Restrict the modification query grids to the current folder tree

[vagisha]

Rationale

The modification web part title links to the full query grid, where an "All Folders" filter could be applied, leading to very slow queries. Restricting the Folder Filter menu is not enough because a hand-built query.containerFilterName=AllFolders URL still applies.

Changes

• Added a shared PanoramaPublicSchema.limitContainerScope helper that restricts any container filter wider than the current folder and subfolders down to CurrentAndSubfolders.
• PanoramaPublicSchema.createView calls the helper for the IsotopeModifications and StructuralModifications grids.
• ModificationsView.getContainerFilter calls the same helper, closing the same gap on the standalone web parts. It is a no-op on the experiment details page, which already pins the scope.

Tests

• PanoramaPublicModificationsTest.verifyModificationQueryScopeIsRestricted checks that the Folder Filter menu does not include All Folders, and that a query.containerFilterName=AllFolders URL is restricted to CurrentAndSubfolders.
• PanoramaPublicModificationsTest.verifyModificationWebPartScopeIsRestricted drives the standalone web part URL and checks the same restriction.

Co-Authored-By: Claude noreply@anthropic.com

[Copilot]

Pull request overview

This PR prevents Panorama Public modification grids (Isotope/Structural) from being widened to expensive cross-folder scopes via hand-crafted URLs, by clamping container filters to the current folder tree.

Changes:

• Added PanoramaPublicSchema.limitContainerScope(...) to restrict any container filter broader than Current/CurrentAndSubfolders down to CurrentAndSubfolders.
• Applied the restriction to the full query grids via PanoramaPublicSchema.createView(...) for the Isotope/Structural modification queries.
• Applied the same restriction to standalone modification web parts via ModificationsView.getContainerFilter(), and added regression UI tests covering both entry points.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated no comments.

File	Description
panoramapublic/src/org/labkey/panoramapublic/PanoramaPublicSchema.java	Adds the shared container-scope limiting helper and applies it to the two modification query grids.
panoramapublic/src/org/labkey/panoramapublic/query/modification/ModificationsView.java	Clamps container filters for standalone modification web parts to prevent URL-based widening.
panoramapublic/test/src/org/labkey/test/tests/panoramapublic/PanoramaPublicModificationsTest.java	Adds UI tests ensuring both the menu and URL parameters cannot expand scope to All Folders.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[labkey-jeckels]

This is primarily to control bots, correct? If so, this should provide good protection. It would still be possible to create a custom SQL query that set a slow container filter, for example.

[vagisha]

This is primarily to control bots, correct? If so, this should provide good protection. It would still be possible to create a custom SQL query that set a slow container filter, for example.

Yes, this is to control bot traffic.