From eff71fbbc49fc26249cd587e59994f265802d140 Mon Sep 17 00:00:00 2001 From: bradymiller Date: Tue, 19 Feb 2013 12:37:00 -0800 Subject: [PATCH] Security fixes. --- interface/main/messages/messages.php | 20 ++++++++++---------- library/pnotes.inc | 24 ++++++++++++------------ 2 files changed, 22 insertions(+), 22 deletions(-) diff --git a/interface/main/messages/messages.php b/interface/main/messages/messages.php index 335b5b139..0d4919076 100644 --- a/interface/main/messages/messages.php +++ b/interface/main/messages/messages.php @@ -133,7 +133,7 @@ switch($task) { else { if($noteid && $assigned_to == '-patient-'){ $row = getPnoteById($noteid); - if (! $row) die("getPnoteById() did not find id '$noteid'"); + if (! $row) die("getPnoteById() did not find id '".text($noteid)."'"); $pres = sqlQuery("SELECT lname, fname " . "FROM patient_data WHERE pid = ?", array($reply_to) ); $patientname = $pres['lname'] . ", " . $pres['fname']; @@ -192,7 +192,7 @@ switch($task) { if($task == "addnew" or $task == "edit") { // Display the Messages page layout. echo " -
+ "; ?> @@ -390,13 +390,13 @@ else { $begin = isset($_REQUEST['begin']) ? $_REQUEST['begin'] : 0; for($i = 0; $i < count($sort); $i++) { - $sortlink[$i] = "\"".htmlspecialchars("; + $sortlink[$i] = "\"".htmlspecialchars("; } for($i = 0; $i < count($sort); $i++) { if($sortby == $sort[$i]) { switch($sortorder) { - case "asc" : $sortlink[$i] = "\"".htmlspecialchars("; break; - case "desc" : $sortlink[$i] = "\"".htmlspecialchars("; break; + case "asc" : $sortlink[$i] = "\"".htmlspecialchars("; break; + case "desc" : $sortlink[$i] = "\"".htmlspecialchars("; break; } break; } } @@ -417,14 +417,14 @@ else { $start = 0; } if($prev >= 0) { - $prevlink = "<<"; + $prevlink = "<<"; } else { $prevlink = "<<"; } if($next < $total) { - $nextlink = ">>"; + $nextlink = ">>"; } else { $nextlink = ">>"; @@ -432,7 +432,7 @@ else { // Display the Messages table header. echo "
- + @@ -472,7 +472,7 @@ else { htmlspecialchars( $myrow['id'], ENT_QUOTES) . "\" onclick=\"if(this.checked==true){ selectRow('row$count'); }else{ deselectRow('row$count'); }\"> -
" . htmlspecialchars( $name, ENT_NOQUOTES) . "
" . htmlspecialchars( $patient, ENT_NOQUOTES) . "
" . @@ -488,7 +488,7 @@ else {
- diff --git a/library/pnotes.inc b/library/pnotes.inc index 6fa6fb83d..5b6e265c6 100644 --- a/library/pnotes.inc +++ b/library/pnotes.inc @@ -126,10 +126,10 @@ $sqlParameterArray = array(); array_push($sqlParameterArray, $username); } if ($status) - $sql .= " AND message_status IN ('".str_replace(",", "','", $status)."')"; + $sql .= " AND message_status IN ('".str_replace(",", "','", add_escape_custom($status) )."')"; $sql .= " ORDER BY date DESC"; if($limit != "all") - $sql .= " LIMIT $start, $limit"; + $sql .= " LIMIT ".add_escape_custom($start).", ".add_escape_custom($limit); $res = sqlStatement($sql, $sqlParameterArray); @@ -171,10 +171,10 @@ $sqlParameterArray = array(); array_push($sqlParameterArray, $username); } if ($status) - $sql .= " AND message_status IN ('".str_replace(",", "','", $status)."')"; + $sql .= " AND message_status IN ('".str_replace(",", "','", add_escape_custom($status) )."')"; $sql .