patients/get_patient_info.php

   1     <?php
   2  // Copyright (C) 2011 Cassian LUP <cassi.lup@gmail.com>
   3  //
   4  // This program is free software; you can redistribute it and/or
   5  // modify it under the terms of the GNU General Public License
   6  // as published by the Free Software Foundation; either version 2
   7  // of the License, or (at your option) any later version.
   8
   9     //starting the PHP session (also regenerating the session id to avoid session fixation attacks)
  10         session_start();
  11         session_regenerate_id(true);
  12     //
  13
  14     //landing page definition -- where to go if something goes wrong
  15         $landingpage = "index.php?site=".$_SESSION['site_id'];
  16     //
  17
  18     //checking whether the request comes from index.php
  19         if (!isset($_SESSION['itsme'])) {
  20                 session_destroy();
  21                 header('Location: '.$landingpage.'&w');
  22                 exit;
  23         }
  24     //
  25
  26     //some validation
  27         if (!isset($_POST['uname']) || empty($_POST['uname'])) {
  28                 session_destroy();
  29                 header('Location: '.$landingpage.'&w&c');
  30                 exit;
  31         }
  32         if (!isset($_POST['pass']) || empty($_POST['pass'])) {
  33                 session_destroy();
  34                 header('Location: '.$landingpage.'&w&c');
  35                 exit;
  36         }
  37     //
  38
  39     // set the language
  40     if (!empty($_POST['languageChoice'])) {
  41             $_SESSION['language_choice'] = (int)$_POST['languageChoice'];
  42     }
  43     else if (empty($_SESSION['language_choice'])) {
  44             // just in case both are empty, then use english
  45             $_SESSION['language_choice'] = 1;
  46     }
  47     else {
  48             // keep the current session language token
  49     }
  50
  51     //Settings that will override globals.php
  52     $ignoreAuth = 1;
  53     //
  54
  55     //Authentication
  56         require_once('../interface/globals.php');
  57     require_once("$srcdir/authentication/common_operations.php");
  58     $password_update=isset($_SESSION['password_update']);
  59     unset($_SESSION['password_update']);
  60     $plain_code= $_POST['pass'];
  61
  62
  63     $authorizedPortal=false; //flag
  64     DEFINE("TBL_PAT_ACC_ON","patient_access_onsite");
  65     DEFINE("COL_PID","pid");
  66     DEFINE("COL_POR_PWD","portal_pwd");
  67     DEFINE("COL_POR_USER","portal_username");
  68     DEFINE("COL_POR_SALT","portal_salt");
  69     DEFINE("COL_POR_PWD_STAT","portal_pwd_status");
  70     $sql= "SELECT ".implode(",",array(COL_ID,COL_PID,COL_POR_PWD,COL_POR_SALT,COL_POR_PWD_STAT))
  71           ." FROM ".TBL_PAT_ACC_ON
  72           ." WHERE ".COL_POR_USER."=?";
  73             $auth = privQuery($sql, array($_POST['uname']));
  74             if($auth===false)
  75             {
  76                 session_destroy();
  77                 header('Location: '.$landingpage.'&w');
  78                 exit;
  79             }
  80             if(empty($auth[COL_POR_SALT]))
  81             {
  82                 if(SHA1($plain_code)!=$auth[COL_POR_PWD])
  83                 {
  84                     session_destroy();
  85                     header('Location: '.$landingpage.'&w');
  86                     exit;
  87                 }
  88                 $new_salt=oemr_password_salt();
  89                 $new_hash=oemr_password_hash($plain_code,$new_salt);
  90                 $sqlUpdatePwd= " UPDATE " . TBL_PAT_ACC_ON
  91                               ." SET " .COL_POR_PWD."=?, "
  92                               . COL_POR_SALT . "=? "
  93                               ." WHERE ".COL_ID."=?";
  94                 privStatement($sqlUpdatePwd,array($new_hash,$new_salt,$auth[COL_ID]));
  95             }
  96             else {
  97                 if(oemr_password_hash($plain_code,$auth[COL_POR_SALT])!=$auth[COL_POR_PWD])
  98                 {
  99                     session_destroy();
 100                     header('Location: '.$landingpage.'&w');
 101                     exit;
 102
 103                 }
 104
 105             }
 106             $_SESSION['portal_username']=$_POST['uname'];
 107     $sql = "SELECT * FROM `patient_data` WHERE `pid` = ?";
 108
 109     if ($userData = sqlQuery($sql, array($auth['pid']) )) { // if query gets executed
 110
 111         if (empty($userData)) {
 112                             // no records for this pid, so escape
 113             session_destroy();
 114                             header('Location: '.$landingpage.'&w');
 115             exit;
 116                     }
 117
 118         if ($userData['allow_patient_portal'] != "YES") {
 119             // Patient has not authorized portal, so escape
 120             session_destroy();
 121                             header('Location: '.$landingpage.'&w');
 122             exit;
 123                     }
 124
 125         if ($auth['pid'] != $userData['pid']) {
 126             // Not sure if this is even possible, but should escape if this happens
 127             session_destroy();
 128             header('Location: '.$landingpage.'&w');
 129             exit;
 130         }
 131
 132         if ( $password_update)
 133             {
 134                 $code_new=$_POST['pass_new'];
 135                 $code_new_confirm=$_POST['pass_new_confirm'];
 136                 if(!(empty($_POST['pass_new'])) && !(empty($_POST['pass_new_confirm'])) && ($code_new == $code_new_confirm)) {
 137                 $new_salt=oemr_password_salt();
 138                 $new_hash=oemr_password_hash($code_new,$new_salt);
 139
 140                 // Update the password and continue (patient is authorized)
 141                 privStatement("UPDATE ".TBL_PAT_ACC_ON
 142                               ."  SET ".COL_POR_PWD."=?,".COL_POR_SALT."=?,".COL_POR_PWD_STAT."=1 WHERE id=?", array($new_hash,$new_salt,$auth['id']) );
 143                 $authorizedPortal = true;
 144             }
 145         }
 146         if ($auth['portal_pwd_status'] == 0) {
 147             if(!$authorizedPortal) {
 148                 // Need to enter a new password in the index.php script
 149                 $_SESSION['password_update'] = 1;
 150                                 header('Location: '.$landingpage);
 151                 exit;
 152             }
 153         }
 154
 155         if ($auth['portal_pwd_status'] == 1) {
 156             // continue (patient is authorized)
 157             $authorizedPortal = true;
 158         }
 159
 160         if ($authorizedPortal) {
 161                         // patient is authorized (prepare the session variables)
 162             unset($_SESSION['password_update']); // just being safe
 163             unset($_SESSION['itsme']); // just being safe
 164             $_SESSION['pid'] = $auth['pid'];
 165             $_SESSION['patient_portal_onsite'] = 1;
 166         }
 167         else {
 168             session_destroy();
 169             header('Location: '.$landingpage.'&w');
 170             exit;
 171         }
 172
 173     }
 174     else { //problem with query
 175         session_destroy();
 176         header('Location: '.$landingpage.'&w');
 177         exit;
 178     }
 179
 180     require_once('summary_pat_portal.php');
 181
 182 ?>