interface/reports/audit_log_tamper_report.php

   1 <?php
   2 /**
   3  * Audit Log Tamper Report.
   4  *
   5  * @package OpenEMR
   6  * @link    http://www.open-emr.org
   7  * @author  Anil N <aniln@ensoftek.com>
   8  * @author  Brady Miller <brady.g.miller@gmail.com>
   9  * @copyright Copyright (c) 2014 Ensoftek
  10  * @copyright Copyright (c) 2017 Brady Miller <brady.g.miller@gmail.com>
  11  * @license https://github.com/openemr/openemr/blob/master/LICENSE GNU General Public License 3
  12  */
  13
  14
  15 include_once("../globals.php");
  16 include_once("$srcdir/log.inc");
  17 ?>
  18 <html>
  19 <head>
  20
  21 <title><?php echo xlt("Audit Log Tamper Report"); ?></title>
  22
  23 <?php html_header_show();?>
  24
  25 <link rel="stylesheet" href="<?php echo $css_header;?>" type="text/css">
  26 <link rel="stylesheet" href="<?php echo $GLOBALS['assets_static_relative']; ?>/jquery-datetimepicker-2-5-4/build/jquery.datetimepicker.min.css">
  27
  28 <script type="text/javascript" src="<?php echo $GLOBALS['assets_static_relative']; ?>/jquery-min-3-1-1/index.js"></script>
  29 <script type="text/javascript" src="<?php echo $GLOBALS['webroot'] ?>/library/dialog.js?v=<?php echo $v_js_includes; ?>"></script>
  30 <script type="text/javascript" src="<?php echo $GLOBALS['assets_static_relative']; ?>/jquery-datetimepicker-2-5-4/build/jquery.datetimepicker.full.min.js"></script>
  31
  32 <style>
  33 #logview {
  34     width: 100%;
  35 }
  36 #logview table {
  37     width:100%;
  38     border-collapse: collapse;
  39 }
  40 #logview th {
  41     background-color: #cccccc;
  42     cursor: pointer; cursor: hand;
  43     padding: 5px 5px;
  44     align: left;
  45     text-align: left;
  46 }
  47
  48 #logview td {
  49     background-color: #ffffff;
  50     border-bottom: 1px solid #808080;
  51     cursor: default;
  52     padding: 5px 5px;
  53     vertical-align: top;
  54 }
  55 .highlight {
  56     background-color: #336699;
  57     color: #336699;
  58 }
  59 .tamperColor{
  60     color:red;
  61 }
  62 </style>
  63 <script>
  64 //function to disable the event type field if the event name is disclosure
  65 function eventTypeChange(eventname)
  66 {
  67          if (eventname == "disclosure") {
  68             document.theform.type_event.disabled = true;
  69           }
  70          else {
  71             document.theform.type_event.disabled = false;
  72          }
  73 }
  74
  75 // VicarePlus :: This invokes the find-patient popup.
  76  function sel_patient() {
  77   dlgopen('../main/calendar/find_patient_popup.php?pflag=0', '_blank', 500, 400);
  78  }
  79
  80 // VicarePlus :: This is for callback by the find-patient popup.
  81  function setpatient(pid, lname, fname, dob) {
  82   var f = document.theform;
  83   f.form_patient.value = lname + ', ' + fname;
  84   f.form_pid.value = pid;
  85  }
  86
  87 </script>
  88 </head>
  89 <body class="body_top">
  90 <font class="title"><?php echo xlt('Audit Log Tamper Report'); ?></font>
  91 <br>
  92 <?php
  93 $err_message=0;
  94 if ($_GET["start_date"]) {
  95     $start_date = $_GET['start_date'];
  96 }
  97
  98 if ($_GET["end_date"]) {
  99     $end_date = $_GET['end_date'];
 100 }
 101
 102 if ($_GET["form_patient"]) {
 103     $form_patient = $_GET['form_patient'];
 104 }
 105
 106 /*
 107  * Start date should not be greater than end date - Date Validation
 108  */
 109 if ($start_date && $end_date) {
 110     if ($start_date > $end_date) {
 111         echo "<table><tr class='alert'><td colspan=7>";
 112         echo xlt('Start Date should not be greater than End Date');
 113         echo "</td></tr></table>";
 114         $err_message=1;
 115     }
 116 }
 117
 118 ?>
 119 <?php
 120 $form_user = $_REQUEST['form_user'];
 121 $form_pid = $_REQUEST['form_pid'];
 122 if ($form_patient == '') {
 123     $form_pid = '';
 124 }
 125
 126 $get_sdate=$start_date ? $start_date : date("Y-m-d H:i:s");
 127 $get_edate=$end_date ? $end_date : date("Y-m-d H:i:s");
 128
 129 ?>
 130 <br>
 131 <FORM METHOD="GET" name="theform" id="theform" onSubmit='top.restoreSession()'>
 132 <?php
 133
 134 $sortby = $_GET['sortby'];
 135 ?>
 136 <input type="hidden" name="sortby" id="sortby" value="<?php echo attr($sortby); ?>">
 137 <input type=hidden name=csum value="">
 138 <table>
 139 <tr><td>
 140 <span class="text"><?php echo xlt('Start Date'); ?>: </span>
 141 </td><td>
