myportal/soap_service/server_audit.php

   1 <?php
   2 // +-----------------------------------------------------------------------------+
   3 // Copyright (C) 2011 Z&H Consultancy Services Private Limited <sam@zhservices.com>
   4 //
   5 //
   6 // This program is free software; you can redistribute it and/or
   7 // modify it under the terms of the GNU General Public License
   8 // as published by the Free Software Foundation; either version 2
   9 // of the License, or (at your option) any later version.
  10 //
  11 //
  12 // This program is distributed in the hope that it will be useful,
  13 // but WITHOUT ANY WARRANTY; without even the implied warranty of
  14 // MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  15 // GNU General Public License for more details.
  16 //
  17 //
  18 // A copy of the GNU General Public License is included along with this program:
  19 // openemr/interface/login/GnuGPL.html
  20 // For more information write to the Free Software
  21 // Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.
  22 //
  23 // Author:   Eldho Chacko <eldho@zhservices.com>
  24 //           Jacob T Paul <jacob@zhservices.com>
  25 //
  26 // +------------------------------------------------------------------------------+
  27
  28 //SANITIZE ALL ESCAPES
  29 $sanitize_all_escapes=true;
  30 //
  31
  32 //STOP FAKE REGISTER GLOBALS
  33 $fake_register_globals=false;
  34 //
  35
  36 require_once("server_mail.php");
  37
  38 class UserAudit extends UserMail{
  39
  40
  41
  42 //During auditing if a new patient demo is rejected will delete the patient from DB
  43
  44   public function delete_if_new_patient($var)
  45        {
  46               $data_credentials=$var[0];
  47         if(UserService::valid($data_credentials)=='oemruser'){
  48                 $audit_master_id = $var['audit_master_id'];
  49                  $qry = "select * from audit_master WHERE id=? and approval_status=1 and type=1";
  50                  $result=sqlStatement($qry,array($audit_master_id));
  51                  $rowfield = sqlFetchArray($result);
  52                  if($rowfield['pid']>0)
  53                   {
  54                         $pid=$rowfield['pid'];
  55                         $qry = "DELETE from  patient_data WHERE pid=?";
  56                         sqlStatement($qry,array($pid));
  57                         $qry = "DELETE  from employer_data WHERE pid=?";
  58                         sqlStatement($qry,array($pid));
  59                         $qry = "DELETE  from history_data WHERE pid=?";
  60                         sqlStatement($qry,array($pid));
  61                         $qry = "DELETE  from insurance_data WHERE pid=?";
  62                         sqlStatement($qry,array($pid));
  63                         $qry = "DELETE from patient_access_offsite WHERE  pid=? ";
  64                         sqlStatement($qry,array($pid));
  65                         $qry = "DELETE from openemr_postcalendar_events WHERE  pc_pid=? ";// appointments approved, but patient denied case.
  66                         sqlStatement($qry,array($pid));
  67                          $qry = "select * from documents_legal_master,documents_legal_detail   where dld_pid=?
  68                                 and dlm_document_id=dld_master_docid and  dlm_subcategory   not in (SELECT dlc_id FROM `documents_legal_categories`
  69                                 where dlc_category_name='Layout Signed' and dlc_category_type=2)";
  70                          $result=sqlStatement($qry,array($pid));
  71                          while($row_sql=sqlFetchArray($result))
  72                           {
  73                            @unlink('../documents/'.$row_sql['dld_filepath'].$row_sql['dld_filename']);
  74                           }
  75                         $qry = "DELETE  from documents_legal_detail WHERE dld_pid=?";
  76                         sqlStatement($qry,array($pid));
  77                         $qry = "DELETE from audit_details WHERE audit_master_id in
  78                                                                 (select id from audit_master WHERE pid=? )";//type and approval_status=1 is not called purposefully,so as to delete the appointments also
  79                         sqlStatement($qry,array($pid));
  80                         $qry = "DELETE from audit_master WHERE pid=?";//type and approval_status=1 is not called purposefully,so as to delete the appointments also
  81                         sqlStatement($qry,array($pid));
  82                   }
  83         }
  84         else{
  85                 throw new SoapFault("Server", "credentials failed");
  86         }
  87        }
  88
  89
  90 //update the audit master_table  with the status ie denied,approved etc.
  91
  92   public function update_audit_master($var)
  93        {
  94               $data_credentials=$var[0];
  95               if(UserService::valid($data_credentials)){
  96                $audit_master_id=$var['audit_master_id'];
  97                $approval_status=$var['approval_status'];
  98                $comments=$var['comments'];
  99                $user_id=$var['user_id'];
 100                sqlStatement("UPDATE audit_master SET approval_status=?, comments=?,modified_time=NOW(),user_id=? WHERE id=? ",array($approval_status,$comments,$user_id,$audit_master_id));
 101                    $dld_pid = sqlQuery("SELECT pid from audit_master WHERE id=?",array($audit_master_id));
 102                    sqlStatement("UPDATE documents_legal_detail SET dld_signed=? WHERE dld_pid=? AND dld_signed=0",array($approval_status,$dld_pid['pid']));
 103                   }
 104               else{
 105               throw new SoapFault("Server", "credentials failed");
 106               }
 107        }
 108
 109
 110
 111 // Will update the corresponding tables with the audited and approved data.
