feat: Add customization URL parameter (#5992)
* Add customization URL parameter * fix: Preserve should be customizeable * Update customizations docs * fix: Overlay items on patient name * Add customization test * Fix resolve to absolute path * fix: Warn on no data in load * Remove unused customization stuff * fix: PR comments * Update stored parameters to only use an array for mulitples * Remove requires ohif.* special call out * Remove strict mode * PR comments * Document segmentation examples * Add three examples as requested * PR comments * lock * Remove old customizatoin export * fix: Ordering issues on customization loads * fix: Use correct default for dev builds app config * Fixes for conflicts * chore: restore pnpm-lock.yaml to match master The lockfile diff was incidental peer-descriptor churn and carried no functional dependency change. It tripped the CircleCI security-audit gate (which only runs when pnpm-lock.yaml is in the PR diff), surfacing a pre-existing critical `decompress` transitive vuln that also exists on master. Restoring master's lockfile removes the audit trigger. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix(ci): restore json5 lockfile entry; ignore unfixable decompress GHSA The previous commit restored pnpm-lock.yaml from master, which dropped the json5@2.2.3 entry that platform/core legitimately depends on (JSONC parsing for the customization feature). That broke `--frozen-lockfile` install (ERR_PNPM_OUTDATED_LOCKFILE). This restores the correct lockfile. Because the lockfile must change (json5), the CircleCI security-audit gate runs and previously failed on a critical `decompress` <=4.2.1 zip-slip advisory. This is a pre-existing transitive vuln (present on master too) with no published patch — decompress's latest release is 4.2.1, so no version bump/override can resolve it. It reaches the tree only via @itk-wasm/dam, a build/data-asset extraction tool under @cornerstonejs/labelmap-interpolation. Add GHSA-mp2f-45pm-3cg9 to the existing pnpm-workspace.yaml auditConfig ignoreGhsas accepted-risk list, matching how the repo already exempts other build-tooling advisories. `pnpm audit --audit-level high` now passes locally (1 critical ignored, 0 high). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * test(e2e): fix visitStudy URL encoding that broke mpr2 study load The visitStudy rewrite (added for the ?customization= option) built the URL with new URLSearchParams({ StudyInstanceUIDs: studyInstanceUID }), which percent-encodes the value. mpr2.spec.ts embeds an extra param in the UID string ('<uid>&hangingprotocolid=mpr'), so the & and = were encoded and the whole thing collapsed into one invalid StudyInstanceUIDs value -> the study could not be found ('studies are not available'), the viewer never rendered, and the side-panel-header-right click timed out. Restore master's raw concatenation for StudyInstanceUIDs (so embedded params survive as separate query params) while still appending the customization option separately. Only mpr2 embeds & in the UID, matching the single failure. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * PR comments --------- Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This commit is contained in:
Bill WallaceandClaude Opus 4.8 authored and GitHub committed
1 parent
3d9a17bc0c
commit
3dd5c70cb2
58 files changed
+3411
-586
No files matched your search
@@ -1,5 +1,21 @@
|
||||
/** @type {AppTypes.Config} */
|
||||
|
||||
// Secure, minimal default configuration.
|
||||
//
|
||||
// This is what a plain production build with no APP_CONFIG produces, so it is
|
||||
// deliberately locked down:
|
||||
// - The local file data source (`dicomlocal`) and the runtime `?url=` sources
|
||||
// (`dicomjson`, `dicomwebproxy`) are NOT enabled — they widen the attack
|
||||
// surface of a default deployment.
|
||||
// - `?customization=` URL loading is OFF: no `customizationUrlPrefixes` are
|
||||
// configured, so any `?customization=` value is rejected (and aborts boot
|
||||
// rather than silently loading).
|
||||
// - `dangerouslyUseDynamicConfig` (the `configUrl` query parameter) is off.
