scout-browser 4.101.0__py3-none-any.whl → 4.103.0__py3-none-any.whl

scout/server/blueprints/cases/templates/cases/case_report.html

@@ -2,6 +2,8 @@
 {% from "utils.html" import comments_table, variant_related_comments_table %}
 {% from "variant/gene_disease_relations.html" import inheritance_badge %}
 {% from "variants/components.html" import fusion_variants_header, default_fusion_variant_cells %}
+{% from "variant/variant_details.html" import frequencies_table, old_observations_table %}
+{% from "variant/components.html" import clinsig_table %}
 
 {% extends "report_base.html" %}
 
@@ -192,7 +194,7 @@
   	              <ul>
   	                {% for pheno in case.phenotype_terms %}
   	                  <li>
-  	                  {{pheno.feature}} - (<a style="text-decoration:none;" href="https://hpo.jax.org/app/browse/term/{{pheno.phenotype_id}}" target="_blank">{{pheno.phenotype_id}})</a>
+  	                  {{pheno.feature}} - (<a style="text-decoration:none;" href="{{ hpo_link_url }}{{pheno.phenotype_id}}" target="_blank">{{pheno.phenotype_id}})</a>
                       {% for feature_ind in pheno.individuals %} <!-- display eventual individual-level HPO terms -->
                         {% for case_ind in case.individuals %}
                           {% if feature_ind.individual_name == case_ind.display_name %}
@@ -588,78 +590,14 @@
       <table class="table table-sm">
         <tr>
           <td style="width:60%;">
-            {{ genotype_table(variant) }}
+            {{ genotype_table(variant) }}<br>
+            {{ clinsig_table(variant) }}
           </td>
           <td style="width:3%"></td>
           <td>
-            <table id="panel-table" class="table table-sm" style="background-color: transparent">
-              <thead>
-                <tr>
-                  <th>Pop. frequency
-                    {% if variant.frequency == 'common' %}
-                      <span class="badge bg-danger">{{variant.frequency}}</span>
-                    {% elif variant.frequency == 'uncommon' %}
-                      <span class="badge bg-warning text-dark">{{variant.frequency}}</span>
-                    {% else %}
-                      <span class="badge bg-success">{{variant.frequency}}</span>
-                    {% endif %}
-                  </th>
-                  <th>
-                  </th>
-                </tr>
-              </thead>
-              <tbody>
-                <tr>
-                  <td>
-                    {% if variant.dbsnp_id %}
-                      <a style="text-decoration:none;" href="{{ variant.thousandg_link }}" rel="noopener" target="_blank">1000G</a>
-                    {% else %}
-                      1000G
-                    {% endif %}
-                  </td>
-                  <td>
-                    {% if variant.max_thousand_genomes_frequency %}
-                      {{ variant.max_thousand_genomes_frequency|human_decimal }} <small>(max)</small> |
-                    {% endif %}
-                    {{ variant.thousand_genomes_frequency|human_decimal if variant.thousand_genomes_frequency }}
-                    {% if not variant.max_thousand_genomes_frequency and not variant.thousand_genomes_frequency %}
-                      <span class="text-muted">Not annotated</span>
-                    {% endif %}
-                  </td>
-                </tr>
-                <tr>
-                  <td><a style="text-decoration:none;" title="Exome Aggregation Consortium" rel="noopener" target="_blank" href="{{ variant.exac_link }}">ExAC</a></td>
-                  <td>
-                    {% if variant.max_exac_frequency %}
-                      {{ variant.max_exac_frequency|human_decimal }} <small>(max)</small> |
-                    {% endif %}