 112 //Appointments and Demos are updated from the audit_details table to the actual transaction tables
 113   public function update_audited_data($var)
 114        {
 115               $data_credentials=$var[0];
 116         $validtables = array("patient_data","employer_data","insurance_data","history_data","openemr_postcalendar_events","ar_session");
 117         if(UserService::valid($data_credentials)){
 118               $audit_master_id = $var['audit_master_id'];
 119               $res = sqlStatement("SELECT * FROM  audit_master  where id=? and  approval_status='1' and  type='3' ",array($audit_master_id));
 120               if(sqlNumRows($res)>0)//skip this function if type=3(only documents saved.)
 121                    {
 122                     return;
 123                    }
 124               $res = sqlStatement("SELECT DISTINCT ad.table_name,am.id,am.pid FROM audit_master as am,audit_details as ad WHERE am.id=ad.audit_master_id and am.approval_status in ('1','4') and am.id=?",array($audit_master_id));
 125               $tablecnt = sqlNumRows($res);
 126               while($row = sqlFetchArray($res)){
 127                 $pid=$row['pid'];
 128                      $resfield = sqlStatement("SELECT * FROM audit_details WHERE audit_master_id=? AND table_name=?",array($audit_master_id,$row['table_name']));
 129                      $table = $row['table_name'];
 130                      $cnt = 0;
 131                      foreach($validtables as $value){//Update will execute if and only if all tables are validtables
 132                             if($value==$table)
 133                             $cnt++;
 134                      }
 135                      if($cnt>0){
 136                             while($rowfield = sqlFetchArray($resfield)){
 137
 138                                   if($table=='patient_data'){
 139                                         $newdata['patient_data'][$rowfield['field_name']]=$rowfield['field_value'];
 140                                   }
 141
 142                                   if($table=='employer_data'){
 143                                         $newdata['employer_data'][$rowfield['field_name']]=$rowfield['field_value'];
 144                                   }
 145
 146                                   if($table=='insurance_data'){
 147                                         $ins1_type="primary";
 148                                         $ins2_type="secondary";
 149                                         $ins3_type="tertiary";
 150                                         for($i=1;$i<=3;$i++)
 151                                         {
 152                                                 $newdata[$rowfield['entry_identification']][$rowfield['field_name']]=$rowfield['field_value'];
 153                                         }
 154                                   }
 155
 156                                   if($table=='openemr_postcalendar_events'){
 157                                     $newdata['openemr_postcalendar_events'][$rowfield['field_name']]=$rowfield['field_value'];
 158                                   }
 159
 160                                   if($table=='ar_session'){
 161                                         $newdata['ar_session'][$rowfield['field_name']]=$rowfield['field_value'];
 162                                   }
 163
 164                             }
 165                             require_once("../../library/invoice_summary.inc.php");
 166                             require_once("../../library/options.inc.php");
 167                             require_once("../../library/acl.inc");
 168                             require_once("../../library/patient.inc");
 169                             if($table=='patient_data'){
 170                                $pdrow = sqlQuery("SELECT id from patient_data WHERE pid=?",array($pid));
 171                                $newdata['patient_data']['id']=$pdrow['id'];
 172                                updatePatientData($pid,$newdata['patient_data']);
 173                             }
 174                             elseif($table=='employer_data'){
 175                                updateEmployerData($pid,$newdata['employer_data']);
 176                             }
 177                             elseif($table=='insurance_data'){
 178                                     for($i=1;$i<=3;$i++){
 179                                             newInsuranceData(
 180                                               $pid,
 181                                               add_escape_custom($newdata[${ins.$i._type}]['type']),
 182                                               add_escape_custom($newdata[${ins.$i._type}]['provider']),
 183                                               add_escape_custom($newdata[${ins.$i._type}]['policy_number']),
 184                                               add_escape_custom($newdata[${ins.$i._type}]['group_number']),
 185                                               add_escape_custom($newdata[${ins.$i._type}]['plan_name']),
 186                                               add_escape_custom($newdata[${ins.$i._type}]['subscriber_lname']),
 187                                               add_escape_custom($newdata[${ins.$i._type}]['subscriber_mname']),
 188                                               add_escape_custom($newdata[${ins.$i._type}]['subscriber_fname']),
 189                                               add_escape_custom($newdata[${ins.$i._type}]['subscriber_relationship']),
 190                                               add_escape_custom($newdata[${ins.$i._type}]['subscriber_ss']),
 191                                               add_escape_custom($newdata[${ins.$i._type}]['subscriber_DOB']),
 192                                               add_escape_custom($newdata[${ins.$i._type}]['subscriber_street']),
 193                                               add_escape_custom($newdata[${ins.$i._type}]['subscriber_postal_code']),
