From 9bbecc22023a707a5997dd118629b807cd25372e Mon Sep 17 00:00:00 2001
From: Saagar Arya <saagar.arya@mcin.ca>
Date: Wed, 9 Jul 2025 15:37:25 -0400
Subject: [PATCH 1/7] [dataquery] Remove instruments and visits that the user
 doesnt have access to

---
 .../behavioural_qc/php/behavioural.class.inc  |  2 +-
 .../php/candidate_list.class.inc              | 55 +------------------
 modules/candidate_list/php/options.class.inc  |  4 +-
 modules/dataquery/php/visitlist.class.inc     |  6 +-
 modules/dictionary/php/module.class.inc       | 18 ++++++
 php/libraries/User.class.inc                  | 27 +++++++++
 6 files changed, 54 insertions(+), 58 deletions(-)

diff --git a/modules/behavioural_qc/php/behavioural.class.inc b/modules/behavioural_qc/php/behavioural.class.inc
index 677ae3b9bf2..fa95d993201 100644
--- a/modules/behavioural_qc/php/behavioural.class.inc
+++ b/modules/behavioural_qc/php/behavioural.class.inc
@@ -93,7 +93,7 @@ class Behavioural extends \NDB_Page implements ETagCalculator
         ServerRequestInterface $request
     ) : array {
         $user         = $request->getAttribute('user');
-        $visit_array  = \Utility::getVisitList();
+        $visit_array  = $user->getVisits();
         $userProjects = $user->getProjects();
         $projects     = [];
         foreach ($userProjects as $project) {
diff --git a/modules/candidate_list/php/candidate_list.class.inc b/modules/candidate_list/php/candidate_list.class.inc
index 9a8ab2a9082..3cd93ec4514 100644
--- a/modules/candidate_list/php/candidate_list.class.inc
+++ b/modules/candidate_list/php/candidate_list.class.inc
@@ -70,58 +70,9 @@ class Candidate_List extends \DataFrameworkMenu
      */
     function getFieldOptions() : array
     {
-        $this->loris->getModule('candidate_parameters')->registerAutoloader();
-
-        // create user object
-        $factory = \NDB_Factory::singleton();
-        $user    = $factory->user();
-        $config  = $factory->config();
-
-        // get the list of visit labels
-        $visit_label_options = \Utility::getVisitList();
-
-        // get the list of sites available for the user
-        if ($user->hasPermission('access_all_profiles')) {
-            $list_of_sites = \Utility::getSiteList();
-        } else {
-            $list_of_sites = $user->getStudySites();
-        }
-        $site_options = [];
-        foreach (array_values($list_of_sites) as $name) {
-            $site_options[$name] = $name;
-        }
-
-        // get the list of projects
-        $list_of_projects = \Utility::getProjectList();
-        $project_options  = [];
-        foreach (array_values($list_of_projects) as $name) {
-            $project_options[$name] = $name;
-        }
-
-        // get the list of cohorts
-        $list_of_cohorts = \Utility::getCohortList();
-        $cohort_options  = [];
-        foreach (array_values($list_of_cohorts) as $name) {
-            $cohort_options[$name] = $name;
-        }
-
-        // get the list participant status options
-        $list_of_participant_status
-            = \Candidate::getParticipantStatusOptions();
-        $participant_status_options = [];
-        foreach (array_values($list_of_participant_status) as $name) {
-            $participant_status_options[$name] = $name;
-        }
-
-        return [
-            'visitlabel'        => $visit_label_options,
-            'site'              => $site_options,
-            'project'           => $project_options,
-            'cohort'            => $cohort_options,
-            'participantstatus' => $participant_status_options,
-            'useedc'            => $config->getSetting("useEDC"),
-            'Sex'               => \Utility::getSexList(),
-        ];
+        // Not sure what to do about this because I can't delete the function,
+        // but it is not even being used
+        return [];
     }
 
     /**
diff --git a/modules/candidate_list/php/options.class.inc b/modules/candidate_list/php/options.class.inc
index 78d43d4932d..4263dfd6b28 100644
--- a/modules/candidate_list/php/options.class.inc
+++ b/modules/candidate_list/php/options.class.inc
@@ -47,8 +47,8 @@ class Options extends \LORIS\Http\Endpoint
         $user    = $factory->user();
         $config  = $factory->config();
 
