addresses vulnerabilities reported at http://secunia.com/advisories/22695
[openemr.git] / interface / drugs / add_edit_drug.php
blob1dcbe65c9a649f9e58d0ab344aa940d8a6122e92
1 <?php
2 // Copyright (C) 2006 Rod Roark <rod@sunsetsystems.com>
3 //
4 // This program is free software; you can redistribute it and/or
5 // modify it under the terms of the GNU General Public License
6 // as published by the Free Software Foundation; either version 2
7 // of the License, or (at your option) any later version.
9 require_once("../globals.php");
10 require_once("$srcdir/acl.inc");
11 require_once("drugs.inc.php");
13 $drug_id = $_REQUEST['drug'];
14 $info_msg = "";
15 $tmpl_line_no = 0;
17 if (!acl_check('admin', 'drugs')) die("Not authorized!");
19 // Write a line of data for one template to the form.
21 function writeTemplateLine($selector, $dosage, $period, $quantity, $refills) {
22 global $tmpl_line_no, $interval_array;
23 ++$tmpl_line_no;
25 echo " <tr>\n";
26 echo " <td class='tmplcell'>";
27 echo "<input type='text' name='tmpl[$tmpl_line_no][selector]' value='$selector' size='10' maxlength='100'>";
28 echo "</td>\n";
29 echo " <td class='tmplcell'>";
30 echo "<input type='text' name='tmpl[$tmpl_line_no][dosage]' value='$dosage' size='10' maxlength='10'>";
31 echo "</td>\n";
32 echo " <td class='tmplcell'>";
33 echo "<select name='tmpl[$tmpl_line_no][period]'>";
34 foreach ($interval_array as $key => $value) {
35 echo "<option value='$key'";
36 if ($key == $period) echo " selected";
37 echo ">$value</option>";
39 echo "</td>\n";
40 echo " <td class='tmplcell'>";
41 echo "<input type='text' name='tmpl[$tmpl_line_no][quantity]' value='$quantity' size='5' maxlength='7'>";
42 echo "</td>\n";
43 echo " <td class='tmplcell'>";
44 echo "<input type='text' name='tmpl[$tmpl_line_no][refills]' value='$refills' size='3' maxlength='5'>";
45 echo "</td>\n";
46 echo " </tr>\n";
49 <html>
50 <head>
51 <title><?php echo $drug_id ? xl("Edit") : xl("Add New"); xl (' Drug','e'); ?></title>
52 <link rel=stylesheet href='<?php echo $css_header ?>' type='text/css'>
54 <style>
55 td { font-size:10pt; }
56 </style>
58 <script language="JavaScript">
59 </script>
61 </head>
63 <body <?php echo $top_bg_line;?>>
64 <?php
65 // If we are saving, then save and close the window.
67 if ($_POST['form_save'] || $_POST['form_delete']) {
68 $new_drug = false;
69 if ($drug_id) {
70 if ($_POST['form_save']) {
71 sqlStatement("UPDATE drugs SET " .
72 "name = '" . $_POST['form_name'] . "', " .
73 "ndc_number = '" . $_POST['form_ndc_number'] . "', " .
74 "on_order = '" . $_POST['form_on_order'] . "', " .
75 "reorder_point = '" . $_POST['form_reorder_point'] . "', " .
76 "form = '" . $_POST['form_form'] . "', " .
77 "size = '" . $_POST['form_size'] . "', " .
78 "unit = '" . $_POST['form_unit'] . "', " .
79 "route = '" . $_POST['form_route'] . "' " .
80 "WHERE drug_id = '$drug_id'");
81 sqlStatement("DELETE FROM drug_templates WHERE drug_id = '$drug_id'");
83 else {
84 if (acl_check('admin', 'super')) {
85 sqlStatement("DELETE FROM drug_inventory WHERE drug_id = '$drug_id'");
86 sqlStatement("DELETE FROM drug_templates WHERE drug_id = '$drug_id'");
87 sqlStatement("DELETE FROM drugs WHERE drug_id = '$drug_id'");
90 } else if ($_POST['form_save']) {
91 $new_drug = true;
92 $drug_id = sqlInsert("INSERT INTO drugs ( " .
93 "name, ndc_number, on_order, reorder_point, form, " .
94 "size, unit, route " .
95 ") VALUES ( " .
96 "'" . $_POST['form_name'] . "', " .
97 "'" . $_POST['form_ndc_number'] . "', " .
98 "'" . $_POST['form_on_order'] . "', " .
99 "'" . $_POST['form_reorder_point'] . "', " .
100 "'" . $_POST['form_form'] . "', " .
101 "'" . $_POST['form_size'] . "', " .
102 "'" . $_POST['form_unit'] . "', " .
103 "'" . $_POST['form_route'] . "' " .
104 ")");
107 if ($_POST['form_save'] && $drug_id) {
108 $tmpl = $_POST['tmpl'];
109 for ($lino = 1; isset($tmpl["$lino"]['selector']); ++$lino) {
110 $iter = $tmpl["$lino"];
111 if (trim($iter['selector'])) {
112 sqlInsert("INSERT INTO drug_templates ( " .
113 "drug_id, selector, dosage, period, quantity, refills " .
114 ") VALUES ( " .
115 "$drug_id, " .
116 "'" . trim($iter['selector']) . "', " .