|
||||
//
|
||||
// It does not need to "just work" untouched — point the data source below at
|
||||
// your own DICOMweb server. For a fully-featured setup with every data source
|
||||
// and customization loading enabled, see config/dev.js (local development) and
|
||||
// config/netlify.js (the public demo deploy).
|
||||
window.config = {
|
||||
name: 'config/default.js',
|
||||
routerBasename: null,
|
||||
@@ -7,6 +23,21 @@ window.config = {
|
||||
extensions: [],
|
||||
modes: [],
|
||||
customizationService: {},
|
||||
|
||||
// --- URL-driven customizations (?customization=) ----------------------------
|
||||
// OFF by default. To allow loading customization data files from the URL, set
|
||||
// `customizationUrlPrefixes` to a map of allowed prefixes. The `default` prefix
|
||||
// (no slashes) is used for values with no leading slash; every other prefix
|
||||
// must start AND end with a slash and is matched against the leading
|
||||
// `/segment/` of the value. Files are fetched and parsed as JSONC data — they
|
||||
// are never executed. Example (left disabled here on purpose):
|
||||
//
|
||||
// customizationUrlPrefixes: {
|
||||
// default: './customizations/', // ?customization=ctPresets
|
||||
// '/remote/': 'https://cdn.example.com/ohif-custom/', // ?customization=/remote/siteA
|
||||
// },
|
||||
// ----------------------------------------------------------------------------
|
||||
|
||||
showStudyList: true,
|
||||
// some windows systems have issues with more than 3 web workers
|
||||
maxNumberOfWebWorkers: 3,
|
||||
@@ -26,81 +57,13 @@ window.config = {
|
||||
prefetch: 25,
|
||||
},
|
||||
showErrorDetails: 'always', // 'always', 'dev', 'production'
|
||||
// filterQueryParam: false,
|
||||
// Defines multi-monitor layouts
|
||||
multimonitor: [
|
||||
{
|
||||
id: 'split',
|
||||
test: ({ multimonitor }) => multimonitor === 'split',
|
||||
screens: [
|
||||
{
|
||||
id: 'ohif0',
|
||||
screen: null,
|
||||
location: {
|
||||
screen: 0,
|
||||
width: 0.5,
|
||||
height: 1,
|
||||
left: 0,
|
||||
top: 0,
|
||||
},
|
||||
options: 'location=no,menubar=no,scrollbars=no,status=no,titlebar=no',
|
||||
},
|
||||
{
|
||||
id: 'ohif1',
|
||||
screen: null,
|
||||
location: {
|
||||
width: 0.5,
|
||||
height: 1,
|
||||
left: 0.5,
|
||||
top: 0,
|
||||
},
|
||||
options: 'location=no,menubar=no,scrollbars=no,status=no,titlebar=no',
|
||||
},
|
||||
],
|
||||
},
|
||||
|
||||
{
|
||||
id: '2',
|
||||
test: ({ multimonitor }) => multimonitor === '2',
|
||||
screens: [
|
||||
{
|
||||
id: 'ohif0',
|
||||
screen: 0,
|
||||
location: {
|
||||
width: 1,
|
||||
height: 1,
|
||||
left: 0,
|
||||
top: 0,
|
||||
},
|
||||
options: 'fullscreen=yes,location=no,menubar=no,scrollbars=no,status=no,titlebar=no',
|
||||
},
|
||||
{
|
||||
id: 'ohif1',
|
||||
screen: 1,
|
||||
location: {
|
||||
width: 1,
|
||||
height: 1,
|
||||
left: 0,
|
||||
top: 0,
|
||||
},
|
||||
options: 'fullscreen=yes,location=no,menubar=no,scrollbars=no,status=no,titlebar=no',
|
||||
},
|
||||
],
|
||||
},
|
||||
],
|
||||
// `dangerouslyUseDynamicConfig` (load configuration from a `configUrl` query
|
||||
// parameter) is intentionally left OFF in the secure default build. See
|
||||
// config/dev.js for the documented shape.
