = Userfile.find_accessible_by_user(params[:id], current_user, :access_requested => :read)
+    cbrain_session['trust_user_files'] ||= []
+    unless cbrain_session['trust_user_files'].include?(@userfile.user_id)
+      cbrain_session['trust_user_files'] << @userfile.user_id
+    end
+    respond_to do |format|
+      format.js  { render js: "" }  # no need to do anything as of now
+    end
+  end
+
+  # established trust in a file or all the other files of a collection for the duration of the session
+  # used to render html userfiles or collection elements
+  def trust
+
+    @userfile = Userfile.find_accessible_by_user(params[:id], current_user, :access_requested => :read)
+    cbrain_session['trust_userfiles'] ||= []
+    unless cbrain_session['trust_userfiles'].include?(@userfile.id)
+      cbrain_session['trust_userfiles'] << @userfile.id
+    end
+
+    respond_to do |format|
+      format.js  { render js: "" }  # no need to do anything as of now
+    end
+  end
+
   # Triggers the mass synchronization of several userfiles
   # or mass 'desynchronization' (ProvNewer) of several userfiles.
   def sync_multiple #:nodoc:
diff --git a/BrainPortal/cbrain_plugins/cbrain-plugins-base/userfiles/html_file/html_file.rb b/BrainPortal/cbrain_plugins/cbrain-plugins-base/userfiles/html_file/html_file.rb
index 2a556bd66..ca029c678 100644
--- a/BrainPortal/cbrain_plugins/cbrain-plugins-base/userfiles/html_file/html_file.rb
+++ b/BrainPortal/cbrain_plugins/cbrain-plugins-base/userfiles/html_file/html_file.rb
@@ -33,6 +33,6 @@ def self.file_name_pattern #:nodoc:
 
   def self.pretty_type #:nodoc:
     "HTML File"
-  end  
+  end
   
 end
diff --git a/BrainPortal/cbrain_plugins/cbrain-plugins-base/userfiles/html_file/views/_html.html.erb b/BrainPortal/cbrain_plugins/cbrain-plugins-base/userfiles/html_file/views/_html.html.erb
index 56d663071..21080f9b8 100644
--- a/BrainPortal/cbrain_plugins/cbrain-plugins-base/userfiles/html_file/views/_html.html.erb
+++ b/BrainPortal/cbrain_plugins/cbrain-plugins-base/userfiles/html_file/views/_html.html.erb
@@ -22,6 +22,11 @@
 #
 %>
 
+This HTML document is not part of CBRAIN. <em> You should <strong>not</strong> view or
+  interact with it unless you fully trust it. </em> (Forms and external links are disabled.)
+<br>
+
+
 <% if params[:new_tab].blank? # show only on userfile page %>
   <%= link_to(
       "Open in a separate tab",
@@ -36,14 +41,30 @@
     ) %>
 <% end %>
 <br>
-This HTML document is not part of CBRAIN. <em> You should <strong>not</strong> view or
-interact with it unless you fully trust it. </em> (Forms and external links are disabled.)
-<br>
 
 <%# -- for other user's files ask confirmation %>
-<% hide_frame = params[:new_tab].blank? && current_user.id != @userfile.user_id %>
+<% hide_frame   = params[:new_tab].blank? && current_user.id != @userfile.user_id %>
+<% hide_frame &&= ! cbrain_session['trust_user_files']&.include?(@userfile.user_id) %>
+<% hide_frame &&= ! cbrain_session['trust_userfiles']&.include?(@userfile.id) %>
 <% if hide_frame %>
-   <div class="trust-file-btn"> <%= link_to 'Show this HTML file below anyway', "#iframe-container" %></div>
+   <div class="trust-file-btn">
+
+     <%= link_to "I trust all #{@userfile.user.login}'s  files,",
+                 trust_creator_userfile_path(@userfile),
+                 method: :post,
+                 remote: true
+     %>
+     show them without warnings during this session
+   </div>
+   <div>
+
+     <%= link_to "Show just this userfile",
+                 trust_userfile_path(@userfile),
+                 method: :post,
+                 remote: true
+     %>
+   </div>
+
 <% end %>
 <br>
 