-                    {{ variant.exac_frequency|human_decimal if variant.exac_frequency }}
-                    {% if not variant.max_exac_frequency and not variant.exac_frequency %}
-                      <span class="text-muted">Not annotated</span>
-                    {% endif %}
-                  </td>
-                </tr>
-                <tr>
-                  <td><a style="text-decoration:none;" title="genome Aggregation Database" rel="noopener" target="_blank" href="{{ variant.gnomad_link }}">gnomAD</a></td>
-                  <td>
-                    {% if 'gnomad_frequency' in variant%}
-                      {% if variant.max_gnomad_frequency %}
-                        {{ variant.max_gnomad_frequency|human_decimal }}
-                        <small>(max)</small> |
-                      {% endif %}
-                      {{ variant.gnomad_frequency|human_decimal if variant.gnomad_frequency }}
-                    {% else %}
-                      <span class="text-muted">Not annotated</span>
-                    {% endif %}
-                  </td>
-                  <td>
-                  </td>
-                </tr>
-              </tbody>
-            </table>
+          {{ frequencies_table(variant) }}
+          {{ old_observations_table(variant) }}
           </td>
-        </tr>
-      </table>
       <table id="panel-table" class="table table-sm" style="background-color: transparent">
         <thead>
           <tr>
@@ -762,11 +700,28 @@
         <tbody>
           <tr>
             <td>{{ variant.sift_predictions|join(', ') or '-'}}</td>
-            <td>{{ variant.revel or '-' }}</td>
+            <td>
+              {% if variant.revel %}
+                <span class="badge bg-{{variant.revel|get_label_or_color_by_score('revel', 'color')}}">
+                  {{ variant.revel }}
+                </span>
+              {% else %}
+                <span class="badge bg-secondary">–</span>
+              {% endif %}
+            </td>
             <td>{{ variant.revel_score or '-' }}</td>
             <td>{{ variant.polyphen_predictions|join(', ') or '-' }}</td>
             <td>{{ variant.spidex|spidex_human if variant.spidex else none|spidex_human }}</td>
-            <td>{{ variant.spliceai_scores|join(', ') or '-' }}</td>
+            <td>
+              {% set spliceai_highest = variant.spliceai_scores | spliceai_max %}
+              {% if spliceai_highest %}
+                <span class="badge bg-{{ spliceai_highest | get_label_or_color_by_score('spliceai', 'color') }}">
+                  {{ variant.spliceai_scores|join(', ') }}
+                </span>
+              {% else %}
+                <span class="badge bg-secondary">–</span>
+              {% endif %}
+            </td>
           </tr>
         </tbody>
       </table>
@@ -1074,25 +1029,8 @@
         </td>
         <td style="width:3%"></td>
         <td>
-          <table id="panel-table" class="table table-sm" style="background-color: transparent">
-            <thead>
-              <th colspan=2>Pop. frequency</th>
-            </thead>
-            <tbody>
-              {% for freq_name, value, link in variant.frequencies %}
-                <tr>
-                  <td>{{ freq_name }}</td>
-                  <td>
-                    {% if value %}
-                      <span class="badge bg-secondary">{{ value|human_decimal }}</span>
-                    {% else %}
-                      <span class="text-muted">Not annotated</span>
-                    {% endif %}
-                  </td>
-                </tr>
-              {% endfor %}
-            </tbody>
-          </table>
+          {{ frequencies_table(variant) }}
+          {{ old_observations_table(variant) }}
         </td>
       </tr>
     </table>