-        // get the list of visit labels
-        $visit_label_options = \Utility::getVisitList();
+        // get the list of visit labels that the user has access to
+        $visit_label_options = $user->getVisits();
 
         // get the list of sites available for the user
         if ($user->hasPermission('access_all_profiles')) {
diff --git a/modules/dataquery/php/visitlist.class.inc b/modules/dataquery/php/visitlist.class.inc
index 4074e315c93..cc132e74844 100644
--- a/modules/dataquery/php/visitlist.class.inc
+++ b/modules/dataquery/php/visitlist.class.inc
@@ -16,6 +16,7 @@ class VisitList extends \NDB_Page
     protected $itemmodule;
     protected $itemcategory;
     protected $dictionaryitem;
+    protected $user;
 
     /**
      * {@inheritDoc}
@@ -28,9 +29,7 @@ class VisitList extends \NDB_Page
     {
         if ($this->dictionaryitem === null) {
             return new \LORIS\Http\Response\JSON\OK(
-                [
-                    'Visits' => array_values(\Utility::getVisitList()),
-                ],
+                ['Visits' => array_values($this->user->getVisits())],
             );
         }
 
@@ -62,6 +61,7 @@ class VisitList extends \NDB_Page
         \User $user,
         ServerRequestInterface $request,
     ) : void {
+        $this->user = $user;
         $queryparams = $request->getQueryParams();
         if (!isset($queryparams['module']) || !isset($queryparams['item'])) {
             return;
diff --git a/modules/dictionary/php/module.class.inc b/modules/dictionary/php/module.class.inc
index f2c26a2c085..09c96d347f8 100644
--- a/modules/dictionary/php/module.class.inc
+++ b/modules/dictionary/php/module.class.inc
@@ -88,6 +88,18 @@ class Module extends \Module
         $categories  = [];
 
         $categoryitems = [];
+
+        // Get the instruments that the user has access to based on their Projects
+        $userVisits = $user->getVisits();
+        $instruments = [];
+        foreach ($userVisits as $visitLabel => $_) {
+            $visitInstruments = \Utility::getVisitInstruments($visitLabel);
+            foreach ($visitInstruments as $testName => $fullName) {
+                if (!isset($instruments[$testName])) {
+                    $instruments[$testName] = $fullName;
+                }
+            }
+        }
         foreach ($modules as $module) {
             if ($formodule !== null && $module->getName() !== $formodule) {
                 continue;
@@ -104,6 +116,12 @@ class Module extends \Module
                 $categories[$mname] = [];
 
                 foreach ($mdict as $cat) {
+                    if (
+                        $mname === 'instruments' &&
+                        !isset($instruments[$cat->getName()])
+                    ) {
+                        continue;
+                    }
                     $categories[$mname][$cat->getName()] = $cat->getDescription();
                     $categoryitems[] = [
                         'Module'   => $module,
diff --git a/php/libraries/User.class.inc b/php/libraries/User.class.inc
index 2d079c4528e..82003f83e95 100644
--- a/php/libraries/User.class.inc
+++ b/php/libraries/User.class.inc
@@ -341,6 +341,33 @@ class User extends UserPermissions implements
         return explode(';', $projects);
     }
 
+    /*
+    * Get the visits the User has access to
+    * through their projects and their cohorts.
+    *
+    * @return array of study visits in the format array('VL' => 'VL')
+    *         where VL is the visit label
+    */
+    public function getVisits(): array {
+        $visit_labels = [];
+        $list_of_projects = $this->getProjectIDs();
+        foreach ($list_of_projects as $projectID) {
+            $cohorts = \Utility::getCohortList($projectID);
+            foreach ($cohorts as $cohortID => $cohortTitle) {
+                $visits  = \Utility::getVisitsForProjectCohort(
+                    $projectID,
+                    $cohortID
+                );
+                foreach ($visits as $_ => $visitLabel) {
+                    if (!in_array($visitLabel, $visit_labels)) {
+                        $visit_labels[$visitLabel] = $visitLabel;
+                    }
+                }
+            }
+        }
+        return $visit_labels;
+    }
+
     /**
      * Get the user's sites' ID numbers
      *

