interface/patient_file/summary/create_portallogin.php

   1 <?php
   2 // +-----------------------------------------------------------------------------+
   3 // Copyright (C) 2011 Z&H Consultancy Services Private Limited <sam@zhservices.com>
   4 //
   5 //
   6 // This program is free software; you can redistribute it and/or
   7 // modify it under the terms of the GNU General Public License
   8 // as published by the Free Software Foundation; either version 2
   9 // of the License, or (at your option) any later version.
  10 //
  11 //
  12 // This program is distributed in the hope that it will be useful,
  13 // but WITHOUT ANY WARRANTY; without even the implied warranty of
  14 // MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  15 // GNU General Public License for more details.
  16 //
  17 //
  18 // A copy of the GNU General Public License is included along with this program:
  19 // openemr/interface/login/GnuGPL.html
  20 // For more information write to the Free Software
  21 // Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.
  22 //
  23 // Author:   Eldho Chacko <eldho@zhservices.com>
  24 //           Jacob T Paul <jacob@zhservices.com>
  25 //           Paul Simon   <paul@zhservices.com>
  26 //
  27 // +------------------------------------------------------------------------------+
  28
  29
  30  require_once("../../globals.php");
  31
  32 // Collect portalsite parameter (either off for offsite or on for onsite); only allow off or on
  33 $portalsite = isset($_GET['portalsite']) ? $_GET['portalsite'] : $portalsite = "off";
  34 if ($portalsite != "off" && $portalsite != "on") $portalsite = "off";
  35
  36  $row = sqlQuery("SELECT pd.*,pao.portal_username,pao.portal_pwd,pao.portal_pwd_status FROM patient_data AS pd LEFT OUTER JOIN patient_access_" . add_escape_custom($portalsite) . "site AS pao ON pd.pid=pao.pid WHERE pd.pid=?",array($pid));
  37
  38 function generatePassword($length=6, $strength=1) {
  39         $consonants = 'bdghjmnpqrstvzacefiklowxy';
  40         $numbers = '0234561789';
  41         $specials = '@#$%';
  42
  43
  44         $password = '';
  45         $alt = time() % 2;
  46         for ($i = 0; $i < $length/3; $i++) {
  47                 if ($alt == 1) {
  48                         $password .= $consonants[(rand() % strlen($consonants))].$numbers[(rand() % strlen($numbers))].$specials[(rand() % strlen($specials))];
  49                         $alt = 0;
  50                 } else {
  51                         $password .= $numbers[(rand() % strlen($numbers))].$specials[(rand() % strlen($specials))].$consonants[(rand() % strlen($consonants))];
  52                         $alt = 1;
  53                 }
  54         }
  55         return $password;
  56 }
  57
  58 function validEmail($email){
  59     if(preg_match("/^[_a-z0-9-]+(\.[_a-z0-9-]+)*@[a-z0-9-]+(\.[a-z0-9-]+)*(\.[a-z]{2,3})$/i", $email)) {
  60     return true;
  61     }
  62     return false;
  63 }
  64
  65 function messageCreate($uname,$pass,$site){
  66     $message = htmlspecialchars( xl("Patient Portal Web Address"),ENT_NOQUOTES) . ":<br>";
  67     if ($site == "on") {
  68         if ($GLOBALS['portal_onsite_enable']) {
  69             $message .= "<a href='" . htmlspecialchars($GLOBALS['portal_onsite_address'],ENT_QUOTES) . "'>" .
  70                     htmlspecialchars($GLOBALS['portal_onsite_address'],ENT_NOQUOTES) . "</a><br>";
  71         }
  72         if ($GLOBALS['portal_onsite_two_enable']) {
  73             $message .= "<a href='" . htmlspecialchars($GLOBALS['portal_onsite_two_address'],ENT_QUOTES) . "'>" .
  74                     htmlspecialchars($GLOBALS['portal_onsite_two_address'],ENT_NOQUOTES) . "</a><br>";
  75         }
  76         $message .= "<br>";
  77     } // $site == "off"
  78     else {
  79         $offsite_portal_patient_link = $GLOBALS['portal_offsite_address_patient_link'] ?  htmlspecialchars($GLOBALS['portal_offsite_address_patient_link'],ENT_QUOTES) : htmlspecialchars("https://mydocsportal.com",ENT_QUOTES);
  80         $message .= "<a href='" . $offsite_portal_patient_link . "'>" .
