addresses vulnerabilities reported at http://secunia.com/advisories/22695
[openemr.git] / interface / drugs / dispense_drug.php
blobbfcd8babb17b03eac66ac1adf1f82beff58d6d9c
1 <?php
2 // Copyright (C) 2006 Rod Roark <rod@sunsetsystems.com>
3 //
4 // This program is free software; you can redistribute it and/or
5 // modify it under the terms of the GNU General Public License
6 // as published by the Free Software Foundation; either version 2
7 // of the License, or (at your option) any later version.
9 require_once("../globals.php");
10 require_once("$srcdir/acl.inc");
11 require_once("drugs.inc.php");
12 require_once($GLOBALS['fileroot'] . "/library/classes/class.phpmailer.php");
13 require_once($GLOBALS['fileroot'] . "/library/classes/class.ezpdf.php");
15 function send_email($subject, $body) {
16 $recipient = $GLOBALS['practice_return_email_path'];
17 $mail = new PHPMailer();
18 $mail->SetLanguage("en", $GLOBALS['fileroot'] . "/library/" );
19 $mail->From = $recipient;
20 $mail->FromName = 'In-House Pharmacy';
21 $mail->isMail();
22 $mail->Host = "localhost";
23 $mail->Mailer = "mail";
24 $mail->Body = $body;
25 $mail->Subject = $subject;
26 $mail->AddAddress($recipient);
27 if(!$mail->Send()) {
28 die("There has been a mail error sending to " . $recipient .
29 " " . $mail->ErrorInfo);
33 $sale_id = $_REQUEST['sale_id'];
34 $drug_id = $_REQUEST['drug_id'];
35 $prescription_id = $_REQUEST['prescription'];
36 $quantity = $_REQUEST['quantity'];
37 $fee = $_REQUEST['fee'];
38 $user = $_SESSION['authUser'];
40 if (!acl_check('admin', 'drugs')) die("Not authorized!");
42 if (!$drug_id ) $drug_id = 0;
43 if (!$prescription_id) $prescription_id = 0;
44 if (!$quantity ) $quantity = 0;
45 if (!$fee ) $fee = 0.00;
47 $inventory_id = 0;
48 $bad_lot_list = '';
49 $today = date('Y-m-d');
51 // If there is no sale_id then this is a new dispensation.
53 if (! $sale_id) {
54 // Find and update inventory, deal with errors.
56 if ($drug_id) {
57 $res = sqlStatement("SELECT * FROM drug_inventory WHERE " .
58 "drug_id = '$drug_id' AND on_hand > 0 AND destroy_date IS NULL " .
59 "ORDER BY expiration, inventory_id");
60 while ($row = sqlFetchArray($res)) {
61 if ($row['expiration'] > $today && $row['on_hand'] >= $quantity) {
62 break;
64 $tmp = $row['lot_number'];
65 if (! $tmp) $tmp = '[missing lot number]';
66 if ($bad_lot_list) $bad_lot_list .= ', ';
67 $bad_lot_list .= $tmp;
70 if ($bad_lot_list) {
71 send_email("Lot destruction needed",
72 "The following lot(s) are expired or too small to fill prescription " .
73 "$prescription_id and should be destroyed: $bad_lot_list\n");
76 if (! $row) {
77 die("Inventory is not available for this order.");
80 $inventory_id = $row['inventory_id'];
82 sqlStatement("UPDATE drug_inventory SET " .
83 "on_hand = on_hand - $quantity " .
84 "WHERE inventory_id = $inventory_id");
86 $rowsum = sqlQuery("SELECT sum(on_hand) AS sum FROM drug_inventory WHERE " .
87 "drug_id = '$drug_id' AND on_hand > '$quantity' AND expiration > CURRENT_DATE");
88 $rowdrug = sqlQuery("SELECT * FROM drugs WHERE " .
89 "drug_id = '$drug_id'");
90 if ($rowsum['sum'] <= $rowdrug['reorder_point']) {
91 send_email("Drug re-order required",
92 "Drug '" . $rowdrug['name'] . "' has reached its reorder point.\n");
95 // TBD: Set and check a reorder notification date so we don't
96 // send zillions of redundant emails.
100 $sale_id = sqlInsert("INSERT INTO drug_sales ( " .
101 "drug_id, inventory_id, prescription_id, pid, user, sale_date, quantity, fee " .
102 ") VALUES ( " .
103 "'$drug_id', '$inventory_id', '$prescription_id', '$pid', '$user', '$today',
104 '$quantity', '$fee' " .
105 ")");
108 // Generate the bottle label for the sale identified by $sale_id.
110 // Get details for what we guess is the primary facility.
111 $frow = sqlQuery("SELECT * FROM facility " .
112 "ORDER BY billing_location DESC, accepts_assignment DESC, id LIMIT 1");
114 // Get everything else.
115 $row = sqlQuery("SELECT " .
116 "s.pid, s.quantity, s.prescription_id, " .
117 "i.manufacturer, i.lot_number, i.expiration, " .