diff --git a/BrainPortal/config/routes.rb b/BrainPortal/config/routes.rb
index b9df53946..3dfe84a1c 100644
--- a/BrainPortal/config/routes.rb
+++ b/BrainPortal/config/routes.rb
@@ -140,6 +140,8 @@
       get  'stream/*file_path' => 'userfiles#stream'
       get  'display'
       post 'extract_from_collection'
+      post 'trust'
+      post 'trust_creator'
     end
     collection do
       post   'download'
diff --git a/BrainPortal/public/javascripts/cbrain.js b/BrainPortal/public/javascripts/cbrain.js
index 16ce7ddbf..88176a7cb 100644
--- a/BrainPortal/public/javascripts/cbrain.js
+++ b/BrainPortal/public/javascripts/cbrain.js
@@ -759,7 +759,7 @@
       form.submit();
     });
 
-    $(document).delegate(".trust-file-btn", "click", function (event) {
+    $(document).on("click", ".trust-file-btn",  function (event) {
       let trustBtn = $("body").find(".trust-file-btn");
       let iframe = $("body").find('.html-viewer');
       let iframeContainer = $("body").find('.iframe-container');
@@ -768,45 +768,8 @@
       iframeContainer.show();  // css trumps html
     });
 
-    // todo delete this one or preceditng confirm button for html viewer iframe
-    // this one caches trust info in local storage
-    $('.trust-file-btn').each(function() {
-      let trustBtn = $(this);
-      let fileIds = trustBtn.data('ids');
-      let iframe = trustBtn.closest('iframe').find('.html-viewer');
-      let iframeContainer = trustBtn.closest('div').find('.iframe-container');
-
-      // If there's a valid fileId, proceed
-      if (fileIds) {
-        const trustKey = "trusted_file_" + fileIds;
-        const fileUrl = iframe.data('frame-url');
-
-        // Check if trust is already saved
-        if (localStorage.getItem(trustKey) === "true") {
-          iframe.attr('src', fileUrl);
-          trustBtn.hide();
-          iframeContainer.show();
-        }
 
-        // Click event for trusting the file
-        trustBtn.click(function() {
-          localStorage.setItem(trustKey, "true"); // Save trust for file/owner id todo expire in 3 h?
-          iframe.attr('src', fileUrl);
-          $(this).hide();
-          iframeContainer.show();
-        });
-      }
-    });
 
-    // show html on click only
-    $(document).delegate(".trust-file-btn", "click", function (event) {
-      let trustBtn = $("body").find(".trust-file-btn");
-      let iframe = $("body").find('.html-viewer');
-      let iframeContainer = $("body").find('.iframe-container');
-      iframe.attr('src', iframe.data('frame-url'));
-      trustBtn.hide();
-      iframeContainer.show();
-    });
 
 
     //html_tool_tip_code based on xstooltip provided by

From c2c23edf7842e2aa890b5094f9f38fae059de3e6 Mon Sep 17 00:00:00 2001
From: MontrealSergiy <sergeboroday@gmail.com>
Date: Tue, 22 Apr 2025 09:22:57 -0400
Subject: [PATCH 06/11] delete empty line

---
 BrainPortal/app/controllers/userfiles_controller.rb | 2 --
 1 file changed, 2 deletions(-)

diff --git a/BrainPortal/app/controllers/userfiles_controller.rb b/BrainPortal/app/controllers/userfiles_controller.rb
index 2789a91de..3d419d2c9 100644
--- a/BrainPortal/app/controllers/userfiles_controller.rb
+++ b/BrainPortal/app/controllers/userfiles_controller.rb
@@ -456,13 +456,11 @@ def trust_creator
   # established trust in a file or all the other files of a collection for the duration of the session
   # used to render html userfiles or collection elements
   def trust
-
     @userfile = Userfile.find_accessible_by_user(params[:id], current_user, :access_requested => :read)
     cbrain_session['trust_userfiles'] ||= []
     unless cbrain_session['trust_userfiles'].include?(@userfile.id)
       cbrain_session['trust_userfiles'] << @userfile.id
     end
-
     respond_to do |format|
       format.js  { render js: "" }  # no need to do anything as of now
     end

From faf6045fc8d775e0cab73cf086b6037fffe1c6be Mon Sep 17 00:00:00 2001
From: MontrealSergiy <sergeboroday@gmail.com>
Date: Fri, 25 Apr 2025 13:28:44 -0400
Subject: [PATCH 07/11] cap and fix userfile array storage in session