scout/server/blueprints/cases/templates/cases/matchmaker.html

@@ -85,7 +85,7 @@
         <ul class="list-group list-group-flush">
           {% for hpo in case.mme_submission.features %}
             <li class="list-group-item">
-              <a class="text-white" target="_blank" href="http://hpo.jax.org/app/browse/term/{{hpo.id}}">
+              <a class="text-white" target="_blank" href="{{hpo_link_url}}{{hpo.id}}">
               <span class="badge bg-sm bg-info">{{hpo.id}}</span>
               </a>{{hpo.label}}
             </li>

scout/server/blueprints/cases/templates/cases/phenotype.html

@@ -191,7 +191,7 @@
 {% endmacro %}
 
 {% macro hpo_panel(case, institute, config) %}
-  {% set url = 'https://hpo.jax.org/app/' %}
+  {% set url = 'https://hpo.jax.org/' %}
     <div id="phenotypes_panel" class="panel-heading">
       <h6 class="mt-3"><span class="fa fa-stethoscope"></span>&nbsp;Phenotype terms (<a target="_blank" class="" href="{{ url }}" rel="noopener">HPO</a>)</h6>
     </div>

scout/server/blueprints/cases/templates/cases/utils.html

@@ -293,8 +293,18 @@
 
   {% if variant.category %}
     {% if variant.category in "str" %}
-      {{ variant.str_repid }} {{ variant.alternative | replace("<", " ") | replace(">", "")}}
-
+      {% if variant.str_repid %}
+        {{ variant.str_repid }}
+      {% elif variant.str_trid %}
+        {{ variant.str_trid  }}
+      {% else %}
+        {% for gene in variant.genes %} {{ gene.symbol }} {% endfor %}
+      {% endif %}
+      {% if variant.str_mc %}
+        STR{{ variant.str_mc }}
+      {% else %}
+        {{ variant.alternative|truncate(20,True) }}
+      {% endif %}
     {% elif variant.category in ("snv", "cancer") %}
       {% set display_genes = [] %}
       {% for gene in variant.genes %}
@@ -339,18 +349,24 @@
 {% macro pretty_link_variant(variant, case) %}
 {# Returns human readable links to the corresponding variant page #}
 
-  {% if variant.category in ("mei", "str", "snv", "cancer") %}
-    {% if variant.category == "cancer" %}
-    <a href='{{ url_for('variant.cancer_variant',
+  {% if variant.category in ("mei", "snv") %}
+    <a href='{{ url_for('variant.variant',
                    institute_id=variant.institute,
                    case_name=case.display_name,
                    variant_id=variant._id) }}' target='_blank'>
-    {% else %}
+  {% elif variant.category == "str" %}
     <a href='{{ url_for('variant.variant',
+                   institute_id=variant.institute,
+                   case_name=case.display_name,
+                   variant_id=variant._id) }}'
+       data-bs-toggle='tooltip'
+       title='{{ variant.alternative | replace("<", " ") | replace(">", "")}}'
+       target='_blank'>
+  {% elif variant.category == "cancer" %}
+    <a href='{{ url_for('variant.cancer_variant',
                    institute_id=variant.institute,
                    case_name=case.display_name,
                    variant_id=variant._id) }}' target='_blank'>
-    {% endif %}
   {% elif variant.category == "outlier" %}
     <a href='{{ url_for('omics_variants.outliers',
        institute_id=variant.institute, case_name=case.display_name) }}' target='_blank'>
@@ -360,7 +376,7 @@
                               case_name=case.display_name,
                               variant_id=variant._id) }}' target='_blank'>
   {% endif %}
-    {{ pretty_variant(variant) }}
+  {{ pretty_variant(variant) }}
   </a>
 {% endmacro %}
 
@@ -442,21 +458,7 @@
               <div class="row">
                 <div class="col">
                   <i class="far fa-check-circle"></i>
-                  {% if variant.category == "snv" %}
-                    <a href="{{ url_for('variant.variant',
-                                        institute_id=variant.institute,
-                                        case_name=case.display_name,
-                                        variant_id=variant._id) }}">
-                          {{ variant.hgnc_symbols|join(', ') }} (partial causative)
-  		             {% else %}
-          		      <a href="{{ url_for('variant.sv_variant',
-                                              institute_id=variant.institute,
-                                              case_name=case.display_name,
-                                              variant_id=variant._id) }}">
-  		              {{ variant.sub_category|upper }}({{ variant.chromosome }}{{ variant.cytoband_start }}-{{ variant.chromosome }}{{ variant.cytoband_end }})
-                    (partial causative)
-  		             {% endif %}
-                   </a>
+                  {{ pretty_link_variant(variant, case) }} (partial causative)
                 </div>
                 <div class="col-2" style="width:fit-content;">
                   {{ remove_form(url_for('cases.mark_causative',
@@ -495,7 +497,7 @@
                 </div>
                 <div class="col-8">
                   {% for hpo in variant_phenotypes.hpo_terms %}
-                    <a target="_blank" href="http://hpo.jax.org/app/browse/term/{{hpo.phenotype_id}}">
+                    <a target="_blank" href="https://hpo.jax.org/browse/term/{{hpo.phenotype_id}}">
                       <span class="badge badge-sm bg-info">{{hpo.phenotype_id}}</span>
                     </a>
                   {% else %}
@@ -615,42 +617,21 @@
         </li>
       {% endfor %}
     </ul>
-    {{ clinvar_vars_summary(suspects, case, institute) }}
       </div>
   </div>
 {% endmacro %}
 