118 "d.name, d.ndc_number, d.form, d.size, d.unit, " .
119 "r.date_modified, r.dosage, r.route, r.interval, r.substitute, r.refills, " .
120 "p.fname, p.lname, p.mname, " .
121 "u.fname AS ufname, u.mname AS umname, u.lname AS ulname " .
122 "FROM drug_sales AS s, drug_inventory AS i, drugs AS d, " .
123 "prescriptions AS r, patient_data AS p, users AS u WHERE " .
124 "s.sale_id = '$sale_id' AND " .
125 "i.inventory_id = s.inventory_id AND " .
126 "d.drug_id = i.drug_id AND " .
127 "r.id = s.prescription_id AND " .
128 "p.pid = s.pid AND " .
129 "u.id = r.provider_id");
131 $dconfig = $GLOBALS['oer_config']['druglabels'];
133 $header_text = $row['ufname'] . ' ' . $row['umname'] . ' ' . $row['ulname'] . "\n" .
134 $frow['street'] . "\n" .
135 $frow['city'] . ', ' . $frow['state'] . ' ' . $frow['postal_code'] .
136 ' ' . $frow['phone'] . "\n";
137 if ($dconfig['disclaimer']) $header_text .= $dconfig['disclaimer'] . "\n";
139 $label_text = $row['fname'] . ' ' . $row['lname'] . ' ' . $row['date_modified'] .
140 ' RX#' . sprintf('%06u', $row['prescription_id']) . "\n" .
141 $row['name'] . ' ' . $row['size'] . ' ' .
142 $unit_array[$row['unit']] . ' QTY ' .
143 $row['quantity'] . "\n" .
144 'Take ' . $row['dosage'] . ' ' . $form_array[$row['form']] .
145 ($row['dosage'] > 1 ? 's ' : ' ') .
146 $interval_array_verbose[$row['interval']] . ' ' .
147 $route_array_verbose[$row['route']] . "\n" .
148 'Lot ' . $row['lot_number'] . ' Exp ' . $row['expiration'] . "\n" .
149 'NDC ' . $row['ndc_number'] . ' ' . $row['manufacturer'];
151 // if ($row['refills']) {
152 // // Find out how many times this prescription has been filled/refilled.
153 // $refills_row = sqlQuery("SELECT count(*) AS count FROM drug_sales " .
154 // "WHERE prescription_id = '" . $row['prescription_id'] .
155 // "' AND quantity > 0");
156 // $label_text .= ($refills_row['count'] - 1) . ' of ' . $row['refills'] . ' refills';
157 // }
159 // We originally went for PDF output on the theory that output formatting
160 // would be more controlled. However the clumisness of invoking a PDF
161 // viewer from the browser becomes intolerable in a POS environment, and
162 // printing HTML is much faster and easier if the browser's page setup is
163 // configured properly.
165 if (false) { // if PDF output is desired
166 $pdf =& new Cezpdf($dconfig['paper_size']);
167 $pdf->ezSetMargins($dconfig['top'],$dconfig['bottom'],$dconfig['left'],$dconfig['right']);
168 $pdf->selectFont($GLOBALS['fileroot'] . "/library/fonts/Helvetica.afm");
169 $pdf->ezSetDy(20); // dunno why we have to do this...
170 $pdf->ezText($header_text, 7, array('justification'=>'center'));
171 if(!empty($dconfig['logo'])) {
172 $pdf->ezSetDy(-5); // add space (move down) before the image
173 $pdf->ezImage($dconfig['logo'], 0, 180, '', 'left');
174 $pdf->ezSetDy(8); // reduce space (move up) after the image
176 $pdf->ezText($label_text, 9, array('justification'=>'center'));
177 $pdf->ezStream();
179 else { // HTML output
181 <html>
182 <head>
183 <style type="text/css">
184 body {
185 font-family: sans-serif;
186 font-size: 9pt;
187 font-weight: normal;
189 .labtop {
190 color: #000000;
191 font-family: sans-serif;
192 font-size: 7pt;
193 font-weight: normal;
194 text-align: center;
195 padding-bottom: 1pt;
197 .labbot {
198 color: #000000;
199 font-family: sans-serif;
200 font-size: 9pt;
201 font-weight: normal;
202 text-align: center;
203 padding-top: 2pt;
205 </style>
206 <title><?php xl('Prescription Label','e') ; ?></title>
207 </head>
208 <body leftmargin='0' topmargin='0' marginwidth='0' marginheight='0'>
209 <center>
210 <table border='0' cellpadding='0' cellspacing='0' style='width: 200pt'>
211 <tr><td class="labtop" nowrap>
212 <?php echo nl2br($header_text); ?>
213 </td></tr>
214 <tr><td style='background-color: #000000; height: 5pt;'></td></tr>
215 <tr><td class="labbot" nowrap>
216 <?php echo nl2br($label_text); ?>
217 </td></tr>
218 </table>
219 </center>
220 <script language="JavaScript">
221 window.print();
222 </script>
223 </body>
224 </html>
225 <?php