From 799b9dc8c0651d06f7e0a972fe4cd58b5727fdb7 Mon Sep 17 00:00:00 2001
From: Saagar Arya <saagar.arya@mcin.ca>
Date: Wed, 9 Jul 2025 15:46:56 -0400
Subject: [PATCH 2/7] Cleanup

---
 modules/candidate_list/php/candidate_list.class.inc | 3 +--
 modules/dataquery/php/visitlist.class.inc           | 2 +-
 modules/dictionary/php/module.class.inc             | 7 +++----
 php/libraries/User.class.inc                        | 9 +++++----
 raisinbread/RB_files/RB_test_names.sql              | 2 +-
 5 files changed, 11 insertions(+), 12 deletions(-)

diff --git a/modules/candidate_list/php/candidate_list.class.inc b/modules/candidate_list/php/candidate_list.class.inc
index 3cd93ec4514..584bffc4783 100644
--- a/modules/candidate_list/php/candidate_list.class.inc
+++ b/modules/candidate_list/php/candidate_list.class.inc
@@ -70,8 +70,7 @@ class Candidate_List extends \DataFrameworkMenu
      */
     function getFieldOptions() : array
     {
-        // Not sure what to do about this because I can't delete the function,
-        // but it is not even being used
+        // To modify the field options, you must edit getFieldOptions in options.class.inc
         return [];
     }
 
diff --git a/modules/dataquery/php/visitlist.class.inc b/modules/dataquery/php/visitlist.class.inc
index cc132e74844..e6e31ce1ba9 100644
--- a/modules/dataquery/php/visitlist.class.inc
+++ b/modules/dataquery/php/visitlist.class.inc
@@ -61,7 +61,7 @@ class VisitList extends \NDB_Page
         \User $user,
         ServerRequestInterface $request,
     ) : void {
-        $this->user = $user;
+        $this->user  = $user;
         $queryparams = $request->getQueryParams();
         if (!isset($queryparams['module']) || !isset($queryparams['item'])) {
             return;
diff --git a/modules/dictionary/php/module.class.inc b/modules/dictionary/php/module.class.inc
index 09c96d347f8..e22f5647abe 100644
--- a/modules/dictionary/php/module.class.inc
+++ b/modules/dictionary/php/module.class.inc
@@ -90,7 +90,7 @@ class Module extends \Module
         $categoryitems = [];
 
         // Get the instruments that the user has access to based on their Projects
-        $userVisits = $user->getVisits();
+        $userVisits  = $user->getVisits();
         $instruments = [];
         foreach ($userVisits as $visitLabel => $_) {
             $visitInstruments = \Utility::getVisitInstruments($visitLabel);
@@ -116,9 +116,8 @@ class Module extends \Module
                 $categories[$mname] = [];
 
                 foreach ($mdict as $cat) {
-                    if (
-                        $mname === 'instruments' &&
-                        !isset($instruments[$cat->getName()])
+                    if ($mname === 'instruments'
+                        && !isset($instruments[$cat->getName()])
                     ) {
                         continue;
                     }
diff --git a/php/libraries/User.class.inc b/php/libraries/User.class.inc
index 82003f83e95..dd36c571a3b 100644
--- a/php/libraries/User.class.inc
+++ b/php/libraries/User.class.inc
@@ -341,20 +341,21 @@ class User extends UserPermissions implements
         return explode(';', $projects);
     }
 
