Ensure error handling for invalid json_decode output by adding array validation checks across routes, traits, and response methods. Replace echo statements with standardized response error handling in module_config_t.

services/nginx/app/classes/authentication.php

@@ -108,6 +108,9 @@ class authentication implements authentication_i
         // Get the token from the headers
         $headers = getallheaders();
         $tmp = json_decode(file_get_contents('php://input'), true);
+        if (!is_array($tmp)) {
+            $tmp = [];
+        }
         if (!isset($headers['Authorization']) && !isset($_GET['token']) && !isset($_POST['token']) && !isset($tmp['token'])) {
             return false;
         }

services/nginx/app/classes/response.php

@@ -148,6 +148,11 @@ class response implements response_i
         if ($_SERVER['REQUEST_METHOD'] === 'GET' || $_SERVER['REQUEST_METHOD'] === 'DELETE' || $_SERVER['REQUEST_METHOD'] === 'OPTIONS') {
             $data = $_GET;
         }
+
+        if (!is_array($data)) {
+            $data = [];
+        }
+
         // If the data key is not set, try to get it from the opposite method
         if (!array_key_exists($key, $data)) {
             if ($_SERVER['REQUEST_METHOD'] === 'POST' || $_SERVER['REQUEST_METHOD'] === 'PUT' || $_SERVER['REQUEST_METHOD'] === 'PATCH') {
@@ -156,6 +161,11 @@ class response implements response_i
                 $data = json_decode(file_get_contents('php://input'), true);
             }
         }
+
+        if (!is_array($data)) {
+            $data = [];
+        }
+
         // Return the data
         return $data[$key] ?? null;
     }
@@ -175,6 +185,11 @@ class response implements response_i
         if ($_SERVER['REQUEST_METHOD'] === 'GET' || $_SERVER['REQUEST_METHOD'] === 'DELETE' || $_SERVER['REQUEST_METHOD'] === 'OPTIONS') {
             $data = $_GET;
         }
+
+        if (!is_array($data)) {
+            return [];
+        }
+
         return $data;
     }
 
@@ -186,6 +201,7 @@ class response implements response_i
      */
     public function isRequestParameterSet(string $key): bool
     {
+        $data = [];
         // Get the request data if the method is POST, PUT or PATCH
         if ($_SERVER['REQUEST_METHOD'] === 'POST' || $_SERVER['REQUEST_METHOD'] === 'PUT' || $_SERVER['REQUEST_METHOD'] === 'PATCH') {
             $data = json_decode(file_get_contents('php://input'), true);
@@ -194,6 +210,11 @@ class response implements response_i
         if ($_SERVER['REQUEST_METHOD'] === 'GET' || $_SERVER['REQUEST_METHOD'] === 'DELETE' || $_SERVER['REQUEST_METHOD'] === 'OPTIONS') {
             $data = $_GET;
         }
+
+        if (!is_array($data)) {
+            return false;
+        }
+
         return array_key_exists($key, $data);
     }
 

services/nginx/app/routes/authRoute.php

@@ -22,6 +22,9 @@ class authRoute
             global $response;
             $this->requireRecaptcha();
             $data = json_decode(file_get_contents('php://input'), true);
+            if (!is_array($data)) {
+                $data = [];
+            }
             // Check if the customer number, and password are set
             if (!isset($data['customer_number']) || empty($data['customer_number']) || !is_numeric($data['customer_number']) || $data['customer_number'] < 1) {
                 $response->error('Customer number is required', 400);
@@ -87,6 +90,9 @@ class authRoute
             global $response;
             $this->requireRecaptcha();
             $data = json_decode(file_get_contents('php://input'), true);
+            if (!is_array($data)) {
+                $data = [];
+            }
             // Check if the employee number, and password are set
             if (!isset($data['user_id'])) {
                 $response->error('Employee number is required', 400);

services/nginx/app/routes/orderRoute.php

@@ -67,7 +67,10 @@ class orderRoute
             }
 
             // Parse request body
-            $data = json_decode(file_get_contents('php://input'), true) ?? [];
+            $data = json_decode(file_get_contents('php://input'), true);
+            if (!is_array($data)) {
+                $data = [];
+            }
             if (!isset($data['id']) || !(int)$data['id']) {
                 $response->error('Order id is required', 400);
             }

services/nginx/app/routes/ordersRoute.php

@@ -136,6 +136,9 @@ class ordersRoute
             if ($user) {
                 // Get the post data
                 $data = json_decode(file_get_contents('php://input'), true);
+                if (!is_array($data)) {
+                    $data = [];
+                }
                 // Check if the required fields are set
                 $data = $this->getData($data, $response);
                 // This is used to determine if the order is created from a handheld device,
@@ -857,6 +860,9 @@ class ordersRoute
         if ($user) {
             // Get the post data
             $data = json_decode(file_get_contents('php://input'), true);
+            if (!is_array($data)) {
+                $data = [];
+            }
             // Check if the required fields are set
             if (!isset($data['id'])) {
                 $response->error('ID is required', 400);

services/nginx/app/traits/db_object_t.php

@@ -1209,12 +1209,9 @@ trait db_object_t
             }
             $set = implode(', ', $set);
             $sql = "INSERT INTO $this->table SET $set";
-            //echo "SQL: $sql\n"; // Debugging line, can be removed in production
             $db->query($sql);
             return $db->insert_id();
         } catch (Exception $e) {
-            echo "Error adding object to $this->table: " . $e->getMessage() . "\n";
-            echo "SQL: $sql\n"; // Debugging line, can be removed in production
             throw new Exception($e->getMessage());
         }
     }

services/nginx/app/traits/module_config_t.php

@@ -56,7 +56,7 @@ trait module_config_t
                 $allowed_variables[] = (new $config_class())->getVariableName();
             }
             $allowed_variables = implode(', ', $allowed_variables);
-            echo "Variable not allowed to be updated. Allowed variables: $allowed_variables";
+            $response->error("Variable not allowed to be updated. Allowed variables: $allowed_variables", 400);
             return false;
         }
         // Update the config variable using the config class that contains the variable

services/nginx/app/traits/route_t.php

@@ -529,11 +529,9 @@ trait route_t
     public function fromRequest(string $name): ?string
     {
         // If the $_POST variable is set, return the value from the POST variable, otherwise return the value from the query string
-        if (isset($_POST)) {
-            $data = json_decode(file_get_contents('php://input'), true);
-            if (isset($data[$name])) {
-                return $data[$name];
-            }
+        $data = json_decode(file_get_contents('php://input'), true);
+        if (is_array($data) && isset($data[$name])) {
+            return $data[$name];
         }
         return (isset($_POST[$name])) ? $_POST[$name] : $this->fromQuery($name);
     }