---
 .../app/controllers/userfiles_controller.rb    | 18 ++++++++++++------
 1 file changed, 12 insertions(+), 6 deletions(-)

diff --git a/BrainPortal/app/controllers/userfiles_controller.rb b/BrainPortal/app/controllers/userfiles_controller.rb
index 3d419d2c9..5a21e1ea2 100644
--- a/BrainPortal/app/controllers/userfiles_controller.rb
+++ b/BrainPortal/app/controllers/userfiles_controller.rb
@@ -444,9 +444,11 @@ def show #:nodoc:
   # used to render html userfiles or collection elements
   def trust_creator
     @userfile = Userfile.find_accessible_by_user(params[:id], current_user, :access_requested => :read)
-    cbrain_session['trust_user_files'] ||= []
-    unless cbrain_session['trust_user_files'].include?(@userfile.user_id)
-      cbrain_session['trust_user_files'] << @userfile.user_id
+    cbrain_session[:trust_user_files] ||= []
+    unless cbrain_session[:trust_user_files].include?(@userfile.user_id)
+      ids = cbrain_session[:trust_user_files] # in place modification does not work well with session
+      ids.shift if ids.length > 99  # limit to 100 ids, session storage is limited
+      cbrain_session[:trust_userfiles] = ids << @userfile.user_id
     end
     respond_to do |format|
       format.js  { render js: "" }  # no need to do anything as of now
@@ -456,10 +458,14 @@ def trust_creator
   # established trust in a file or all the other files of a collection for the duration of the session
   # used to render html userfiles or collection elements
   def trust
+
     @userfile = Userfile.find_accessible_by_user(params[:id], current_user, :access_requested => :read)
-    cbrain_session['trust_userfiles'] ||= []
-    unless cbrain_session['trust_userfiles'].include?(@userfile.id)
-      cbrain_session['trust_userfiles'] << @userfile.id
+    cbrain_session[:trust_userfiles] ||= []
+    unless cbrain_session[:trust_userfiles].include?(@userfile.id)
+      ids = cbrain_session[:trust_userfiles]
+      ids << @userfile.id
+      ids.shift if ids.length > 199  # limit to 200 file ids, session size is limited
+      cbrain_session[:trust_userfiles] = ids # in place does not work well within a session
     end
     respond_to do |format|
       format.js  { render js: "" }  # no need to do anything as of now

From 49a4f8e6f30693228551f2141df76beeead09033 Mon Sep 17 00:00:00 2001
From: MontrealSergiy <sergeboroday@gmail.com>
Date: Fri, 25 Apr 2025 13:30:29 -0400
Subject: [PATCH 08/11] correct/adjust confirmation on frontend

---
 .../userfiles/html_file/views/_html.html.erb             | 8 ++++----
 BrainPortal/public/javascripts/cbrain.js                 | 9 +++------
 2 files changed, 7 insertions(+), 10 deletions(-)

diff --git a/BrainPortal/cbrain_plugins/cbrain-plugins-base/userfiles/html_file/views/_html.html.erb b/BrainPortal/cbrain_plugins/cbrain-plugins-base/userfiles/html_file/views/_html.html.erb
index 21080f9b8..842e08f37 100644
--- a/BrainPortal/cbrain_plugins/cbrain-plugins-base/userfiles/html_file/views/_html.html.erb
+++ b/BrainPortal/cbrain_plugins/cbrain-plugins-base/userfiles/html_file/views/_html.html.erb
@@ -42,10 +42,10 @@ This HTML document is not part of CBRAIN. <em> You should <strong>not</strong> v
 <% end %>
 <br>
 
-<%# -- for other user's files ask confirmation %>
+<%# -- for other user's files ask confirmation, unless user of files is marked as trusted %>
 <% hide_frame   = params[:new_tab].blank? && current_user.id != @userfile.user_id %>
-<% hide_frame &&= ! cbrain_session['trust_user_files']&.include?(@userfile.user_id) %>
-<% hide_frame &&= ! cbrain_session['trust_userfiles']&.include?(@userfile.id) %>
+<% hide_frame &&= ! cbrain_session[:trust_user_files]&.include?(@userfile.user_id) %>
+<% hide_frame &&= ! cbrain_session[:trust_userfiles]&.include?(@userfile.id) %>
 <% if hide_frame %>
    <div class="trust-file-btn">
 