 142 <input type="text" size="18" class="datetimepicker" name="start_date" id="start_date" value="<?php echo $start_date ? $start_date : date('Y-m-d H:i:s'); ?>" title="<?php echo xla('yyyy-mm-dd H:m Start date'); ?>" />
 143 </td>
 144 <td>
 145 <span class="text"><?php echo xlt('End Date'); ?>: </span>
 146 </td><td>
 147 <input type="text" size="18" class="datetimepicker" name="end_date" id="end_date" value="<?php echo $end_date ? $end_date : date('Y-m-d H:i:s'); ?>" title="<?php echo xla('yyyy-mm-dd H:m End date'); ?>" />
 148 </td>
 149
 150 <td>
 151 &nbsp;&nbsp;<span class='text'><?php echo xlt('Patient'); ?>: </span>
 152 </td>
 153 <td>
 154 <input type='text' size='20' name='form_patient' style='width:100%;cursor:pointer;cursor:hand' value='<?php echo attr($form_patient) ? attr($form_patient) : xla('Click To Select'); ?>' onclick='sel_patient()' title='<?php echo xlt('Click to select patient'); ?>' />
 155 <input type='hidden' name='form_pid' value='<?php echo attr($form_pid); ?>' />
 156 </td>
 157 </tr>
 158
 159 <tr><td>
 160 <span class='text'><?php echo xlt('Include Checksum'); ?>: </span>
 161 </td><td>
 162 <?php
 163
 164 $check_sum = isset($_GET['check_sum']);
 165 ?>
 166 <input type="checkbox" name="check_sum" <?php echo ($check_sum) ? "checked" : ""; ?>>
 167 </td>
 168 <td>
 169 <input type=hidden name="event" value=<?php echo attr($event) ; ?>>
 170 <a href="javascript:document.theform.submit();" class='link_submit'>[<?php echo xlt('Refresh'); ?>]</a>
 171 </td>
 172 </tr>
 173 </table>
 174 </FORM>
 175
 176
 177 <?php if ($start_date && $end_date && $err_message!=1) { ?>
 178 <div id="logview">
 179 <span class="text" id="display_tamper" style="display:none;"><?php echo xlt('Following rows in the audit log have been tampered'); ?></span>
 180 <table>
 181  <tr>
 182   <th id="sortby_date" class="text" title="<?php echo xla('Sort by Tamper date/time'); ?>"><?php echo xlt('Tamper Date'); ?></th>
 183   <th id="sortby_user" class="text" title="<?php echo xla('Sort by User'); ?>"><?php echo xlt('User'); ?></th>
 184   <th id="sortby_pid" class="text" title="<?php echo xla('Sort by PatientID'); ?>"><?php echo xlt('PatientID'); ?></th>
 185   <th id="sortby_comments" class="text" title="<?php echo  xla('Sort by Comments'); ?>"><?php echo xlt('Comments'); ?></th>
 186     <?php  if ($check_sum) {?>
 187   <th id="sortby_newchecksum" class="text" title="<?php xla('Sort by New Checksum'); ?>"><?php echo xlt('Tampered Checksum'); ?></th>
 188   <th id="sortby_oldchecksum" class="text" title="<?php xla('Sort by Old Checksum'); ?>"><?php echo xlt('Original Checksum'); ?></th>
 189     <?php } ?>
 190  </tr>
 191 <?php
 192
 193 $eventname = $_GET['eventname'];
 194 $type_event = $_GET['type_event'];
 195 ?>
 196 <input type=hidden name=event value=<?php echo attr($eventname)."-".attr($type_event) ?>>
 197 <?php
 198 $type_event = "update";
 199 $tevent="";
 200 $gev="";
 201 if ($eventname != "" && $type_event != "") {
 202     $getevent=$eventname."-".$type_event;
 203 }
 204
 205 if (($eventname == "") && ($type_event != "")) {
 206     $tevent=$type_event;
 207 } else if ($type_event =="" && $eventname != "") {
 208     $gev=$eventname;
 209 } else if ($eventname == "") {
 210     $gev = "";
 211 } else {
 212     $gev = $getevent;
 213 }
 214
 215 $dispArr = array();
 216 $icnt = 1;
 217 if ($ret = getEvents(array('sdate' => $get_sdate,'edate' => $get_edate, 'user' => $form_user, 'patient' => $form_pid, 'sortby' => $_GET['sortby'], 'levent' =>$gev, 'tevent' =>$tevent))) {
 218     foreach ($ret as $iter) {
 219         //translate comments
 220         $patterns = array ('/^success/','/^failure/','/ encounter/');
 221         $replace = array ( xl('success'), xl('failure'), xl('encounter', '', ' '));
 222
 223         $dispCheck = false;
 224         $log_id = $iter['id'];
 225         $commentEncrStatus = "No";
 226         $logEncryptData = logCommentEncryptData($log_id);
 227
 228         if (count($logEncryptData) > 0) {
 229             $commentEncrStatus = $logEncryptData['encrypt'];
 230             $checkSumOld = $logEncryptData['checksum'];
 231             $concatLogColumns = $iter['date'].$iter['event'].$iter['user'].$iter['groupname'].$iter['comments'].$iter['patient_id'].$iter['success'].$iter['checksum'].$iter['crt_user'];
 232             $checkSumNew = sha1($concatLogColumns);
 233
 234             if ($checkSumOld != $checkSumNew) {
 235                 $dispCheck = true;
 236             } else {
 237                 $dispCheck = false;