-    /*
+    /**
     * Get the visits the User has access to
     * through their projects and their cohorts.
     *
     * @return array of study visits in the format array('VL' => 'VL')
     *         where VL is the visit label
     */
-    public function getVisits(): array {
-        $visit_labels = [];
+    public function getVisits(): array
+    {
+        $visit_labels     = [];
         $list_of_projects = $this->getProjectIDs();
         foreach ($list_of_projects as $projectID) {
             $cohorts = \Utility::getCohortList($projectID);
             foreach ($cohorts as $cohortID => $cohortTitle) {
-                $visits  = \Utility::getVisitsForProjectCohort(
+                $visits = \Utility::getVisitsForProjectCohort(
                     $projectID,
                     $cohortID
                 );
diff --git a/raisinbread/RB_files/RB_test_names.sql b/raisinbread/RB_files/RB_test_names.sql
index 12baad35c79..6856ca2e572 100644
--- a/raisinbread/RB_files/RB_test_names.sql
+++ b/raisinbread/RB_files/RB_test_names.sql
@@ -5,6 +5,6 @@ INSERT INTO `test_names` (`ID`, `Test_name`, `Full_name`, `Sub_group`, `IsDirect
 INSERT INTO `test_names` (`ID`, `Test_name`, `Full_name`, `Sub_group`, `IsDirectEntry`) VALUES (2,'bmi','BMI Calculator',1,1);
 INSERT INTO `test_names` (`ID`, `Test_name`, `Full_name`, `Sub_group`, `IsDirectEntry`) VALUES (3,'medical_history','Medical History',1,1);
 INSERT INTO `test_names` (`ID`, `Test_name`, `Full_name`, `Sub_group`, `IsDirectEntry`) VALUES (4,'mri_parameter_form','MRI Parameter Form',2,NULL);
-INSERT INTO `test_names` (`ID`, `Test_name`, `Full_name`, `Sub_group`, `IsDirectEntry`) VALUES (6,'aosi','AOSI',1,NULL);
+INSERT INTO `test_names` (`ID`, `Test_name`, `Full_name`, `Sub_group`, `IsDirectEntry`) VALUES (5,'aosi','AOSI',1,NULL);
 UNLOCK TABLES;
 SET FOREIGN_KEY_CHECKS=1;

From 99879f1f9068cfa550f8264850c64f5f75d9995c Mon Sep 17 00:00:00 2001
From: Saagar Arya <saagar.arya@mcin.ca>
Date: Wed, 9 Jul 2025 15:51:20 -0400
Subject: [PATCH 3/7] Fix static tests

---
 modules/candidate_list/php/candidate_list.class.inc |  3 ++-
 php/libraries/User.class.inc                        | 12 ++++++------
 2 files changed, 8 insertions(+), 7 deletions(-)

diff --git a/modules/candidate_list/php/candidate_list.class.inc b/modules/candidate_list/php/candidate_list.class.inc
index 584bffc4783..fd3c8164bbb 100644
--- a/modules/candidate_list/php/candidate_list.class.inc
+++ b/modules/candidate_list/php/candidate_list.class.inc
@@ -70,7 +70,8 @@ class Candidate_List extends \DataFrameworkMenu
      */
     function getFieldOptions() : array
     {
-        // To modify the field options, you must edit getFieldOptions in options.class.inc
+        // To modify the field options,
+        // you must edit getFieldOptions in options.class.inc
         return [];
     }
 
diff --git a/php/libraries/User.class.inc b/php/libraries/User.class.inc
index dd36c571a3b..77615c5ccef 100644
--- a/php/libraries/User.class.inc
+++ b/php/libraries/User.class.inc
@@ -342,12 +342,12 @@ class User extends UserPermissions implements
     }
 
     /**
-    * Get the visits the User has access to
-    * through their projects and their cohorts.
-    *
-    * @return array of study visits in the format array('VL' => 'VL')
-    *         where VL is the visit label
-    */
+     * Get the visits the User has access to
+     * through their projects and their cohorts.
+     *
+     * @return array of study visits in the format array('VL' => 'VL')
+     *         where VL is the visit label
+     */
     public function getVisits(): array
     {
         $visit_labels     = [];

From 4c2aa62c7ab4e27b55f0ff78fa2ebabe25ffeb80 Mon Sep 17 00:00:00 2001
From: Saagar Arya <saagar.arya@mcin.ca>
Date: Tue, 12 Aug 2025 16:22:02 -0400
Subject: [PATCH 4/7] Change to VisitController

