From 8de47925031eb07d1a9771aa3e75d1d84fad6d4f Mon Sep 17 00:00:00 2001
From: ihabz <ihab.zeedia@stanford.edu>
Date: Sat, 2 Jul 2022 12:18:06 -0700
Subject: [PATCH] fix more psalm warnings.

---
 OnCoreIntegration.php    | 20 ++++++++++++++------
 ajax/cron.php            | 13 ++++++++-----
 assets/scripts/oncore.js | 17 +++++++++++------
 pages/field_map.php      |  9 ++++++---
 4 files changed, 39 insertions(+), 20 deletions(-)

diff --git a/OnCoreIntegration.php b/OnCoreIntegration.php
index 7b240ea..1aec746 100644
--- a/OnCoreIntegration.php
+++ b/OnCoreIntegration.php
@@ -567,16 +567,25 @@ public function injectIntegrationUI()
         $has_oncore_integration = $this->hasOnCoreIntegration();
         ?>
         <link rel="stylesheet" href="<?= $notif_css ?>">
+
+        <script src="<?= $oncore_js ?>" type="text/javascript"></script>
         <script>
             var ajax_endpoint = "<?=$ajax_endpoint?>";
             var field_map_url = "<?=$field_map_url?>";
 
-            var oncore_protocols = <?=json_encode($available_oncore_protocols); ?>;
-            var oncore_integrations = <?=json_encode($oncore_integrations); ?>;
-            var has_oncore_integration = <?=json_encode($has_oncore_integration); ?>;
+            //var oncore_integrations = <?//=json_encode($oncore_integrations); ?>//;
+            //var has_oncore_integration = <?//=json_encode($has_oncore_integration); ?>//;
+            //
+            //var has_field_mappings = <?//=json_encode(!empty($this->getMapping()->getProjectFieldMappings()['pull']) && !empty($this->getMapping()->getProjectFieldMappings()['push']) ? true : false); ?>//;
+            //var last_adjudication = <?//=json_encode($this->getSyncDiffSummary()); ?>//;
+
 
-            var has_field_mappings = <?=json_encode(!empty($this->getMapping()->getProjectFieldMappings()['pull']) && !empty($this->getMapping()->getProjectFieldMappings()['push']) ? true : false); ?>;
-            var last_adjudication = <?=json_encode($this->getSyncDiffSummary()); ?>;
+            var oncore_protocols = decode_object("<?=htmlentities(json_encode($available_oncore_protocols, JSON_THROW_ON_ERROR)); ?>");
+            var oncore_integrations = decode_object("<?=htmlentities(json_encode($oncore_integrations, JSON_THROW_ON_ERROR)); ?>");
+            var has_oncore_integration = decode_object("<?=htmlentities(json_encode($has_oncore_integration, JSON_THROW_ON_ERROR)); ?>");
+
+            var has_field_mappings = decode_object("<?=htmlentities(json_encode(!empty($this->getMapping()->getProjectFieldMappings()['pull']) && !empty($this->getMapping()->getProjectFieldMappings()['push']) ? true : false, JSON_THROW_ON_ERROR)); ?>");
+            var last_adjudication = decode_object("<?=htmlentities(json_encode($this->getSyncDiffSummary(), JSON_THROW_ON_ERROR)); ?>");
 
             var make_oncore_module = function () {
                 if ($("#setupChklist-modify_project").length) {
@@ -767,7 +776,6 @@ public function injectIntegrationUI()
             }
         </style>
         <script src="<?= $notif_js ?>" type="text/javascript"></script>
-        <script src="<?= $oncore_js ?>" type="text/javascript"></script>
         <?php
     }
 