  81                     $offsite_portal_patient_link . "</a><br><br>";
  82         $message .= htmlspecialchars(xl("Provider Id"),ENT_NOQUOTES) . ": " .
  83                     htmlspecialchars($GLOBALS['portal_offsite_providerid'],ENT_NOQUOTES) . "<br><br>";
  84     }
  85
  86         $message .= htmlspecialchars(xl("User Name"),ENT_NOQUOTES) . ": " .
  87                     htmlspecialchars($uname,ENT_NOQUOTES) . "<br><br>" .
  88                     htmlspecialchars(xl("Password"),ENT_NOQUOTES) . ": " .
  89                     htmlspecialchars($pass,ENT_NOQUOTES) . "<br><br>";
  90     return $message;
  91 }
  92
  93 function emailLogin($patient_id,$message){
  94     $patientData = sqlQuery("SELECT * FROM `patient_data` WHERE `pid`=?", array($patient_id) );
  95     if ( $patientData['hipaa_allowemail'] != "YES" || empty($patientData['email']) || empty($GLOBALS['patient_reminder_sender_email']) ) {
  96         return false;
  97     }
  98     if (!(validEmail($patientData['email']))) {
  99         return false;
 100     }
 101     if (!(validEmail($GLOBALS['patient_reminder_sender_email']))) {
 102         return false;
 103     }
 104
 105     $mail = new MyMailer();
 106     $pt_name=$patientData['fname'].' '.$patientData['lname'];
 107     $pt_email=$patientData['email'];
 108     $email_subject=xl('Access Your Patient Portal');
 109     $email_sender=$GLOBALS['patient_reminder_sender_email'];
 110     $mail->AddReplyTo($email_sender, $email_sender);
 111     $mail->SetFrom($email_sender, $email_sender);
 112     $mail->AddAddress($pt_email, $pt_name);
 113     $mail->Subject = $email_subject;
 114     $mail->MsgHTML("<html><body><div class='wrapper'>".$message."</div></body></html>");
 115     $mail->IsHTML(true);
 116     $mail->AltBody = $message;
 117
 118     if ($mail->Send()) {
 119         return true;
 120     } else {
 121         $email_status = $mail->ErrorInfo;
 122         error_log("EMAIL ERROR: ".$email_status,0);
 123         return false;
 124     }
 125 }
 126
 127 function displayLogin($patient_id,$message,$emailFlag){
 128     $patientData = sqlQuery("SELECT * FROM `patient_data` WHERE `pid`=?", array($patient_id) );
 129     if ($emailFlag) {
 130         $message = "<br><br>" .
 131                    htmlspecialchars(xl("Email was sent to following address"),ENT_NOQUOTES) . ": " .
 132                    htmlspecialchars($patientData['email'],ENT_NOQUOTES) . "<br><br>" .
 133                    $message;
 134     }
 135     echo "<html><body onload='top.printLogPrint(window);'>" . $message . "</body></html>";
 136 }
 137
 138 if(isset($_REQUEST['form_save']) && $_REQUEST['form_save']=='SUBMIT'){
 139     require_once("$srcdir/authentication/common_operations.php");
 140
 141     $clear_pass=$_REQUEST['pwd'];
 142
 143     $res = sqlStatement("SELECT * FROM patient_access_" . add_escape_custom($portalsite) . "site WHERE pid=?",array($pid));
 144     $query_parameters=array($_REQUEST['uname']);
 145     $salt_clause="";
 146     if($portalsite=='on')
 147     {
 148         // For onsite portal create a blowfish based hash and salt.
 149         $new_salt = oemr_password_salt();
 150         $salt_clause = ",portal_salt=? ";
 151         array_push($query_parameters,oemr_password_hash($clear_pass,$new_salt),$new_salt);
 152     }
 153     else
 154     {
 155         // For offsite portal still create and SHA1 hashed password
 156         // When offsite portal is updated to handle blowfish, then both portals can use the same execution path.