@@ -56,7 +56,7 @@ This HTML document is not part of CBRAIN. <em> You should <strong>not</strong> v
      %>
      show them without warnings during this session
    </div>
-   <div>
+   <div class="trust-file-btn">
 
      <%= link_to "Show just this userfile",
                  trust_userfile_path(@userfile),
diff --git a/BrainPortal/public/javascripts/cbrain.js b/BrainPortal/public/javascripts/cbrain.js
index 88176a7cb..caddcfbd8 100644
--- a/BrainPortal/public/javascripts/cbrain.js
+++ b/BrainPortal/public/javascripts/cbrain.js
@@ -759,8 +759,9 @@
       form.submit();
     });
 
-    $(document).on("click", ".trust-file-btn",  function (event) {
-      let trustBtn = $("body").find(".trust-file-btn");
+    // show HMTL file in a frame after user indicates trust (to that file or file owner)
+    $(document).on("ajax:success", ".trust-file-btn",  function (event) {
+      let trustBtn = $(".trust-file-btn");
       let iframe = $("body").find('.html-viewer');
       let iframeContainer = $("body").find('.iframe-container');
       iframe.attr('src', iframe.data('frame-url'));
@@ -768,10 +769,6 @@
       iframeContainer.show();  // css trumps html
     });
 
-
-
-
-
     //html_tool_tip_code based on xstooltip provided by
     //http://www.texsoft.it/index.php?%20m=sw.js.htmltooltip&c=software&l=it
     $(document).delegate(".html_tool_tip_trigger", "mouseenter", function(event) {

From 85de3258335fb8c13d45daaf17010a97061e95e8 Mon Sep 17 00:00:00 2001
From: MontrealSergiy <sergeboroday@gmail.com>
Date: Fri, 25 Apr 2025 14:30:45 -0400
Subject: [PATCH 09/11] prettier formatting and comments ...

---
 .../userfiles/html_file/views/_html.html.erb  | 97 +++++++++----------
 1 file changed, 46 insertions(+), 51 deletions(-)

diff --git a/BrainPortal/cbrain_plugins/cbrain-plugins-base/userfiles/html_file/views/_html.html.erb b/BrainPortal/cbrain_plugins/cbrain-plugins-base/userfiles/html_file/views/_html.html.erb
index 842e08f37..fa8e38585 100644
--- a/BrainPortal/cbrain_plugins/cbrain-plugins-base/userfiles/html_file/views/_html.html.erb
+++ b/BrainPortal/cbrain_plugins/cbrain-plugins-base/userfiles/html_file/views/_html.html.erb
@@ -1,4 +1,3 @@
-
 <%
 #
 # CBRAIN Project
@@ -26,68 +25,64 @@ This HTML document is not part of CBRAIN. <em> You should <strong>not</strong> v
   interact with it unless you fully trust it. </em> (Forms and external links are disabled.)
 <br>
 
-
-<% if params[:new_tab].blank? # show only on userfile page %>
+<% if params[:new_tab].blank?
+     # show only on userfile page %>
   <%= link_to(
-      "Open in a separate tab",
-      display_userfile_url(@userfile,
-        :viewer                => :html,
-        :content_viewer        => "on",
-        :file_name             => @userfile.name,
-        :viewer_userfile_class => "HtmlFile",
-        :new_tab               => "yes"
-      ),
-      :target => "_blank"
-    ) %>
+        "Open in a separate tab",
+        display_userfile_url(@userfile,
+                             :viewer => :html,
+                             :content_viewer => "on",
+                             :file_name => @userfile.name,
+                             :viewer_userfile_class => "HtmlFile",
+                             :new_tab => "yes"
+        ),
+        :target => "_blank"
+      ) %>
 <% end %>
 <br>
 