---
 php/libraries/User.class.inc | 27 ++++++++++++++-------------
 1 file changed, 14 insertions(+), 13 deletions(-)

diff --git a/php/libraries/User.class.inc b/php/libraries/User.class.inc
index 77615c5ccef..4cffc677a27 100644
--- a/php/libraries/User.class.inc
+++ b/php/libraries/User.class.inc
@@ -350,22 +350,23 @@ class User extends UserPermissions implements
      */
     public function getVisits(): array
     {
-        $visit_labels     = [];
-        $list_of_projects = $this->getProjectIDs();
-        foreach ($list_of_projects as $projectID) {
-            $cohorts = \Utility::getCohortList($projectID);
-            foreach ($cohorts as $cohortID => $cohortTitle) {
-                $visits = \Utility::getVisitsForProjectCohort(
-                    $projectID,
-                    $cohortID
-                );
-                foreach ($visits as $_ => $visitLabel) {
-                    if (!in_array($visitLabel, $visit_labels)) {
-                        $visit_labels[$visitLabel] = $visitLabel;
-                    }
+        $visit_labels = [];
+        $userProjectIDs = $this->getProjectIDs();
+        
+        // Get VisitController instance
+        $visitController = new \LORIS\VisitController();
+        $allVisitsProjectCohort = $visitController->getVisitsProjectCohort();
+        
+        foreach ($allVisitsProjectCohort as [$visit, $projectID, $cohortID]) {
+            // Check if user has access to this project
+            if (in_array(\ProjectID::singleton($projectID), $userProjectIDs)) {
+                $visitLabel = $visit->getName();
+                if (!in_array($visitLabel, $visit_labels)) {
+                    $visit_labels[$visitLabel] = $visitLabel;
                 }
             }
         }
+        
         return $visit_labels;
     }
 

From 0ee20d04cce46906ff2e72198603b8c341e24414 Mon Sep 17 00:00:00 2001
From: Saagar Arya <saagar.arya@mcin.ca>
Date: Wed, 13 Aug 2025 11:00:48 -0400
Subject: [PATCH 5/7] Fix more modules

---
 modules/candidate_list/php/options.class.inc               | 3 ++-
 .../php/candidatequeryengine.class.inc                     | 3 ++-
 modules/dictionary/php/dictionary.class.inc                | 2 +-
 .../php/electrophysiology_uploader.class.inc               | 2 +-
 modules/imaging_browser/php/queryengine.class.inc          | 6 ++++--
 modules/imaging_uploader/php/imaging_uploader.class.inc    | 3 ++-
 modules/instruments/php/instrumentqueryengine.class.inc    | 3 +++
 modules/statistics/jsx/widgets/projects.js                 | 0
 modules/statistics/php/stats_behavioural.class.inc         | 2 +-
 modules/statistics/php/stats_demographic.class.inc         | 3 ++-
 php/libraries/User.class.inc                               | 7 +++++--
 php/libraries/VisitController.class.inc                    | 6 +++---
 12 files changed, 26 insertions(+), 14 deletions(-)
 create mode 100644 modules/statistics/jsx/widgets/projects.js

diff --git a/modules/candidate_list/php/options.class.inc b/modules/candidate_list/php/options.class.inc
index 4263dfd6b28..3093ab34b8d 100644
--- a/modules/candidate_list/php/options.class.inc
+++ b/modules/candidate_list/php/options.class.inc
@@ -62,7 +62,8 @@ class Options extends \LORIS\Http\Endpoint
         }
 
         // get the list of projects
-        $list_of_projects = \Utility::getProjectList();
+        // $list_of_projects = \Utility::getProjectList();
+        $list_of_projects = $user->getProjectNames();
         $project_options  = [];
         foreach (array_values($list_of_projects) as $name) {
             $project_options[$name] = $name;
diff --git a/modules/candidate_parameters/php/candidatequeryengine.class.inc b/modules/candidate_parameters/php/candidatequeryengine.class.inc
index 45da580d757..368810b6122 100644
--- a/modules/candidate_parameters/php/candidatequeryengine.class.inc
+++ b/modules/candidate_parameters/php/candidatequeryengine.class.inc
@@ -249,9 +249,10 @@ class CandidateQueryEngine extends \LORIS\Data\Query\SQLQueryEngine
         if ($item->getScope()->__toString() !== 'session') {
             return [];
         }
+        $user = \NDB_Factory::singleton()->user();
 