 238                 continue;
 239             }
 240         } else {
 241             continue;
 242         }
 243
 244         if ($commentEncrStatus == "Yes") {
 245             $decrypt_comment =  trim(aes256Decrypt($iter["comments"]));
 246             $trans_comments = preg_replace($patterns, $replace, $decrypt_comment);
 247         } else {
 248             $comments = trim($iter["comments"]);
 249             $trans_comments = preg_replace($patterns, $replace, $comments);
 250         }
 251
 252         //Alter Checksum value records only display here
 253         if ($dispCheck) {
 254             $dispArr[] = $icnt++;
 255         ?>
 256      <TR class="oneresult">
 257           <TD class="text tamperColor"><?php echo oeFormatShortDate(substr($iter["date"], 0, 10)) . substr($iter["date"], 10) ?></TD>
 258           <TD class="text tamperColor"><?php echo text($iter["user"]); ?></TD>
 259           <TD class="text tamperColor"><?php echo text($iter["patient_id"]);?></TD>
 260           <TD class="text tamperColor"><?php echo text($trans_comments);?></TD>
 261             <?php  if ($check_sum) { ?>
 262           <TD class="text tamperColor"><?php echo text($checkSumNew);?></TD>
 263           <TD class="text tamperColor"><?php echo text($checkSumOld);?></TD>
 264             <?php } ?>
 265      </TR>
 266 <?php
 267         }
 268     }
 269 }
 270
 271 if (count($dispArr) == 0) {?>
 272      <TR class="oneresult">
 273             <?php
 274             $colspan = 4;
 275             if ($check_sum) {
 276                 $colspan=6;
 277             }
 278             ?>
 279         <TD class="text" colspan="<?php echo $colspan;?>" align="center"><?php echo xlt('No audit log tampering detected in the selected date range.'); ?></TD>
 280      </TR>
 281 <?php
 282 } else {?>
 283     <script type="text/javascript">$('#display_tamper').css('display', 'block');</script>
 284     <?php
 285 }
 286
 287 ?>
 288 </table>
 289 </div>
 290 <?php } ?>
 291 </body>
 292 <script language="javascript">
 293
 294 // jQuery stuff to make the page a little easier to use
 295 $(document).ready(function(){
 296     // funny thing here... good learning experience
 297     // the TR has TD children which have their own background and text color
 298     // toggling the TR color doesn't change the TD color
 299     // so we need to change all the TR's children (the TD's) just as we did the TR
 300     // thus we have two calls to toggleClass:
 301     // 1 - for the parent (the TR)
 302     // 2 - for each of the children (the TDs)
 303     $(".oneresult").mouseover(function() { $(this).toggleClass("highlight"); $(this).children().toggleClass("highlight"); });
 304     $(".oneresult").mouseout(function() { $(this).toggleClass("highlight"); $(this).children().toggleClass("highlight"); });
 305
 306     // click-able column headers to sort the list
 307     $("#sortby_date").click(function() { $("#sortby").val("date"); $("#theform").submit(); });
 308     $("#sortby_event").click(function() { $("#sortby").val("event"); $("#theform").submit(); });
 309     $("#sortby_user").click(function() { $("#sortby").val("user"); $("#theform").submit(); });
 310     $("#sortby_cuser").click(function() { $("#sortby").val("user"); $("#theform").submit(); });
 311     $("#sortby_group").click(function() { $("#sortby").val("groupname"); $("#theform").submit(); });
 312     $("#sortby_pid").click(function() { $("#sortby").val("patient_id"); $("#theform").submit(); });
 313     $("#sortby_success").click(function() { $("#sortby").val("success"); $("#theform").submit(); });
 314     $("#sortby_comments").click(function() { $("#sortby").val("comments"); $("#theform").submit(); });
 315     $("#sortby_oldchecksum").click(function() { $("#sortby").val("checksum"); $("#theform").submit(); });
 316     $("#sortby_newchecksum").click(function() { $("#sortby").val("checksum"); $("#theform").submit(); });
 317
 318     $('.datetimepicker').datetimepicker({
 319         <?php $datetimepicker_timepicker = true; ?>
 320         <?php $datetimepicker_showseconds = true; ?>
 321         <?php $datetimepicker_formatInput = false; ?>
 322         <?php require($GLOBALS['srcdir'] . '/js/xl/jquery-datetimepicker-2-5-4.js.php'); ?>
 323         <?php // can add any additional javascript settings to datetimepicker here; need to prepend first setting with a comma ?>
 324     });
 325 });
 326
 327 </script>
 328
 329 </html>
 330