 <%# -- for other user's files ask confirmation, unless user of files is marked as trusted %>
-<% hide_frame   = params[:new_tab].blank? && current_user.id != @userfile.user_id %>
-<% hide_frame &&= ! cbrain_session[:trust_user_files]&.include?(@userfile.user_id) %>
-<% hide_frame &&= ! cbrain_session[:trust_userfiles]&.include?(@userfile.id) %>
+<% hide_frame = params[:new_tab].blank? && current_user.id != @userfile.user_id %>
+<% hide_frame &&= !cbrain_session[:trust_user_files]&.include?(@userfile.user_id) %>
+<% hide_frame &&= !cbrain_session[:trust_userfiles]&.include?(@userfile.id) %>
 <% if hide_frame %>
-   <div class="trust-file-btn">
-
-     <%= link_to "I trust all #{@userfile.user.login}'s  files,",
-                 trust_creator_userfile_path(@userfile),
-                 method: :post,
-                 remote: true
-     %>
-     show them without warnings during this session
-   </div>
-   <div class="trust-file-btn">
-
-     <%= link_to "Show just this userfile",
-                 trust_userfile_path(@userfile),
-                 method: :post,
-                 remote: true
-     %>
-   </div>
+  <div class="trust-file-btn">
 
+    <%= link_to "I trust all #{@userfile.user.login}'s  files,",
+                trust_creator_userfile_path(@userfile),
+                method: :post,
+                remote: true
+    %>
+    show them without warnings during this session
+  </div>
+  <div class="trust-file-btn">
+    <%= link_to "Show just this userfile",
+                trust_userfile_path(@userfile),
+                method: :post,
+                remote: true
+    %>
+  </div>
 <% end %>
+
 <br>
 
-</div>
 <div class="iframe-container" id="iframe-container"
-  <% if hide_frame %>
-    hidden
-  <% end %>
- >
+     <% if hide_frame %>
+        hidden
+     <% end %>
+     >
   <iframe sandbox="allow-scripts allow-same-origin"
-    data-frame-url="<%= stream_userfile_path(@userfile, :disposition => 'inline') %>"
-    <% unless hide_frame %>
-      src="<%= stream_userfile_path(@userfile, :disposition => 'inline') %>"
-    <% end %>
-    class="full-frame html-viewer"
-
-    <%# todo drop caching trust with ids? %>
-    data-ids="<%= "#{@userfile.id}-#{@userfile.user.id}" %>"
-    class="full-frame html-viewer"
-    <% if params[:new_tab].present? # workaround to wide frame in a new tab %>
-      style="height: 100%; width: 100%;"
-    <% end %>
- >
+          data-frame-url="<%= stream_userfile_path(@userfile, :disposition => 'inline') %>"
+          <% unless hide_frame %>
+            src="<%= stream_userfile_path(@userfile, :disposition => 'inline') %>"
+          <% end %>
+          class="full-frame html-viewer"
+          class="full-frame html-viewer"
+          <% if params[:new_tab].present?
+               # workaround to wide frame in a new tab %>
+            style="height: 100%; width: 100%;"
+          <% end %>
+          >
     HTML Viewer
   </iframe>
 </div>

From 9bc4fa92f373d48c42dc64a3efe6fddddd4d6e17 Mon Sep 17 00:00:00 2001
From: MontrealSergiy <sergeboroday@gmail.com>
Date: Fri, 25 Apr 2025 14:31:36 -0400
Subject: [PATCH 10/11] verbiage in comments ...

---
 .../app/controllers/userfiles_controller.rb    | 18 ++++++++----------
 1 file changed, 8 insertions(+), 10 deletions(-)

diff --git a/BrainPortal/app/controllers/userfiles_controller.rb b/BrainPortal/app/controllers/userfiles_controller.rb
index 5a21e1ea2..2d7c397ec 100644
--- a/BrainPortal/app/controllers/userfiles_controller.rb
+++ b/BrainPortal/app/controllers/userfiles_controller.rb
@@ -440,14 +440,14 @@ def show #:nodoc:
     end
   end
 
-  # established trust in all the other files of a creator of this file for the duration of the session
-  # used to render html userfiles or collection elements
+  # establishes trust in all the files of a creator of this file for the duration of the session
+  # This method is used to render html userfiles or collection elements
   def trust_creator
     @userfile = Userfile.find_accessible_by_user(params[:id], current_user, :access_requested => :read)
     cbrain_session[:trust_user_files] ||= []
     unless cbrain_session[:trust_user_files].include?(@userfile.user_id)
-      ids = cbrain_session[:trust_user_files] # in place modification does not work well with session
-      ids.shift if ids.length > 99  # limit to 100 ids, session storage is limited
+      ids = cbrain_session[:trust_user_files] # in place modification does not work well within a session
+      ids.shift if ids.length > 99  # cap to 100 ids, session storage is limited
       cbrain_session[:trust_userfiles] = ids << @userfile.user_id
     end
     respond_to do |format|
@@ -455,17 +455,15 @@ def trust_creator
     end
   end
 