         // Session scoped variables: VisitLabel, project, site, cohort
-        return array_keys(\Utility::getVisitList());
+        return array_keys($user->getVisits());
     }
 
     /**
diff --git a/modules/dictionary/php/dictionary.class.inc b/modules/dictionary/php/dictionary.class.inc
index 209705c6b2b..67da9dfa8b1 100644
--- a/modules/dictionary/php/dictionary.class.inc
+++ b/modules/dictionary/php/dictionary.class.inc
@@ -63,7 +63,7 @@ class Dictionary extends \DataFrameworkMenu
             $cohort_options[$name] = $name;
         }
         $visit_options = [];
-        foreach (\Utility::getVisitList() as $visit) {
+        foreach ($user->getVisits() as $visit) {
             $visit_options[$visit] = $visit;
         }
         return [
diff --git a/modules/electrophysiology_uploader/php/electrophysiology_uploader.class.inc b/modules/electrophysiology_uploader/php/electrophysiology_uploader.class.inc
index 611be85653b..955ad85c78f 100644
--- a/modules/electrophysiology_uploader/php/electrophysiology_uploader.class.inc
+++ b/modules/electrophysiology_uploader/php/electrophysiology_uploader.class.inc
@@ -78,7 +78,7 @@ class Electrophysiology_Uploader extends \DataFrameworkMenu
 
         return [
             'sites'      => $site_options,
-            'visitLabel' => \Utility::getVisitList(),
+            'visitLabel' => $user->getVisits(),
         ];
     }
 
diff --git a/modules/imaging_browser/php/queryengine.class.inc b/modules/imaging_browser/php/queryengine.class.inc
index 4e037f1e9c9..f190a1ecee7 100644
--- a/modules/imaging_browser/php/queryengine.class.inc
+++ b/modules/imaging_browser/php/queryengine.class.inc
@@ -356,9 +356,11 @@ class QueryEngine extends \LORIS\Data\Query\SQLQueryEngine
             return $visits;
         }
 
-        // Fall back on all visits if something ends up getting
+        $user = \NDB_Factory::singleton()->user();
+
+        // Fall back on user visits if something ends up getting
         // added that we can't derive the modality of.
-        return array_keys(\Utility::getVisitList());
+        return array_keys($user->getVisits());
     }
 
     /**
diff --git a/modules/imaging_uploader/php/imaging_uploader.class.inc b/modules/imaging_uploader/php/imaging_uploader.class.inc
index 2442d019f82..64088c60c7c 100644
--- a/modules/imaging_uploader/php/imaging_uploader.class.inc
+++ b/modules/imaging_uploader/php/imaging_uploader.class.inc
@@ -158,7 +158,8 @@ class Imaging_Uploader extends \NDB_Menu_Filter_Form
             'N' => 'No',
             'Y' => 'Yes',
         ];
-        $visitlabels   = \Utility::getVisitList();
+        $user = \NDB_Factory::singleton()->user();
+        $visitlabels   = $user->getVisits();
         // Fields used for selection filter and upload form
         $this->addSelect('IsPhantom', 'Phantom Scans', $phantomOtions);
         $this->addBasicText('candID', 'CandID');
diff --git a/modules/instruments/php/instrumentqueryengine.class.inc b/modules/instruments/php/instrumentqueryengine.class.inc
index 0d79f866757..53a87ed480d 100644
--- a/modules/instruments/php/instrumentqueryengine.class.inc
+++ b/modules/instruments/php/instrumentqueryengine.class.inc
@@ -183,6 +183,8 @@ class InstrumentQueryEngine implements \LORIS\Data\Query\QueryEngine
         if (isset($this->visitcache[$inst->getName()])) {
             return $this->visitcache[$inst->getName()];
         }
+        $user        = \NDB_Factory::singleton()->user();
+        $user_visits = "('" . join("','", $user->getVisits()) . "')";
 