= " ORDER BY date DESC"; if($limit != "all") - $sql .= " LIMIT $start, $limit"; + $sql .= " LIMIT ".add_escape_custom($start).", ".$limit; $res = sqlStatement($sql, $sqlParameterArray); @@ -187,7 +187,7 @@ $sqlParameterArray = array(); function getPatientNotes($pid = '', $limit = '', $offset = 0, $search = '') { if($limit){ - $limit = "LIMIT $offset, $limit"; + $limit = "LIMIT ".add_escape_custom($offset).", ".add_escape_custom($limit); } $sql = " SELECT @@ -223,7 +223,7 @@ function getPatientNotes($pid = '', $limit = '', $offset = 0, $search = '') function getPatientNotifications($pid = '', $limit = '', $offset = 0, $search = '') { if($limit){ - $limit = "LIMIT $offset, $limit"; + $limit = "LIMIT ".add_escape_custom($offset).", ".add_escape_custom($limit); } $sql = " SELECT @@ -259,7 +259,7 @@ function getPatientNotifications($pid = '', $limit = '', $offset = 0, $search = function getPatientSentNotes($pid = '', $limit = '', $offset = 0, $search = '') { if($limit){ - $limit = "LIMIT $offset, $limit"; + $limit = "LIMIT ".add_escape_custom($offset).", ".add_escape_custom($limit); } $sql = " SELECT @@ -303,7 +303,7 @@ function getPnotesByPid ($pid, $activity = "1", $cols = "*", $limit=10, $start=0 "AND activity = '1' ". " AND message_status != 'Done' ". " AND deleted != 1 ". - " ORDER BY date DESC LIMIT $start,$limit", array($pid) ); + " ORDER BY date DESC LIMIT ".add_escape_custom($start).",".add_escape_custom($limit), array($pid) ); } else if ($activity == '0') { // return only inactive @@ -311,13 +311,13 @@ function getPnotesByPid ($pid, $activity = "1", $cols = "*", $limit=10, $start=0 "AND (activity = '0' ". " OR message_status = 'Done') ". " AND deleted != 1 ". - " ORDER BY date DESC LIMIT $start,$limit", array($pid) ); + " ORDER BY date DESC LIMIT ".add_escape_custom($start).",".add_escape_custom($limit), array($pid) ); } else { // $activity == "all" // return both active and inactive $res = sqlStatement("SELECT $cols FROM pnotes WHERE pid LIKE ? " . " AND deleted != 1 ". - " ORDER BY date DESC LIMIT $start,$limit", array($pid) ); + " ORDER BY date DESC LIMIT ".add_escape_custom($start).",".add_escape_custom($limit), array($pid) ); } for ($iter = 0; $row = sqlFetchArray($res); $iter++) $all[$iter] = $row; @@ -377,7 +377,7 @@ function addMailboxPnote($pid, $newtext, $authorized = '0', $activity = '1', function updatePnote($id, $newtext, $title, $assigned_to, $message_status = "") { $row = getPnoteById($id); - if (! $row) die("updatePnote() did not find id '$id'"); + if (! $row) die("updatePnote() did not find id '".text($id)."'"); $activity = $assigned_to ? '1' : '0'; // make inactive if set as Done @@ -421,7 +421,7 @@ function updatePnoteMessageStatus($id, $message_status) function updatePnotePatient($id, $patient_id) { $row = getPnoteById($id); - if (! $row) die("updatePnotePatient() did not find id '$id'"); + if (! $row) die("updatePnotePatient() did not find id '".text($id)."'"); $activity = $assigned_to ? '1' : '0'; $pid = $row['pid']; -- 2.11.4.GIT
" . + " . htmlspecialchars( xl('Add New'), ENT_NOQUOTES) . "   " . htmlspecialchars( xl('Delete'), ENT_NOQUOTES) . " $prevlink   $end of $total   $nextlink