|
||||
defaultDataSourceName: 'ohif',
|
||||
/* Dynamic config allows user to pass "configUrl" query string this allows to load config without recompiling application. The regex will ensure valid configuration source */
|
||||
// dangerouslyUseDynamicConfig: {
|
||||
// enabled: true,
|
||||
// // regex will ensure valid configuration source and default is /.*/ which matches any character. To use this, setup your own regex to choose a specific source of configuration only.
|
||||
// // Example 1, to allow numbers and letters in an absolute or sub-path only.
|
||||
// // regex: /(0-9A-Za-z.]+)(\/[0-9A-Za-z.]+)*/
|
||||
// // Example 2, to restricts to either hosptial.com or othersite.com.
|
||||
// // regex: /(https:\/\/hospital.com(\/[0-9A-Za-z.]+)*)|(https:\/\/othersite.com(\/[0-9A-Za-z.]+)*)/
|
||||
// regex: /.*/,
|
||||
// },
|
||||
dataSources: [
|
||||
{
|
||||
// Read-only public demo server. Replace with your own DICOMweb server.
|
||||
namespace: '@ohif/extension-default.dataSourcesModule.dicomweb',
|
||||
sourceName: 'ohif',
|
||||
configuration: {
|
||||
@@ -118,9 +81,6 @@ window.config = {
|
||||
supportsWildcard: true,
|
||||
staticWado: true,
|
||||
singlepart: 'bulkdata,video',
|
||||
// whether the data source should use retrieveBulkData to grab metadata,
|
||||
// and in case of relative path, what would it be relative to, options
|
||||
// are in the series level or study level (some servers like series some study)
|
||||
bulkDataURI: {
|
||||
enabled: true,
|
||||
relativeResolution: 'studies',
|
||||
@@ -130,157 +90,13 @@ window.config = {
|
||||
},
|
||||
},
|
||||
|
||||
{
|
||||
namespace: '@ohif/extension-default.dataSourcesModule.dicomweb',
|
||||
sourceName: 'ohif2',
|
||||
configuration: {
|
||||
friendlyName: 'AWS S3 Static wado secondary server',
|
||||
name: 'aws',
|
||||
wadoUriRoot: 'https://dd14fa38qiwhyfd.cloudfront.net/dicomweb',
|
||||
qidoRoot: 'https://dd14fa38qiwhyfd.cloudfront.net/dicomweb',
|
||||
wadoRoot: 'https://dd14fa38qiwhyfd.cloudfront.net/dicomweb',
|
||||
qidoSupportsIncludeField: false,
|
||||
supportsReject: false,
|
||||
imageRendering: 'wadors',
|
||||
thumbnailRendering: 'wadors',
|
||||
enableStudyLazyLoad: true,
|
||||
supportsFuzzyMatching: false,
|
||||
supportsWildcard: true,
|
||||
staticWado: true,
|
||||
singlepart: 'bulkdata,video',
|
||||
// whether the data source should use retrieveBulkData to grab metadata,
|
||||
// and in case of relative path, what would it be relative to, options
|
||||
// are in the series level or study level (some servers like series some study)
|
||||
bulkDataURI: {
|
||||
enabled: true,
|
||||
relativeResolution: 'studies',
|
||||
},
|
||||
omitQuotationForMultipartRequest: true,
|
||||
},
|
||||
},
|
||||
{
|
||||
namespace: '@ohif/extension-default.dataSourcesModule.dicomweb',