         $DB     = \NDB_Factory::singleton()->database();
         $visits = $DB->pselectCol(
@@ -192,6 +194,7 @@ class InstrumentQueryEngine implements \LORIS\Data\Query\QueryEngine
                    JOIN session s ON (f.SessionID=s.ID)
                    JOIN candidate c ON (c.ID=s.CandidateID)
                 WHERE s.Active='Y' AND c.Active='Y' and tn.Test_name=:tn
+                AND s.Visit_Label IN $user_visits
             ORDER BY s.Visit_label",
             ['tn' => $inst->getName()]
         );
diff --git a/modules/statistics/jsx/widgets/projects.js b/modules/statistics/jsx/widgets/projects.js
new file mode 100644
index 00000000000..e69de29bb2d
diff --git a/modules/statistics/php/stats_behavioural.class.inc b/modules/statistics/php/stats_behavioural.class.inc
index efed6c971c5..38eb6383bf0 100644
--- a/modules/statistics/php/stats_behavioural.class.inc
+++ b/modules/statistics/php/stats_behavioural.class.inc
@@ -166,7 +166,7 @@ class Stats_Behavioural extends \NDB_Form
             }
             $Visits = \Utility::getVisitList($currentProject);
         } else {
-            $Visits = \Utility::getVisitList();
+            $Visits = $user->getVisits();
         }
 
         $this->tpl_data['Visits'] = $Visits ?? '';
diff --git a/modules/statistics/php/stats_demographic.class.inc b/modules/statistics/php/stats_demographic.class.inc
index 958fd3703c7..6970ac6f9c8 100644
--- a/modules/statistics/php/stats_demographic.class.inc
+++ b/modules/statistics/php/stats_demographic.class.inc
@@ -212,7 +212,8 @@ class Stats_Demographic extends \NDB_Form
     function setup()
     {
         parent::setup();
-        $visits = \Utility::getVisitList();
+        $user = \NDB_Factory::singleton()->user();
+        $visits = $user->getVisits();
         $db     = $this->loris->getDatabaseConnection();
         //This boolean is for optional use by project if the demographics table
         // queries any information from the mri_parameter_form table
diff --git a/php/libraries/User.class.inc b/php/libraries/User.class.inc
index 4cffc677a27..9595c437e50 100644
--- a/php/libraries/User.class.inc
+++ b/php/libraries/User.class.inc
@@ -328,7 +328,7 @@ class User extends UserPermissions implements
     }
 
     /**
-     * Get the user's sites' ID numbers
+     * Get the names of projects accessible to the user
      *
      * @return array
      */
@@ -352,9 +352,12 @@ class User extends UserPermissions implements
     {
         $visit_labels = [];
         $userProjectIDs = $this->getProjectIDs();
+
+        $factory = \NDB_Factory::singleton();
+        $DB      = $factory->database();
         
         // Get VisitController instance
-        $visitController = new \LORIS\VisitController();
+        $visitController = new \LORIS\VisitController($DB);
         $allVisitsProjectCohort = $visitController->getVisitsProjectCohort();
         
         foreach ($allVisitsProjectCohort as [$visit, $projectID, $cohortID]) {
diff --git a/php/libraries/VisitController.class.inc b/php/libraries/VisitController.class.inc
index c3abb371105..8bf4c29533a 100644
--- a/php/libraries/VisitController.class.inc
+++ b/php/libraries/VisitController.class.inc
@@ -155,7 +155,7 @@ class VisitController
         return array_map(
             function ($row) {
                 return [
-                    new \LORIS\Visit($row['name'], $row['ID']),
+                    new \LORIS\Visit($row['name'], $row['label']),
                     $row['project'],    // will be modified to object when
                     $row['cohort'], // available
                 ];
@@ -163,7 +163,7 @@ class VisitController
             iterator_to_array(
                 $this->database->pselect(
                     'SELECT
-                  v.VisitID as "ID",
+                  v.VisitLabel as "label",
                   v.VisitName as "name",
                   psr.ProjectID as "project",
                   psr.CohortID as "cohort"
@@ -175,7 +175,7 @@ class VisitController
                  JOIN
                   project_cohort_rel psr
                  ON vps.ProjectCohortRelID = psr.ProjectCohortRelID
-                ORDER BY ID, project, cohort
+                ORDER BY label, project, cohort
                 ',
                     []
                 )

From 269fdb807112ffc14a78484e48576dc69dc25190 Mon Sep 17 00:00:00 2001
From: Saagar Arya <saagar.arya@mcin.ca>
Date: Wed, 13 Aug 2025 11:05:03 -0400
Subject: [PATCH 6/7] fix for sniffer

