myportal/soap_service/server_audit.php

   1 <?php
   2 // +-----------------------------------------------------------------------------+
   3 // Copyright (C) 2011 Z&H Consultancy Services Private Limited <sam@zhservices.com>
   4 //
   5 //
   6 // This program is free software; you can redistribute it and/or
   7 // modify it under the terms of the GNU General Public License
   8 // as published by the Free Software Foundation; either version 2
   9 // of the License, or (at your option) any later version.
  10 //
  11 //
  12 // This program is distributed in the hope that it will be useful,
  13 // but WITHOUT ANY WARRANTY; without even the implied warranty of
  14 // MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  15 // GNU General Public License for more details.
  16 //
  17 //
  18 // A copy of the GNU General Public License is included along with this program:
  19 // openemr/interface/login/GnuGPL.html
  20 // For more information write to the Free Software
  21 // Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.
  22 //
  23 // Author:   Eldho Chacko <eldho@zhservices.com>
  24 //           Jacob T Paul <jacob@zhservices.com>
  25 //
  26 // +------------------------------------------------------------------------------+
  27
  28 //SANITIZE ALL ESCAPES
  29 $sanitize_all_escapes=true;
  30 //
  31
  32 //STOP FAKE REGISTER GLOBALS
  33 $fake_register_globals=false;
  34 //
  35
  36 require_once("server_mail.php");
  37
  38 class UserAudit extends UserMail{
  39
  40
  41
  42 //During auditing if a new patient demo is rejected will delete the patient from DB
  43
  44   public function delete_if_new_patient($var)
  45        {
  46               $data_credentials=$var[0];
  47         if(UserService::valid($data_credentials)=='oemruser'){
  48                 $audit_master_id = $var['audit_master_id'];
  49                  $qry = "select * from audit_master WHERE id=? and approval_status=1 and type=1";
  50                  $result=sqlStatement($qry,array($audit_master_id));
  51                  $rowfield = sqlFetchArray($result);
  52                  if($rowfield['pid']>0)
  53                   {
  54                         $pid=$rowfield['pid'];
  55                         $qry = "DELETE from  patient_data WHERE pid=?";
  56                         sqlStatement($qry,array($pid));
  57                         $qry = "DELETE  from employer_data WHERE pid=?";
  58                         sqlStatement($qry,array($pid));
  59                         $qry = "DELETE  from history_data WHERE pid=?";
  60                         sqlStatement($qry,array($pid));
  61                         $qry = "DELETE  from insurance_data WHERE pid=?";
  62                         sqlStatement($qry,array($pid));
  63                         $qry = "DELETE from patient_access_offsite WHERE  pid=? ";
  64                         sqlStatement($qry,array($pid));
  65                         $qry = "DELETE from openemr_postcalendar_events WHERE  pc_pid=? ";// appointments approved, but patient denied case.
  66                         sqlStatement($qry,array($pid));
  67                          $qry = "select * from documents_legal_master,documents_legal_detail   where dld_pid=?
  68                                 and dlm_document_id=dld_master_docid and  dlm_subcategory   not in (SELECT dlc_id FROM `documents_legal_categories`
  69                                 where dlc_category_name='Layout Signed' and dlc_category_type=2)";
  70                          $result=sqlStatement($qry,array($pid));
  71                          while($row_sql=sqlFetchArray($result))
  72                           {
  73                            @unlink('../documents/'.$row_sql['dld_filepath'].$row_sql['dld_filename']);
  74                           }
  75                         $qry = "DELETE  from documents_legal_detail WHERE dld_pid=?";
  76                         sqlStatement($qry,array($pid));
  77                         $qry = "DELETE from audit_details WHERE audit_master_id in
  78                                                                 (select id from audit_master WHERE pid=? )";//type and approval_status=1 is not called purposefully,so as to delete the appointments also
  79                         sqlStatement($qry,array($pid));
  80                         $qry = "DELETE from audit_master WHERE pid=?";//type and approval_status=1 is not called purposefully,so as to delete the appointments also
  81                         sqlStatement($qry,array($pid));
  82                   }
  83         }
  84         else{
  85                 throw new SoapFault("Server", "credentials failed");
  86         }
  87        }
  88
  89
  90 //update the audit master_table  with the status ie denied,approved etc.
