[Bug]: Update_schedule_json: validate "sections" query param (must be JSON list of section IDs) #4268

Problem

update_schedule_json does json.loads(request.GET['sections']) and assumes the result is a list of section IDs.
But json.loads can return dict/int/string/etc., and later set-math assumes a list of ints.

Examples

• sections="{}" parses to dict => treated like empty set => can remove all sections (dangerous)
• sections="5" parses to int => set(5) TypeError => 500 crash
• sections='["abc", 12, 12]' includes junk + duplicates

The issue is currently in esp/esp/program/modules/handlers/onsiteclasslist.py -> update_schedule_json

Acceptance

• sections="{}" -> HTTP 400 + JSON error message
• sections="5" -> HTTP 400 + JSON error message
• valid list works normally end-to-end

Steps to Reproduce

1. We have a Program with onsite module enabled.
2. We have a valid student user ID (replace <USER_ID>).
3. The student is enrolled in at least one section (for the “schedule wipe” repro).
4. Replace and <PROGRAM_URL> with your environment.

Expected Behavior

Expected
Return HTTP 400 with JSON error if sections is not a JSON list.
Sanitise list: cast to int, drop invalid, dedupe, and enforce max length.

Actual Behavior

Right now the code does:

1. desired_sections = json.loads(request.GET['sections'])
2. Later, it does set(desired_sections) and assumes it’s a list of ints
3. But json.loads() can return a dict, int, string, etc. — and that can:
4. wipe schedules (e.g. {} becomes empty set)
5. 500 crash (e.g. "5" becomes int → set(5) crashes)

This is visible in the current code inside update_schedule_json

Screenshots

No response

Operating System

MAC OS

Browser

Chrome latest

Additional Context

No response