 {% macro clinvar_var_status(variant, case, institute) %}
-    {% if variant._id and variant.category != 'str' %}
+    {% if case.clinvar_variants and variant._id in case.clinvar_variants.keys() %}
+      (included in a ClinVar submission)
+    {% elif variant._id and variant.category in ["snv", "sv"] %}
         <form id="clinvar_submit" class="d-flex justify-content-center" action="{{ url_for('clinvar.clinvar_add_variant', institute_id=institute._id, case_name=case.display_name) }}" method="POST">
-            {% if case.clinvar_variants and variant._id in case.clinvar_variants.keys() %}
-                (included in ClinVar submission)
-            {% elif variant.category in ('cancer', 'cancer_sv') %}
-                <button data-bs-toggle='tooltip' data-bs-placement="bottom" title="Submission of somatic variants from Scout is temporarily suspended. We are working to harmonize submissions with changes introduced by ClinVar for this variant category." disabled >Add to ClinVar submission</button>
-            {% elif variant.category in ('snv', 'sv') %}
-                <button type="submit" name="var_id" value="{{variant._id}}" class="btn btn-secondary btn-sm" style="float: right;">Add to ClinVar submission</button>
-            {% endif %}
+          <button type="submit" name="var_id" value="{{variant._id}}" class="btn btn-secondary btn-sm" style="float: right;">Add to ClinVar submission</button>
+        </form>
+    {% elif variant.category in ('cancer') %}
+        <form id="clinvar_onc_submit" class="d-flex justify-content-center" action="{{ url_for('clinvar.clinvar_add_onc_variant', institute_id=institute._id, case_name=case.display_name) }}" method="POST">
+          <button type="submit" name="var_id" value="{{variant._id}}" class="btn btn-secondary btn-sm" style="float: right;">Add to ClinVar submission</button>
         </form>
-    {% endif %}
-{% endmacro %}
-
-{% macro clinvar_vars_summary(suspects, case, institute) %}
-    {% if case.clinvar_variants %}
-        {% if case.clinvar_variants_not_in_suspects | length >0 %}
-            <div class="d-flex align-content-center flex-wrap">
-                <div class="col-auto d-flex align-items-center wrap">
-                    <h6 class="m-2">&nbsp;Variants present in a ClinVar submission, no longer pinned:</h6>
-                </div>
-                {% for entry in case.clinvar_variants_not_in_suspects %}
-                    <div class="m-2">{{ pretty_link_variant(entry, case) }}</div>
-                {% endfor %}
-            </div>
-        {% endif %}
-            <div class="card-footer d-flex justify-content-center pb-0" style="background-color:inherit;">
-                <a href="{{url_for('clinvar.clinvar_submissions', institute_id=institute._id)}}"
-                    class="btn btn-secondary btn-sm text-white mx-3" target="_blank" rel="noopener noreferrer">View ClinVar
-                    submissions <i class="fas fa-arrow-circle-right"></i></a>
-            </div>
     {% endif %}
 {% endmacro %}
 

scout/server/blueprints/cases/views.py

@@ -36,6 +36,7 @@ from scout.server.utils import (
     html_to_pdf_file,
     institute_and_case,
     jsonconverter,
+    safe_redirect_back,
     templated,
     user_cases,
     user_institutes,
@@ -148,7 +149,7 @@ def beacon_add_variants(institute_id, case_name):
         store, institute_id, case_name
     )  # This function checks if user has permissions to access the case
     beacon.add_variants(store, case_obj, request.form)
-    return redirect(request.referrer)
+    return safe_redirect_back(request)
 
 
 @cases_bp.route("/beacon_remove_variants/<institute_id>/<case_name>", methods=["GET"])
@@ -158,7 +159,7 @@ def beacon_remove_variants(institute_id, case_name):
         store, institute_id, case_name
     )  # This function checks if user has permissions to access the case
     beacon.remove_variants(store, institute_id, case_obj)
-    return redirect(request.referrer)
+    return safe_redirect_back(request)
 