  91
  92   public function update_audit_master($var)
  93        {
  94               $data_credentials=$var[0];
  95               if(UserService::valid($data_credentials)){
  96                $audit_master_id=$var['audit_master_id'];
  97                $approval_status=$var['approval_status'];
  98                $comments=$var['comments'];
  99                $user_id=$var['user_id'];
 100                sqlStatement("UPDATE audit_master SET approval_status=?, comments=?,modified_time=NOW(),user_id=? WHERE id=? ",array($approval_status,$comments,$user_id,$audit_master_id));
 101                    $dld_pid = sqlQuery("SELECT pid from audit_master WHERE id=?",array($audit_master_id));
 102                    sqlStatement("UPDATE documents_legal_detail SET dld_signed=? WHERE dld_pid=? AND dld_signed=0",array($approval_status,$dld_pid['pid']));
 103                   }
 104               else{
 105               throw new SoapFault("Server", "credentials failed");
 106               }
 107        }
 108
 109
 110
 111 // Will update the corresponding tables with the audited and approved data.
 112 //Appointments and Demos are updated from the audit_details table to the actual transaction tables
 113   public function update_audited_data($var)
 114        {
 115               $data_credentials=$var[0];
 116         $validtables = array("patient_data","employer_data","insurance_data","history_data","openemr_postcalendar_events");
 117         if(UserService::valid($data_credentials)){
 118               $audit_master_id = $var['audit_master_id'];
 119               $res = sqlStatement("SELECT * FROM  audit_master  where id=? and  approval_status='1' and  type='3' ",array($audit_master_id));
 120               if(sqlNumRows($res)>0)//skip this function if type=3(only documents saved.)
 121                    {
 122                     return;
 123                    }
 124               $res = sqlStatement("SELECT DISTINCT ad.table_name,am.id,am.pid FROM audit_master as am,audit_details as ad WHERE am.id=ad.audit_master_id and am.approval_status in ('1','4') and am.id=?",array($audit_master_id));
 125               $tablecnt = sqlNumRows($res);
 126               while($row = sqlFetchArray($res)){
 127                 $pid=$row['pid'];
 128                      $resfield = sqlStatement("SELECT * FROM audit_details WHERE audit_master_id=? AND table_name=?",array($audit_master_id,$row['table_name']));
 129                      $table = $row['table_name'];
 130                      $cnt = 0;
 131                      foreach($validtables as $value){//Update will execute if and only if all tables are validtables
 132                             if($value==$table)
 133                             $cnt++;
 134                      }
 135                      if($cnt>0){
 136                             while($rowfield = sqlFetchArray($resfield)){
 137
 138                                   if($table=='patient_data'){
 139                                         $newdata['patient_data'][$rowfield['field_name']]=$rowfield['field_value'];
 140                                   }
 141
 142                                   if($table=='employer_data'){
 143                                         $newdata['employer_data'][$rowfield['field_name']]=$rowfield['field_value'];
 144                                   }
 145
 146                                   if($table=='insurance_data'){
 147                                         $ins1_type="primary";
 148                                         $ins2_type="secondary";
 149                                         $ins3_type="tertiary";
 150                                         for($i=1;$i<=3;$i++)
 151                                         {
 152                                                 $newdata[$rowfield['entry_identification']][$rowfield['field_name']]=$rowfield['field_value'];
 153                                         }
 154                                   }
 155
 156                                   if($table=='openemr_postcalendar_events'){
 157                                     $newdata['openemr_postcalendar_events'][$rowfield['field_name']]=$rowfield['field_value'];
 158                                   }
 159
 160                             }
 161                             require_once("../../library/invoice_summary.inc.php");
 162                             require_once("../../library/options.inc.php");
 163                             require_once("../../library/acl.inc");
 164                             require_once("../../library/patient.inc");
 165                             if($table=='patient_data'){
 166                                $pdrow = sqlQuery("SELECT id from patient_data WHERE pid=?",array($pid));
 167                                $newdata['patient_data']['id']=$pdrow['id'];
 168                                updatePatientData($pid,$newdata['patient_data']);
 169                             }
 170                             elseif($table=='employer_data'){
 171                                updateEmployerData($pid,$newdata['employer_data']);