---
 .../imaging_uploader/php/imaging_uploader.class.inc    |  2 +-
 modules/statistics/php/stats_demographic.class.inc     |  2 +-
 php/libraries/User.class.inc                           | 10 +++++-----
 3 files changed, 7 insertions(+), 7 deletions(-)

diff --git a/modules/imaging_uploader/php/imaging_uploader.class.inc b/modules/imaging_uploader/php/imaging_uploader.class.inc
index 64088c60c7c..fa2b8a56b94 100644
--- a/modules/imaging_uploader/php/imaging_uploader.class.inc
+++ b/modules/imaging_uploader/php/imaging_uploader.class.inc
@@ -158,7 +158,7 @@ class Imaging_Uploader extends \NDB_Menu_Filter_Form
             'N' => 'No',
             'Y' => 'Yes',
         ];
-        $user = \NDB_Factory::singleton()->user();
+        $user          = \NDB_Factory::singleton()->user();
         $visitlabels   = $user->getVisits();
         // Fields used for selection filter and upload form
         $this->addSelect('IsPhantom', 'Phantom Scans', $phantomOtions);
diff --git a/modules/statistics/php/stats_demographic.class.inc b/modules/statistics/php/stats_demographic.class.inc
index 6970ac6f9c8..549681f79f2 100644
--- a/modules/statistics/php/stats_demographic.class.inc
+++ b/modules/statistics/php/stats_demographic.class.inc
@@ -212,7 +212,7 @@ class Stats_Demographic extends \NDB_Form
     function setup()
     {
         parent::setup();
-        $user = \NDB_Factory::singleton()->user();
+        $user   = \NDB_Factory::singleton()->user();
         $visits = $user->getVisits();
         $db     = $this->loris->getDatabaseConnection();
         //This boolean is for optional use by project if the demographics table
diff --git a/php/libraries/User.class.inc b/php/libraries/User.class.inc
index 9595c437e50..7c3ade30265 100644
--- a/php/libraries/User.class.inc
+++ b/php/libraries/User.class.inc
@@ -350,16 +350,16 @@ class User extends UserPermissions implements
      */
     public function getVisits(): array
     {
-        $visit_labels = [];
+        $visit_labels   = [];
         $userProjectIDs = $this->getProjectIDs();
 
         $factory = \NDB_Factory::singleton();
         $DB      = $factory->database();
-        
+
         // Get VisitController instance
-        $visitController = new \LORIS\VisitController($DB);
+        $visitController        = new \LORIS\VisitController($DB);
         $allVisitsProjectCohort = $visitController->getVisitsProjectCohort();
-        
+
         foreach ($allVisitsProjectCohort as [$visit, $projectID, $cohortID]) {
             // Check if user has access to this project
             if (in_array(\ProjectID::singleton($projectID), $userProjectIDs)) {
@@ -369,7 +369,7 @@ class User extends UserPermissions implements
                 }
             }
         }
-        
+
         return $visit_labels;
     }
 

From 6e90d81db36b37679f68126d8e71b5ec1d2b5344 Mon Sep 17 00:00:00 2001
From: Saagar Arya <saagar.arya@mcin.ca>
Date: Wed, 13 Aug 2025 11:09:04 -0400
Subject: [PATCH 7/7] Fix for phan

---
 php/libraries/User.class.inc | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/php/libraries/User.class.inc b/php/libraries/User.class.inc
index 7c3ade30265..e29e01289a9 100644
--- a/php/libraries/User.class.inc
+++ b/php/libraries/User.class.inc
@@ -360,7 +360,7 @@ class User extends UserPermissions implements
         $visitController        = new \LORIS\VisitController($DB);
         $allVisitsProjectCohort = $visitController->getVisitsProjectCohort();
 
-        foreach ($allVisitsProjectCohort as [$visit, $projectID, $cohortID]) {
+        foreach ($allVisitsProjectCohort as [$visit, $projectID]) {
             // Check if user has access to this project
             if (in_array(\ProjectID::singleton($projectID), $userProjectIDs)) {
                 $visitLabel = $visit->getName();