 157         array_push($query_parameters,SHA1($clear_pass));
 158     }
 159     array_push($query_parameters,$pid);
 160     if(sqlNumRows($res)){
 161     sqlStatement("UPDATE patient_access_" . add_escape_custom($portalsite) . "site SET portal_username=?,portal_pwd=?,portal_pwd_status=0 " . $salt_clause . " WHERE pid=?",$query_parameters);
 162     }
 163     else{
 164     sqlStatement("INSERT INTO patient_access_" . add_escape_custom($portalsite) . "site SET portal_username=?,portal_pwd=?,portal_pwd_status=0" . $salt_clause . " ,pid=?",$query_parameters);
 165     }
 166
 167     // Create the message
 168     $message = messageCreate($_REQUEST['uname'],$clear_pass,$portalsite);
 169     // Email and display/print the message
 170     if ( emailLogin($pid,$message) ) {
 171         // email was sent
 172         displayLogin($pid,$message,true);
 173     }
 174     else {
 175         // email wasn't sent
 176         displayLogin($pid,$message,false);
 177     }
 178     exit;
 179 } ?>
 180
 181 <html>
 182 <head>
 183 <link rel="stylesheet" href="<?php echo $css_header;?>" type="text/css">
 184
 185 <script type="text/javascript" src="<?php echo $GLOBALS['assets_static_relative']; ?>/jquery-min-1-7-2/index.js"></script>
 186 <script type="text/javascript">
 187 function transmit(){
 188
 189                 // get a public key to encrypt the password info and send
 190                 document.getElementById('form_save').value='SUBMIT';
 191                 document.forms[0].submit();
 192 }
 193 </script>
 194 </head>
 195 <body class="body_top">
 196     <form name="portallogin" action="" method="POST">
 197     <table align="center" style="margin-top:10px">
 198         <tr class="text">
 199             <th colspan="5" align="center"><?php echo htmlspecialchars(xl("Generate Username And Password For")." ".$row['fname'],ENT_QUOTES);?></th>
 200         </tr>
 201         <?php
 202                 if($portalsite == 'off'){
 203         ?>
 204         <tr class="text">
 205             <td><?php echo htmlspecialchars(xl('Provider Id').':',ENT_QUOTES);?></td>
 206             <td><span><?php echo htmlspecialchars($GLOBALS['portal_offsite_providerid'],ENT_QUOTES);?></span></td>
 207         </tr>
 208         <?php
 209                 }
 210         ?>
 211         <tr class="text">
 212             <td><?php echo htmlspecialchars(xl('User Name').':',ENT_QUOTES);?></td>
 213             <td><input type="text" name="uname" value="<?php if($row['portal_username']) echo htmlspecialchars($row['portal_username'],ENT_QUOTES); else echo htmlspecialchars($row['fname'].$row['id'],ENT_QUOTES);?>" size="10" readonly></td>
 214         </tr>
 215         <tr class="text">
 216             <td><?php echo htmlspecialchars(xl('Password').':',ENT_QUOTES);?></td>
 217             <?php
 218             $pwd = generatePassword();
 219             ?>
 220             <td><input type="text" name="pwd" id="pwd" value="<?php echo htmlspecialchars($pwd,ENT_QUOTES);?>" size="10"/>
 221             </td>
 222             <td><a href="#" class="css_button" onclick="top.restoreSession(); javascript:document.location.reload()"><span><?php echo htmlspecialchars(xl('Change'),ENT_QUOTES);?></span></a></td>
 223         </tr>
 224         <tr class="text">
 225             <td><input type="hidden" name="form_save" id="form_save"></td>
 226             <td colspan="5" align="center">
 227                 <a href="#" class="css_button" onclick="return transmit()"><span><?php echo htmlspecialchars(xl('Save'),ENT_QUOTES);?></span></a>
 228                 <input type="hidden" name="form_cancel" id="form_cancel">
 229                 <a href="#" class="css_button" onclick="top.restoreSession(); parent.$.fn.fancybox.close();"><span><?php echo htmlspecialchars(xl('Cancel'),ENT_QUOTES);?></span></a>
 230             </td>
 231         </tr>
 232     </table>
 233     </form>
 234 </body>