|
||||
sourceName: 'ohif3',
|
||||
configuration: {
|
||||
friendlyName: 'AWS S3 Static wado secondary server',
|
||||
name: 'aws',
|
||||
wadoUriRoot: 'https://d3t6nz73ql33tx.cloudfront.net/dicomweb',
|
||||
qidoRoot: 'https://d3t6nz73ql33tx.cloudfront.net/dicomweb',
|
||||
wadoRoot: 'https://d3t6nz73ql33tx.cloudfront.net/dicomweb',
|
||||
qidoSupportsIncludeField: false,
|
||||
supportsReject: false,
|
||||
imageRendering: 'wadors',
|
||||
thumbnailRendering: 'wadors',
|
||||
enableStudyLazyLoad: true,
|
||||
supportsFuzzyMatching: false,
|
||||
supportsWildcard: true,
|
||||
staticWado: true,
|
||||
singlepart: 'bulkdata,video',
|
||||
// whether the data source should use retrieveBulkData to grab metadata,
|
||||
// and in case of relative path, what would it be relative to, options
|
||||
// are in the series level or study level (some servers like series some study)
|
||||
bulkDataURI: {
|
||||
enabled: true,
|
||||
relativeResolution: 'studies',
|
||||
},
|
||||
omitQuotationForMultipartRequest: true,
|
||||
},
|
||||
},
|
||||
|
||||
{
|
||||
namespace: '@ohif/extension-default.dataSourcesModule.dicomweb',
|
||||
sourceName: 'local5000',
|
||||
configuration: {
|
||||
friendlyName: 'Static WADO Local Data',
|
||||
name: 'DCM4CHEE',
|
||||
qidoRoot: 'http://localhost:5000/dicomweb',
|
||||
wadoRoot: 'http://localhost:5000/dicomweb',
|
||||
qidoSupportsIncludeField: false,
|
||||
supportsReject: true,
|
||||
supportsStow: true,
|
||||
imageRendering: 'wadors',
|
||||
thumbnailRendering: 'wadors',
|
||||
enableStudyLazyLoad: true,
|
||||
supportsFuzzyMatching: false,
|
||||
supportsWildcard: true,
|
||||
staticWado: true,
|
||||
singlepart: 'video',
|
||||
bulkDataURI: {
|
||||
enabled: true,
|
||||
relativeResolution: 'studies',
|
||||
},
|
||||
},
|
||||
},
|
||||
{
|
||||
namespace: '@ohif/extension-default.dataSourcesModule.dicomweb',
|
||||
sourceName: 'orthanc',
|
||||
configuration: {
|
||||
friendlyName: 'local Orthanc DICOMWeb Server',
|
||||
name: 'DCM4CHEE',
|
||||
wadoUriRoot: 'http://localhost/pacs/dicom-web',
|
||||
qidoRoot: 'http://localhost/pacs/dicom-web',
|
||||
wadoRoot: 'http://localhost/pacs/dicom-web',
|
||||
qidoSupportsIncludeField: true,
|
||||
supportsReject: true,
|
||||
dicomUploadEnabled: true,
|
||||
imageRendering: 'wadors',
|
||||
thumbnailRendering: 'wadors',
|
||||
enableStudyLazyLoad: true,
|
||||
supportsFuzzyMatching: true,
|
||||
supportsWildcard: true,
|
||||
omitQuotationForMultipartRequest: true,
|
||||
bulkDataURI: {
|
||||
enabled: true,
|
||||
// This is an example config that can be used to fix the retrieve URL
|
||||
// where it has the wrong prefix (eg a canned prefix). It is better to
|
||||
// just use the correct prefix out of the box, but that is sometimes hard
|
||||
// when URLs go through several systems.