117 "'" . trim($iter['dosage']) . "', " .
118 "'" . trim($iter['period']) . "', " .
119 "'" . trim($iter['quantity']) . "', " .
120 "'" . trim($iter['refills']) . "' " .
121 ")");
126 // Close this window and redisplay the updated list of drugs.
128 echo "<script language='JavaScript'>\n";
129 if ($info_msg) echo " alert('$info_msg');\n";
130 echo " if (opener.refreshme) opener.refreshme();\n";
131 if ($new_drug) {
132 echo " window.location.href='add_edit_lot.php?drug=$drug_id&lot=0'\n";
133 } else {
134 echo " window.close();\n";
136 echo "</script></body></html>\n";
137 exit();
140 if ($drug_id) {
141 $row = sqlQuery("SELECT * FROM drugs WHERE drug_id = '$drug_id'");
142 $tres = sqlStatement("SELECT * FROM drug_templates WHERE " .
143 "drug_id = '$drug_id' ORDER BY selector");
147 <form method='post' name='theform' action='add_edit_drug.php?drug=<?php echo $drug_id; ?>'>
148 <center>
150 <table border='0' width='100%'>
152 <tr>
153 <td valign='top' nowrap><b><?php xl('Name','e'); ?>:</b></td>
154 <td>
155 <input type='text' size='40' name='form_name' maxlength='80' value='<?php echo $row['name'] ?>' style='width:100%' />
156 </td>
157 </tr>
159 <tr>
160 <td valign='top' nowrap><b><?php xl('NDC Number','e'); ?>:</b></td>
161 <td>
162 <input type='text' size='40' name='form_ndc_number' maxlength='20' value='<?php echo $row['ndc_number'] ?>' style='width:100%' />
163 </td>
164 </tr>
166 <tr>
167 <td valign='top' nowrap><b><?php xl('On Order','e'); ?>:</b></td>
168 <td>
169 <input type='text' size='5' name='form_on_order' maxlength='7' value='<?php echo $row['on_order'] ?>' />
170 </td>
171 </tr>
173 <tr>
174 <td valign='top' nowrap><b><?php xl('Reorder At','e'); ?>:</b></td>
175 <td>
176 <input type='text' size='5' name='form_reorder_point' maxlength='7' value='<?php echo $row['reorder_point'] ?>' />
177 </td>
178 </tr>
180 <tr>
181 <td valign='top' nowrap><b><?php xl('Form','e'); ?>:</b></td>
182 <td>
183 <select name='form_form'>
184 <?php
185 foreach ($form_array as $key => $value) {
186 echo " <option value='$key'";
187 if ($key == $row['form']) echo " selected";
188 echo ">$value\n";
191 </select>
192 </td>
193 </tr>
195 <tr>
196 <td valign='top' nowrap><b><?php xl('Pill Size','e'); ?>:</b></td>
197 <td>
198 <input type='text' size='5' name='form_size' maxlength='7' value='<?php echo $row['size'] ?>' />
199 </td>
200 </tr>
202 <tr>
203 <td valign='top' nowrap><b><?php xl('Units','e'); ?>:</b></td>
204 <td>
205 <select name='form_unit'>
206 <?php
207 foreach ($unit_array as $key => $value) {
208 echo " <option value='$key'";
209 if ($key == $row['unit']) echo " selected";
210 echo ">$value\n";
213 </select>
214 </td>
215 </tr>
217 <tr>
218 <td valign='top' nowrap><b><?php xl('Route','e'); ?>:</b></td>
219 <td>
220 <select name='form_route'>
221 <?php
222 foreach ($route_array as $key => $value) {
223 echo " <option value='$key'";
224 if ($key == $row['route']) echo " selected";
225 echo ">$value\n";
228 </select>
229 </td>
230 </tr>
232 <tr>
233 <td valign='top' nowrap><b><?php xl('Templates','e'); ?>:</b></td>
234 <td>
235 <table border='0' width='100%'>
236 <tr>
237 <td><b><?php xl('Name' ,'e'); ?></b></td>
238 <td><b><?php xl('Schedule','e'); ?></b></td>
239 <td><b><?php xl('Interval','e'); ?></b></td>
240 <td><b><?php xl('Qty' ,'e'); ?></b></td>
241 <td><b><?php xl('Refills' ,'e'); ?></b></td>
242 </tr>
243 <?php
244 $blank_lines = 3;
245 if ($tres) {
246 $blank_lines = 1;
247 while ($trow = sqlFetchArray($tres)) {
248 writeTemplateLine($trow['selector'], $trow['dosage'], $trow['period'],
249 $trow['quantity'], $trow['refills']);
252 for ($i = 0; $i < $blank_lines; ++$i) {
253 writeTemplateLine('', '', '', '', '');
256 </table>
257 </td>
258 </tr>
260 </table>
263 <input type='submit' name='form_save' value='<?php xl('Save','e'); ?>' />
265 <?php if (acl_check('admin', 'super')) { ?>
266 &nbsp;
267 <input type='submit' name='form_delete' value='<?php xl('Delete','e'); ?>' style='color:red' />
268 <?php } ?>
270 &nbsp;
271 <input type='button' value='<?php xl('Cancel','e'); ?>' onclick='window.close()' />
273 </p>
275 </center>
276 </form>
277 </body>
278 </html>