 172                             }
 173                             elseif($table=='insurance_data'){
 174                                     for($i=1;$i<=3;$i++){
 175                                             newInsuranceData(
 176                                               $pid,
 177                                               add_escape_custom($newdata[${ins.$i._type}]['type']),
 178                                               add_escape_custom($newdata[${ins.$i._type}]['provider']),
 179                                               add_escape_custom($newdata[${ins.$i._type}]['policy_number']),
 180                                               add_escape_custom($newdata[${ins.$i._type}]['group_number']),
 181                                               add_escape_custom($newdata[${ins.$i._type}]['plan_name']),
 182                                               add_escape_custom($newdata[${ins.$i._type}]['subscriber_lname']),
 183                                               add_escape_custom($newdata[${ins.$i._type}]['subscriber_mname']),
 184                                               add_escape_custom($newdata[${ins.$i._type}]['subscriber_fname']),
 185                                               add_escape_custom($newdata[${ins.$i._type}]['subscriber_relationship']),
 186                                               add_escape_custom($newdata[${ins.$i._type}]['subscriber_ss']),
 187                                               add_escape_custom($newdata[${ins.$i._type}]['subscriber_DOB']),
 188                                               add_escape_custom($newdata[${ins.$i._type}]['subscriber_street']),
 189                                               add_escape_custom($newdata[${ins.$i._type}]['subscriber_postal_code']),
 190                                               add_escape_custom($newdata[${ins.$i._type}]['subscriber_city']),
 191                                               add_escape_custom($newdata[${ins.$i._type}]['subscriber_state']),
 192                                               add_escape_custom($newdata[${ins.$i._type}]['subscriber_country']),
 193                                               add_escape_custom($newdata[${ins.$i._type}]['subscriber_phone']),
 194                                               add_escape_custom($newdata[${ins.$i._type}]['subscriber_employer']),
 195                                               add_escape_custom($newdata[${ins.$i._type}]['subscriber_employer_street']),
 196                                               add_escape_custom($newdata[${ins.$i._type}]['subscriber_employer_city']),
 197                                               add_escape_custom($newdata[${ins.$i._type}]['subscriber_employer_postal_code']),
 198                                               add_escape_custom($newdata[${ins.$i._type}]['subscriber_employer_state']),
 199                                               add_escape_custom($newdata[${ins.$i._type}]['subscriber_employer_country']),
 200                                               add_escape_custom($newdata[${ins.$i._type}]['copay']),
 201                                               add_escape_custom($newdata[${ins.$i._type}]['subscriber_sex']),
 202                                               add_escape_custom($newdata[${ins.$i._type}]['date']),
 203                                               add_escape_custom($newdata[${ins.$i._type}]['accept_assignment']));
 204                                     }
 205                             }
 206                             elseif($table=='openemr_postcalendar_events'){
 207                               sqlInsert("INSERT INTO openemr_postcalendar_events ( " .
 208                                     "pc_pid,pc_title,pc_time,pc_hometext,pc_eventDate,pc_endDate,pc_startTime,pc_endTime,pc_duration,pc_catid,pc_eventstatus,pc_aid,pc_facility" .
 209                                     ") VALUES ( " .
 210                                     "'" . add_escape_custom($pid)             . "', " .
 211                                     "'" . add_escape_custom($newdata['openemr_postcalendar_events']['pc_title'])           . "', " .
 212                                     "NOW(), "                                         .
 213                                     "'" . add_escape_custom($newdata['openemr_postcalendar_events']['pc_hometext']) . "', " .
 214                                     "'" . add_escape_custom($newdata['openemr_postcalendar_events']['pc_eventDate'])          . "', " .
 215                                     "'" . add_escape_custom($newdata['openemr_postcalendar_events']['pc_endDate'])                        . "', " .
 216                                     "'" . add_escape_custom($newdata['openemr_postcalendar_events']['pc_startTime'])     . "', " .
 217                                     "'" . add_escape_custom($newdata['openemr_postcalendar_events']['pc_endTime'])                   . "', " .
 218                                     "'" . add_escape_custom($newdata['openemr_postcalendar_events']['pc_duration']) . "', " .