-  # established trust in a file or all the other files of a collection for the duration of the session
-  # used to render html userfiles or collection elements
+  # establishes trust in a file or all the other files of a collection for the duration of the session
+  # This method is used to render html userfiles or collection elements
   def trust
-
     @userfile = Userfile.find_accessible_by_user(params[:id], current_user, :access_requested => :read)
     cbrain_session[:trust_userfiles] ||= []
     unless cbrain_session[:trust_userfiles].include?(@userfile.id)
-      ids = cbrain_session[:trust_userfiles]
-      ids << @userfile.id
+      ids = cbrain_session[:trust_userfiles]  # in place modification does not work well within a session
       ids.shift if ids.length > 199  # limit to 200 file ids, session size is limited
-      cbrain_session[:trust_userfiles] = ids # in place does not work well within a session
+      cbrain_session[:trust_userfiles] = ids << @userfile.id
     end
     respond_to do |format|
       format.js  { render js: "" }  # no need to do anything as of now

From d1cccbe8f25b3271bbc5d132324b879d1d1557f6 Mon Sep 17 00:00:00 2001
From: MontrealSergiy <sergeboroday@gmail.com>
Date: Mon, 12 May 2025 10:52:19 -0400
Subject: [PATCH 11/11] remove a duplicate line #1505

---
 .../userfiles/html_file/views/_html.html.erb  | 42 +++++++++----------
 1 file changed, 21 insertions(+), 21 deletions(-)

diff --git a/BrainPortal/cbrain_plugins/cbrain-plugins-base/userfiles/html_file/views/_html.html.erb b/BrainPortal/cbrain_plugins/cbrain-plugins-base/userfiles/html_file/views/_html.html.erb
index fa8e38585..4224ebffb 100644
--- a/BrainPortal/cbrain_plugins/cbrain-plugins-base/userfiles/html_file/views/_html.html.erb
+++ b/BrainPortal/cbrain_plugins/cbrain-plugins-base/userfiles/html_file/views/_html.html.erb
@@ -30,14 +30,15 @@ This HTML document is not part of CBRAIN. <em> You should <strong>not</strong> v
   <%= link_to(
         "Open in a separate tab",
         display_userfile_url(@userfile,
-                             :viewer => :html,
-                             :content_viewer => "on",
-                             :file_name => @userfile.name,
-                             :viewer_userfile_class => "HtmlFile",
-                             :new_tab => "yes"
+          :viewer                => :html,
+          :content_viewer        => "on",
+          :file_name             => @userfile.name,
+          :viewer_userfile_class => "HtmlFile",
+          :new_tab => "yes"
         ),
         :target => "_blank"
-      ) %>
+      )
+  %>
 <% end %>
 <br>
 
@@ -67,22 +68,21 @@ This HTML document is not part of CBRAIN. <em> You should <strong>not</strong> v
 <br>
 
 <div class="iframe-container" id="iframe-container"
-     <% if hide_frame %>
-        hidden
-     <% end %>
-     >
+    <% if hide_frame %>
+      hidden
+    <% end %>
+>
   <iframe sandbox="allow-scripts allow-same-origin"
-          data-frame-url="<%= stream_userfile_path(@userfile, :disposition => 'inline') %>"
-          <% unless hide_frame %>
-            src="<%= stream_userfile_path(@userfile, :disposition => 'inline') %>"
-          <% end %>
-          class="full-frame html-viewer"
-          class="full-frame html-viewer"
-          <% if params[:new_tab].present?
-               # workaround to wide frame in a new tab %>
-            style="height: 100%; width: 100%;"
-          <% end %>
-          >
+      data-frame-url="<%= stream_userfile_path(@userfile, :disposition => 'inline') %>"
+      <% unless hide_frame %>
+        src="<%= stream_userfile_path(@userfile, :disposition => 'inline') %>"
+      <% end %>
+        class="full-frame html-viewer"
+      <% if params[:new_tab].present?
+        # workaround to wide frame in a new tab %>
+        style="height: 100%; width: 100%;"
+      <% end %>
+  >
     HTML Viewer
   </iframe>
 </div>