 
 @cases_bp.route("/<institute_id>/<case_name>/mme_matches", methods=["GET", "POST"])
@@ -175,7 +176,7 @@ def matchmaker_match(institute_id, case_name, target):
     """Starts an internal match or a match against one or all MME external nodes"""
     institute_obj, case_obj = institute_and_case(store, institute_id, case_name)
     match_results = controllers.matchmaker_match(request, target, institute_id, case_name)
-    return redirect(request.referrer)
+    return safe_redirect_back(request)
 
 
 @cases_bp.route("/<institute_id>/<case_name>/mme_add", methods=["POST"])
@@ -183,7 +184,7 @@ def matchmaker_add(institute_id, case_name):
     """Add or update a case in MatchMaker"""
     # Call matchmaker_delete controller to add a patient to MatchMaker
     controllers.matchmaker_add(request, institute_id, case_name)
-    return redirect(request.referrer)
+    return safe_redirect_back(request)
 
 
 @cases_bp.route("/<institute_id>/<case_name>/mme_delete", methods=["POST"])
@@ -191,7 +192,7 @@ def matchmaker_delete(institute_id, case_name):
     """Remove a case from MatchMaker"""
     # Call matchmaker_delete controller to delete a patient from MatchMaker
     controllers.matchmaker_delete(request, institute_id, case_name)
-    return redirect(request.referrer)
+    return safe_redirect_back(request)
 
 
 @cases_bp.route("/<institute_id>/<case_name>/individuals", methods=["POST"])
@@ -212,7 +213,7 @@ def update_individual(institute_id, case_name):
         age=age,
         tissue=tissue,
     )
-    return redirect(request.referrer)
+    return safe_redirect_back(request)
 
 
 @cases_bp.route("/<institute_id>/<case_name>/samples", methods=["POST"])
@@ -237,7 +238,7 @@ def update_cancer_sample(institute_id, case_name):
         tumor_type=tumor_type,
         tumor_purity=tumor_purity,
     )
-    return redirect(request.referrer)
+    return safe_redirect_back(request)
 
 
 @cases_bp.route("/<institute_id>/<case_name>/synopsis", methods=["POST"])
@@ -247,7 +248,7 @@ def case_synopsis(institute_id, case_name):
     user_obj = store.user(current_user.email)
     new_synopsis = request.form.get("synopsis")
     controllers.update_synopsis(store, institute_obj, case_obj, user_obj, new_synopsis)
-    return redirect(request.referrer)
+    return safe_redirect_back(request)
 
 
 @cases_bp.route("/api/v1/<institute_id>/<case_name>/case_report", methods=["GET"])
@@ -344,7 +345,7 @@ def mt_report(institute_id, case_name):
     shutil.rmtree(temp_excel_dir)
 
     flash("No MT report excel file could be exported for this sample", "warning")
-    return redirect(request.referrer)
+    return safe_redirect_back(request)
 
 
 @cases_bp.route("/<institute_id>/<case_name>/diagnose", methods=["POST"])
@@ -366,7 +367,7 @@ def case_diagnosis(institute_id, case_name):
         affected_inds=affected_inds,
         remove=True if request.args.get("remove") == "yes" else False,
     )
-    return redirect("#".join([link, "disease_assign"]))
+    return safe_redirect_back(request, "#".join([link, "disease_assign"]))
 
 
 @cases_bp.route("/<institute_id>/<case_name>/phenotypes", methods=["POST"])
@@ -414,7 +415,7 @@ def phenotypes(institute_id, case_name, phenotype_id=None):
             )
             return redirect(case_url)
 
-    return redirect("#".join([case_url, "phenotypes_panel"]))
+    return safe_redirect_back(request, "#".join([case_url, "phenotypes_panel"]))
 
 
 @cases_bp.route("/<institute_id>/<case_name>/phenotype_export", methods=["POST"])
@@ -526,7 +527,7 @@ def phenotypes_actions(institute_id, case_name):
         hgnc_ids = [result[0] for result in results if result[1] >= hpo_count]
         store.update_dynamic_gene_list(case_obj, hgnc_ids=hgnc_ids, phenotype_ids=hpo_ids)
 