diff --git a/ajax/cron.php b/ajax/cron.php
index e396989..ad81c8e 100644
--- a/ajax/cron.php
+++ b/ajax/cron.php
@@ -16,28 +16,31 @@
     if ($action == 'protocols') {
         $module->getProtocols()->processCron($module->getProjectId(), $Proj->project['project_irb_number']);
         header('Content-Type: application/json');
-        echo json_encode(array('status' => 'success', 'message' => 'Protocols Cron completed for pid' . $module->getProjectId()));
+        $result = json_encode(array('status' => 'success', 'message' => 'Protocols Cron completed for pid' . $module->getProjectId()), JSON_THROW_ON_ERROR);
     } elseif ($action == 'subjects') {
         $module->getProtocols()->syncRecords();
         header('Content-Type: application/json');
-        echo json_encode(array('status' => 'success', 'message' => 'Subjects Cron completed for pid' . $module->getProjectId()));
+        $result = json_encode(array('status' => 'success', 'message' => 'Subjects Cron completed for pid' . $module->getProjectId()), JSON_THROW_ON_ERROR);
     } elseif ($action == 'redcap_only') {
         $module->getProtocols()->syncREDCapRecords();
         header('Content-Type: application/json');
-        echo json_encode(array('status' => 'success', 'message' => 'REDCap Records Cron completed for pid' . $module->getProjectId()));
+        $result = json_encode(array('status' => 'success', 'message' => 'REDCap Records Cron completed for pid' . $module->getProjectId()), JSON_THROW_ON_ERROR);
     } else {
         throw new \Exception('Unknown Action');
     }
+    echo htmlentities($result, ENT_QUOTES);;
 } catch (\LogicException|ClientException|GuzzleException $e) {
     header("Content-type: application/json");
 //    http_response_code(404);
     Entities::createException($e->getMessage());
     $result['data'] = [];
-    echo json_encode($result);
+    $result = json_encode($result);
+    echo htmlentities($result, ENT_QUOTES);;
 } catch (\Exception $e) {
     header("Content-type: application/json");
     Entities::createException($e->getMessage());
     http_response_code(404);
-    echo json_encode(array('status' => 'error', 'message' => $e->getMessage()));
+    $result = json_encode(array('status' => 'error', 'message' => $e->getMessage()));
+    echo htmlentities($result, ENT_QUOTES);;
 }
 ?>
diff --git a/assets/scripts/oncore.js b/assets/scripts/oncore.js
index 997364d..790f487 100644
--- a/assets/scripts/oncore.js
+++ b/assets/scripts/oncore.js
@@ -1,14 +1,19 @@
 function decode_object(obj) {
     // parse text to json object
-    obj = JSON.parse(obj.replace(/&quot;/g, '"'));
-    for (key in obj) {
-        if (typeof obj[key] === Object) {
-            return decode_object(obj[key])
+    var parsedObj = obj;
+    if (typeof obj === 'string') {
+        var temp = obj.replace(/&quot;/g, '"')
+        parsedObj = JSON.parse(temp);
+    }
+
+    for (key in parsedObj) {
+        if (typeof parsedObj[key] === 'object') {
+            parsedObj[key] = decode_object(parsedObj[key])
         } else {
-            obj[key] = decode_string(obj[key])
+            parsedObj[key] = decode_string(parsedObj[key])
         }
     }
-    return obj
+    return parsedObj
 }
 
 function decode_string(input) {
diff --git a/pages/field_map.php b/pages/field_map.php
index ce3cd73..654a27d 100644
--- a/pages/field_map.php
+++ b/pages/field_map.php
@@ -176,7 +176,8 @@
     margin-left:10px; width:30px; height:30px;
     background-size:contain;
 }
-#field_mapping #study_sites .loading::after{
+
+#field_mapping #study_sites .loading::after {
     top: 12px;
     right: 25px;
 }
@@ -185,8 +186,10 @@
 <script>
     $(document).ready(function () {
         var ajax_endpoint = "<?=$ajax_endpoint?>";
-        var oncore_fields = <?=json_encode($oncore_fields)?>;
-        var pushpull_pref = <?=json_encode($pushpull_pref)?>;
+        //var oncore_fields = <?//=json_encode($oncore_fields)?>//;
+        var oncore_fields = decode_object("<?=htmlentities(json_encode($oncore_fields, JSON_THROW_ON_ERROR)); ?>");
+        //var pushpull_pref = <?//=json_encode($pushpull_pref)?>//;
+        var pushpull_pref = decode_object("<?=htmlentities(json_encode($pushpull_pref, JSON_THROW_ON_ERROR)); ?>");
         var redcap_csrf_token = "<?=$module->getCSRFToken()?>";
 
         //THIS WILL QUEUE THE AJAX REQUESTS SO THEY DONT RACE CONDITION EACH OTHER