patients/get_patient_info.php

   1     <?php
   2  // Copyright (C) 2011 Cassian LUP <cassi.lup@gmail.com>
   3  //
   4  // This program is free software; you can redistribute it and/or
   5  // modify it under the terms of the GNU General Public License
   6  // as published by the Free Software Foundation; either version 2
   7  // of the License, or (at your option) any later version.
   8
   9     //starting the PHP session (also regenerating the session id to avoid session fixation attacks)
  10         session_start();
  11         session_regenerate_id(true);
  12     //
  13
  14     //landing page definition -- where to go if something goes wrong
  15         $landingpage = "index.php?site=".$_SESSION['site_id'];
  16     //
  17
  18     //checking whether the request comes from index.php
  19         if (!isset($_SESSION['itsme'])) {
  20                 session_destroy();
  21                 header('Location: '.$landingpage.'&w');
  22                 exit;
  23         }
  24     //
  25
  26     //some validation
  27         if (!isset($_POST['uname']) || empty($_POST['uname'])) {
  28                 session_destroy();
  29                 header('Location: '.$landingpage.'&w&c');
  30                 exit;
  31         }
  32         if (!isset($_POST['pass']) || empty($_POST['pass'])) {
  33                 session_destroy();
  34                 header('Location: '.$landingpage.'&w&c');
  35                 exit;
  36         }
  37     //
  38
  39     require_once("../library/translation.inc.php");
  40
  41     // set the language
  42     if (!empty($_POST['languageChoice'])) {
  43         $_SESSION['language_choice'] = (int)$_POST['languageChoice'];
  44     }
  45     else if (empty($_SESSION['language_choice'])) {
  46         // just in case both are empty, then use english
  47         $_SESSION['language_choice'] = 1;
  48     }
  49     else {
  50         // keep the current session language token
  51     }
  52     $_SESSION['language_direction'] = getLanguageDir( $_SESSION['language_choice'] );
  53
  54
  55
  56     //SANITIZE ALL ESCAPES
  57     $fake_register_globals=false;
  58
  59     //STOP FAKE REGISTER GLOBALS
  60     $sanitize_all_escapes=true;
  61
  62     //Settings that will override globals.php
  63     $ignoreAuth = 1;
  64     //
  65
  66     //Authentication (and language setting)
  67         require_once('../interface/globals.php');
  68     require_once("$srcdir/authentication/common_operations.php");
  69     $password_update=isset($_SESSION['password_update']);
  70     unset($_SESSION['password_update']);
  71     $plain_code= $_POST['pass'];
  72
  73
  74     $authorizedPortal=false; //flag
  75     DEFINE("TBL_PAT_ACC_ON","patient_access_onsite");
  76     DEFINE("COL_PID","pid");
  77     DEFINE("COL_POR_PWD","portal_pwd");
  78     DEFINE("COL_POR_USER","portal_username");
  79     DEFINE("COL_POR_SALT","portal_salt");
  80     DEFINE("COL_POR_PWD_STAT","portal_pwd_status");
  81     $sql= "SELECT ".implode(",",array(COL_ID,COL_PID,COL_POR_PWD,COL_POR_SALT,COL_POR_PWD_STAT))
  82           ." FROM ".TBL_PAT_ACC_ON
  83           ." WHERE ".COL_POR_USER."=?";
  84             $auth = privQuery($sql, array($_POST['uname']));
  85             if($auth===false)
  86             {
  87                 session_destroy();
  88                 header('Location: '.$landingpage.'&w');
  89                 exit;
  90             }
  91             if(empty($auth[COL_POR_SALT]))
  92             {
  93                 if(SHA1($plain_code)!=$auth[COL_POR_PWD])
  94                 {
  95                     session_destroy();
  96                     header('Location: '.$landingpage.'&w');
  97                     exit;
  98                 }
  99                 $new_salt=oemr_password_salt();
 100                 $new_hash=oemr_password_hash($plain_code,$new_salt);
 101                 $sqlUpdatePwd= " UPDATE " . TBL_PAT_ACC_ON
 102                               ." SET " .COL_POR_PWD."=?, "
 103                               . COL_POR_SALT . "=? "
 104                               ." WHERE ".COL_ID."=?";
 105                 privStatement($sqlUpdatePwd,array($new_hash,$new_salt,$auth[COL_ID]));
 106             }
 107             else {
 108                 if(oemr_password_hash($plain_code,$auth[COL_POR_SALT])!=$auth[COL_POR_PWD])
 109                 {
 110                     session_destroy();
 111                     header('Location: '.$landingpage.'&w');
 112                     exit;
 113
 114                 }
 115
 116             }
 117             $_SESSION['portal_username']=$_POST['uname'];
 118     $sql = "SELECT * FROM `patient_data` WHERE `pid` = ?";
 119
 120     if ($userData = sqlQuery($sql, array($auth['pid']) )) { // if query gets executed
 121
 122         if (empty($userData)) {
 123                             // no records for this pid, so escape
 124             session_destroy();
 125                             header('Location: '.$landingpage.'&w');
 126             exit;
 127                     }
 128
 129         if ($userData['allow_patient_portal'] != "YES") {
 130             // Patient has not authorized portal, so escape
 131             session_destroy();
 132                             header('Location: '.$landingpage.'&w');
 133             exit;
 134                     }
 135
 136         if ($auth['pid'] != $userData['pid']) {
 137             // Not sure if this is even possible, but should escape if this happens
 138             session_destroy();
 139             header('Location: '.$landingpage.'&w');
 140             exit;
 141         }
 142
 143         if ( $password_update)
 144             {
 145                 $code_new=$_POST['pass_new'];
 146                 $code_new_confirm=$_POST['pass_new_confirm'];
 147                 if(!(empty($_POST['pass_new'])) && !(empty($_POST['pass_new_confirm'])) && ($code_new == $code_new_confirm)) {
 148                 $new_salt=oemr_password_salt();
 149                 $new_hash=oemr_password_hash($code_new,$new_salt);
 150
 151                 // Update the password and continue (patient is authorized)
 152                 privStatement("UPDATE ".TBL_PAT_ACC_ON
 153                               ."  SET ".COL_POR_PWD."=?,".COL_POR_SALT."=?,".COL_POR_PWD_STAT."=1 WHERE id=?", array($new_hash,$new_salt,$auth['id']) );
 154                 $authorizedPortal = true;
 155             }
 156         }
 157         if ($auth['portal_pwd_status'] == 0) {
 158             if(!$authorizedPortal) {
 159                 // Need to enter a new password in the index.php script
 160                 $_SESSION['password_update'] = 1;
 161                                 header('Location: '.$landingpage);
 162                 exit;
 163             }
 164         }
 165
 166         if ($auth['portal_pwd_status'] == 1) {
 167             // continue (patient is authorized)
 168             $authorizedPortal = true;
 169         }
 170
 171         if ($authorizedPortal) {
 172                         // patient is authorized (prepare the session variables)
 173             unset($_SESSION['password_update']); // just being safe
 174             unset($_SESSION['itsme']); // just being safe
 175             $_SESSION['pid'] = $auth['pid'];
 176             $_SESSION['patient_portal_onsite'] = 1;
 177         }
 178         else {
 179             session_destroy();
 180             header('Location: '.$landingpage.'&w');
 181             exit;
 182         }
 183
 184     }
 185     else { //problem with query
 186         session_destroy();
 187         header('Location: '.$landingpage.'&w');
 188         exit;
 189     }
 190
 191     require_once('summary_pat_portal.php');
 192
 193 ?>