-    return redirect("#".join([case_url, "phenotypes_panel"]))
+    return safe_redirect_back(request, "#".join([case_url, "phenotypes_panel"]))
 
 
 @cases_bp.route("/<institute_id>/<case_name>/events", methods=["POST"])
@@ -567,7 +568,7 @@ def events(institute_id, case_name, event_id=None):
             # create a case comment
             store.comment(institute_obj, case_obj, user_obj, link, content=content)
 
-    return redirect(request.referrer)
+    return safe_redirect_back(request)
 
 
 @cases_bp.route("/<institute_id>/<case_name>/status", methods=["POST"])
@@ -588,7 +589,7 @@ def status(institute_id, case_name):
     if tags or case_obj.get("tags") and tags != case_obj.get("tags"):
         store.tag_case(institute_obj, case_obj, user_obj, tags, link)
 
-    return redirect(request.referrer)
+    return safe_redirect_back(request)
 
 
 @cases_bp.route("/<institute_id>/<case_name>/assign", methods=["POST"])
@@ -605,7 +606,7 @@ def assign(institute_id, case_name, user_id=None, inactivate=False):
         store.unassign(institute_obj, case_obj, user_obj, link, inactivate)
     else:
         store.assign(institute_obj, case_obj, user_obj, link)
-    return redirect(request.referrer)
+    return safe_redirect_back(request)
 
 
 @cases_bp.route("/api/v1/cases", defaults={"institute_id": None})
@@ -688,7 +689,7 @@ def pin_variant(institute_id, case_name, variant_id):
         store.pin_variant(institute_obj, case_obj, user_obj, link, variant_obj)
     elif request.form["action"] == "DELETE":
         store.unpin_variant(institute_obj, case_obj, user_obj, link, variant_obj)
-    return redirect(request.referrer or link)
+    return safe_redirect_back(request, request.referrer or link)
 
 
 @cases_bp.route("/<institute_id>/<case_name>/<variant_id>/validate", methods=["POST"])
@@ -705,7 +706,7 @@ def mark_validation(institute_id, case_name, variant_id):
         variant_id=variant_id,
     )
     store.validate(institute_obj, case_obj, user_obj, link, variant_obj, validate_type)
-    return redirect(request.referrer or link)
+    return safe_redirect_back(request, request.referrer or link)
 
 
 @cases_bp.route(
@@ -748,8 +749,7 @@ def mark_causative(institute_id, case_name, variant_id, partial_causative=False)
             store.unmark_causative(institute_obj, case_obj, user_obj, link, variant_obj)
 
     # send the user back to the case that was marked as solved
-    case_url = url_for(".case", institute_id=institute_id, case_name=case_name)
-    return redirect(request.referrer)
+    return safe_redirect_back(request)
 
 
 @cases_bp.route("/<institute_id>/<case_name>/check-case", methods=["POST"])
@@ -761,7 +761,7 @@ def check_case(institute_id, case_name):
     store.case_collection.find_one_and_update(
         {"_id": case_obj["_id"]}, {"$set": {"needs_check": False}}
     )
-    return redirect(request.referrer)
+    return safe_redirect_back(request)
 
 
 @cases_bp.route("/<institute_id>/<case_name>/report/<report_type>")
@@ -835,7 +835,7 @@ def share(institute_id, case_name):
     except ValueError as ex:
         flash(str(ex), "warning")
 
-    return redirect(request.referrer)
+    return safe_redirect_back(request)
 
 
 @cases_bp.route("/<institute_id>/<case_name>/update_rerun_status")
@@ -846,7 +846,7 @@ def update_rerun_status(institute_id, case_name):
     link = url_for("cases.case", institute_id=institute_id, case_name=case_name)
 
     store.update_rerun_status(institute_obj, case_obj, user_obj, link)
-    return redirect(link)
+    return safe_redirect_back(request, link)
 
 
 @cases_bp.route("/<institute_id>/<case_name>/monitor", methods=["POST"])
@@ -860,7 +860,7 @@ def rerun_monitor(institute_id, case_name):
     else:
         store.unmonitor(institute_obj, case_obj, user_obj, link)
 