 219                                     "'" . add_escape_custom($newdata['openemr_postcalendar_events']['pc_catid'])             . "', " .
 220                                     "1, " .
 221                                     "'" . add_escape_custom($newdata['openemr_postcalendar_events']['pc_aid'])."', " .
 222                                     "'" . add_escape_custom($newdata['openemr_postcalendar_events']['pc_facility'])               . "')"
 223                                 );
 224                             }
 225                          }
 226                      else{
 227                             throw new SoapFault("Server", "Table Not Supported error message");
 228                      }
 229               }
 230         }
 231         else{
 232                 throw new SoapFault("Server", "credentials failed");
 233         }
 234     }
 235
 236
 237 //Data from portal is inserted through this function. It will wait for audit and approval
 238 //according to the facility settings. audit_details is the child table of Audit_master
 239
 240   public function insert_to_be_audit_data($var)
 241        {
 242          global $pid;
 243          $data_credentials = $var[0];
 244          if(UserService::valid($data_credentials))
 245               {
 246                      $audit_master_id_to_delete=$var['audit_master_id_to_delete'];
 247                      $approval_status=$var['approval_status'];
 248                      $type=$var['type'];
 249                      $ip_address=$var['ip_address'];
 250                      $table_name_array=$var['table_name_array'];
 251                      $field_name_value_array=$var['field_name_value_array'];
 252                      $entry_identification_array=$var['entry_identification_array'];
 253
 254                      if($audit_master_id_to_delete){
 255                      $qry = "DELETE from audit_master WHERE id=?";
 256                      sqlStatement($qry,array($audit_master_id_to_delete));
 257                      $qry = "DELETE from audit_details WHERE audit_master_id=?";
 258                      sqlStatement($qry,array($audit_master_id_to_delete));
 259                      }
 260
 261                      $master_query="INSERT INTO audit_master SET
 262                        pid = ?,
 263                        approval_status = ?,
 264                        ip_address = ?,
 265                        type = ?";
 266                      $audit_master_id= sqlInsert($master_query,array($pid,$approval_status,$ip_address,$type));
 267                      $detail_query="INSERT INTO `audit_details` (`table_name`, `field_name`, `field_value`, `audit_master_id`, `entry_identification`) VALUES ";
 268                      $detail_query_array='';
 269                      foreach($table_name_array as $key=>$table_name)
 270                       {
 271                              foreach($field_name_value_array[$key] as $field_name=>$field_value)
 272                               {
 273                                      $detail_query.="(? ,? ,? ,? ,?),";
 274                                      $detail_query_array[] = $table_name;
 275                                      $detail_query_array[] = trim($field_name);
 276                                      $detail_query_array[] = trim($field_value);
 277                                      $detail_query_array[] = $audit_master_id;
 278                                      $detail_query_array[] = trim($entry_identification_array[$key]);
 279                               }
 280                       }
 281                      $detail_query = substr($detail_query, 0, -1);
 282                      $detail_query=$detail_query.';';
 283                      sqlInsert($detail_query,$detail_query_array);
 284                      if($var['auto_update']==1)
 285                      {
 286                             $var['audit_master_id'] = $audit_master_id;
 287                             UserAudit::update_audited_data($var);
 288                      }
 289               }
 290              else
 291               {
 292                      throw new SoapFault("Server", "credentials failed");
 293               }
 294     }
 295
 296
 297 //Data from portal is inserted through this function. It will wait for audit and approval
 298 //according to the facility settings. This is the master table entry.
 299
 300   public function insert_audit_master($var)
 301        {
 302         global $pid;
 303         $data_credentials=$var[0];
 304         if(UserService::valid($data_credentials))
 305                  {
 306                      $approval_status=$var['approval_status'];
 307                      $type=$var['type'];
 308                      $ip_address=$var['ip_address'];
 309
 310                      $master_query="INSERT INTO audit_master SET
 311                        pid = ?,
 312                        approval_status = ?,
 313                        ip_address = ?,
 314                        type =?";
 315                      $audit_master_id= sqlInsert($master_query,array($pid,$approval_status,$ip_address,$type));
 316                  }
 317                 else
 318                  {
 319                         throw new SoapFault("Server", "credentials failed");
 320                  }
 321        }
 322 }
 323 ?>