|
||||
// Example URLS are:
|
||||
// "BulkDataURI" : "http://localhost/dicom-web/studies/1.2.276.0.7230010.3.1.2.2344313775.14992.1458058363.6979/series/1.2.276.0.7230010.3.1.3.1901948703.36080.1484835349.617/instances/1.2.276.0.7230010.3.1.4.1901948703.36080.1484835349.618/bulk/00420011",
|
||||
// when running on http://localhost:3003 with no server running on localhost. This can be corrected to:
|
||||
// /orthanc/dicom-web/studies/1.2.276.0.7230010.3.1.2.2344313775.14992.1458058363.6979/series/1.2.276.0.7230010.3.1.3.1901948703.36080.1484835349.617/instances/1.2.276.0.7230010.3.1.4.1901948703.36080.1484835349.618/bulk/00420011
|
||||
// which is a valid relative URL, and will result in using the http://localhost:3003/orthanc/.... path
|
||||
// startsWith: 'http://localhost/',
|
||||
// prefixWith: '/orthanc/',
|
||||
},
|
||||
},
|
||||
},
|
||||
|
||||
{
|
||||
namespace: '@ohif/extension-default.dataSourcesModule.dicomwebproxy',
|
||||
sourceName: 'dicomwebproxy',
|
||||
configuration: {
|
||||
friendlyName: 'dicomweb delegating proxy',
|
||||
name: 'dicomwebproxy',
|
||||
// Security controls for runtime ?url=... datasource loading:
|
||||
// In authenticated environments, runtime ?url origins must be allowlisted:
|
||||
// dangerouslyAllowedOriginsForAuthenticatedEnvironments: [
|
||||
// 'https://config.example.com',
|
||||
// 'http://localhost:5000',
|
||||
// ],
|
||||
},
|
||||
},
|
||||
{
|
||||
namespace: '@ohif/extension-default.dataSourcesModule.dicomjson',
|
||||
sourceName: 'dicomjson',
|
||||
configuration: {
|
||||
friendlyName: 'dicom json',
|
||||
name: 'json',
|
||||
// Security controls for runtime ?url=... datasource loading:
|
||||
// In authenticated environments, runtime ?url origins must be allowlisted:
|
||||
// dangerouslyAllowedOriginsForAuthenticatedEnvironments: [
|
||||
// 'https://config.example.com',
|
||||
// 'http://localhost:5000',
|
||||
// ],
|
||||
},
|
||||
},
|
||||
{
|
||||
namespace: '@ohif/extension-default.dataSourcesModule.dicomlocal',
|
||||
sourceName: 'dicomlocal',
|
||||
configuration: {
|
||||
friendlyName: 'dicom local',
|
||||
},
|
||||
},
|
||||
// The following data sources are intentionally NOT enabled in the secure
|
||||
// default because they broaden the attack surface of a default deployment.
|
||||
// Enable them only in a deployment you control (see config/dev.js):
|
||||
// - dicomlocal: loads DICOM files from the user's machine.
|
||||
// - dicomjson: loads metadata from an arbitrary `?url=` (gate with
|
||||
// `dangerouslyAllowedOriginsForAuthenticatedEnvironments`).
|
||||
// - dicomwebproxy: delegating proxy driven by `?url=`.
|
||||
],
|
||||
httpErrorHandler: error => {
|
||||
// This is 429 when rejected from the public idc sandbox too often.
|
||||
@@ -289,29 +105,4 @@ window.config = {
|
||||
// Could use services manager here to bring up a dialog/modal if needed.
|
||||
console.warn('test, navigate to https://ohif.org/');
|
||||
},
|
||||
// segmentation: {
|
||||
// segmentLabel: {
|
||||
// enabledByDefault: true,
|
||||
// labelColor: [255, 255, 0, 1], // must be an array
|
||||
// hoverTimeout: 1,
|
||||
// background: 'rgba(100, 100, 100, 0.5)', // can be any valid css color
|
||||
// },
|
||||
// },
|
||||
// whiteLabeling: {
|
||||
// createLogoComponentFn: function (React) {
|
||||
// return React.createElement(
|
||||
// 'a',
|
||||
// {
|
||||
// target: '_self',
|
||||
// rel: 'noopener noreferrer',
|
||||
// className: 'text-purple-600 line-through',
|
||||
// href: '_X___IDC__LOGO__LINK___Y_',
|
||||
// },
|
||||
// React.createElement('img', {
|
||||
// src: './Logo.svg',
|
||||
// className: 'w-14 h-14',
|
||||
// })
|
||||
// );
|
||||
// },
|
||||
// },
|
||||
};
|
||||
Reference in new issue
Block a user