-    return redirect(request.referrer)
+    return safe_redirect_back(request)
 
 
 @cases_bp.route("/<institute_id>/<case_name>/reanalysis", methods=["POST"])
@@ -876,7 +876,7 @@ def reanalysis(institute_id, case_name):
         LOG.error(msg)
         flash(msg, "danger")
 
-    return redirect(request.referrer)
+    return safe_redirect_back(request)
 
 
 @cases_bp.route("/<institute_id>/<case_name>/research", methods=["POST"])
@@ -886,7 +886,7 @@ def research(institute_id, case_name):
     user_obj = store.user(current_user.email)
     link = url_for(".case", institute_id=institute_id, case_name=case_name)
     store.open_research(institute_obj, case_obj, user_obj, link)
-    return redirect(request.referrer)
+    return safe_redirect_back(request)
 
 
 @cases_bp.route("/<institute_id>/<case_name>/reset_research", methods=["GET"])
@@ -895,7 +895,7 @@ def reset_research(institute_id, case_name):
     user_obj = store.user(current_user.email)
     link = url_for(".case", institute_id=institute_id, case_name=case_name)
     store.reset_research(institute_obj, case_obj, user_obj, link)
-    return redirect(request.referrer)
+    return safe_redirect_back(request)
 
 
 @cases_bp.route("/<institute_id>/<case_name>/cohorts", methods=["POST"])
@@ -909,7 +909,7 @@ def cohorts(institute_id, case_name):
         store.remove_cohort(institute_obj, case_obj, user_obj, link, cohort_tag)
     else:
         store.add_cohort(institute_obj, case_obj, user_obj, link, cohort_tag)
-    return redirect("#".join([request.referrer, "cohorts"]))
+    return safe_redirect_back(request, "#".join([request.referrer, "cohorts"]))
 
 
 @cases_bp.route("/<institute_id>/<case_name>/default-panels", methods=["POST"])
@@ -917,7 +917,7 @@ def default_panels(institute_id, case_name):
     """Update default panels for a case."""
     panel_ids = request.form.getlist("panel_ids")
     controllers.update_default_panels(store, current_user, institute_id, case_name, panel_ids)
-    return redirect(request.referrer)
+    return safe_redirect_back(request)
 
 
 @cases_bp.route("/<institute_id>/<case_name>/update-clinical-filter-hpo", methods=["POST"])
@@ -928,7 +928,7 @@ def update_clinical_filter_hpo(institute_id, case_name):
     controllers.update_clinical_filter_hpo(
         store, current_user, institute_obj, case_obj, hpo_clinical_filter
     )
-    return redirect(request.referrer)
+    return safe_redirect_back(request)
 
 
 @cases_bp.route("/<institute_id>/<case_name>/add_case_group", methods=["GET", "POST"])
@@ -943,8 +943,7 @@ def add_case_group(institute_id, case_name):
         case_name = request.form.get("other_case_name")
 
     controllers.add_case_group(store, current_user, institute_id, case_name, group_id)
-
-    return redirect(request.referrer + "#case_groups")
+    return safe_redirect_back(request, request.referrer + "#case_groups")
 
 
 @cases_bp.route("/<institute_id>/<case_name>/<case_group>/remove_case_group", methods=["GET"])
@@ -952,7 +951,7 @@ def remove_case_group(institute_id, case_name, case_group):
     """Unbind a case group from a case. Remove the group if it is no longer in use."""
     controllers.remove_case_group(store, current_user, institute_id, case_name, case_group)
 
-    return redirect(request.referrer + "#case_groups")
+    return safe_redirect_back(request, request.referrer + "#case_groups")
 
 
 @cases_bp.route("/<case_group>/case_group_update_label", methods=["POST"])
@@ -962,7 +961,7 @@ def case_group_update_label(case_group):
 
     controllers.case_group_update_label(store, case_group, label)
 
-    return redirect(request.referrer + "#case_groups")
+    return safe_redirect_back(request, request.referrer + "#case_groups")
 
 
 @cases_bp.route("/<institute_id>/<case_name>/download-hpo-genes/<category>", methods=["GET"])