 194                                               add_escape_custom($newdata[${ins.$i._type}]['subscriber_city']),
 195                                               add_escape_custom($newdata[${ins.$i._type}]['subscriber_state']),
 196                                               add_escape_custom($newdata[${ins.$i._type}]['subscriber_country']),
 197                                               add_escape_custom($newdata[${ins.$i._type}]['subscriber_phone']),
 198                                               add_escape_custom($newdata[${ins.$i._type}]['subscriber_employer']),
 199                                               add_escape_custom($newdata[${ins.$i._type}]['subscriber_employer_street']),
 200                                               add_escape_custom($newdata[${ins.$i._type}]['subscriber_employer_city']),
 201                                               add_escape_custom($newdata[${ins.$i._type}]['subscriber_employer_postal_code']),
 202                                               add_escape_custom($newdata[${ins.$i._type}]['subscriber_employer_state']),
 203                                               add_escape_custom($newdata[${ins.$i._type}]['subscriber_employer_country']),
 204                                               add_escape_custom($newdata[${ins.$i._type}]['copay']),
 205                                               add_escape_custom($newdata[${ins.$i._type}]['subscriber_sex']),
 206                                               add_escape_custom($newdata[${ins.$i._type}]['date']),
 207                                               add_escape_custom($newdata[${ins.$i._type}]['accept_assignment']));
 208                                     }
 209                             }
 210                             elseif($table=='openemr_postcalendar_events'){
 211                               sqlInsert("INSERT INTO openemr_postcalendar_events ( " .
 212                                     "pc_pid,pc_title,pc_time,pc_hometext,pc_eventDate,pc_endDate,pc_startTime,pc_endTime,pc_duration,pc_catid,pc_eventstatus,pc_aid,pc_facility" .
 213                                     ") VALUES ( " .
 214                                     "'" . add_escape_custom($pid)             . "', " .
 215                                     "'" . add_escape_custom($newdata['openemr_postcalendar_events']['pc_title'])           . "', " .
 216                                     "NOW(), "                                         .
 217                                     "'" . add_escape_custom($newdata['openemr_postcalendar_events']['pc_hometext']) . "', " .
 218                                     "'" . add_escape_custom($newdata['openemr_postcalendar_events']['pc_eventDate'])          . "', " .
 219                                     "'" . add_escape_custom($newdata['openemr_postcalendar_events']['pc_endDate'])                        . "', " .
 220                                     "'" . add_escape_custom($newdata['openemr_postcalendar_events']['pc_startTime'])     . "', " .
 221                                     "'" . add_escape_custom($newdata['openemr_postcalendar_events']['pc_endTime'])                   . "', " .
 222                                     "'" . add_escape_custom($newdata['openemr_postcalendar_events']['pc_duration']) . "', " .
 223                                     "'" . add_escape_custom($newdata['openemr_postcalendar_events']['pc_catid'])             . "', " .
 224                                     "1, " .
 225                                     "'" . add_escape_custom($newdata['openemr_postcalendar_events']['pc_aid'])."', " .
 226                                     "'" . add_escape_custom($newdata['openemr_postcalendar_events']['pc_facility'])               . "')"
 227                                 );
 228                             }
 229                                 elseif($table=='ar_session'){
 230                               sqlInsert("INSERT INTO ar_session ( " .
 231                                     "payer_id, user_id, reference, check_date, pay_total, modified_time, payment_type, description, post_to_date, patient_id, payment_method" .
 232                                     ") VALUES ( " .
 233                                     "'" . add_escape_custom($newdata['ar_session']['payer_id']) . "', " .
 234                                     "'" . add_escape_custom($newdata['ar_session']['user_id']) . "', " .
 235                                         "'" . add_escape_custom($newdata['ar_session']['reference']) . "', " .
 236                                     "NOW(), " .
 237                                     "'" . add_escape_custom($newdata['ar_session']['pay_total']) . "', " .
 238                                     "NOW(), " .
 239                                     "'" . add_escape_custom($newdata['ar_session']['payment_type']) . "', " .
 240                                     "'" . add_escape_custom($newdata['ar_session']['description']) . "', " .
 241                                         "NOW(), " .
 242                                     "'" . add_escape_custom($pid) . "', " .
 243                                     "'" . add_escape_custom($newdata['ar_session']['payment_method']) . "')"
 244                                   );
 245                             }
 246                          }
 247                      else{
 248                             throw new SoapFault("Server", "Table Not Supported error message");
 249                      }
 250               }
 251         }
 252         else{
 253                 throw new SoapFault("Server", "credentials failed");
 254         }
 255     }
 256
 257
 258 //Data from portal is inserted through this function. It will wait for audit and approval
 259 //according to the facility settings. audit_details is the child table of Audit_master
 260
 261   public function insert_to_be_audit_data($var)
 262        {
 263          global $pid;
 264          $data_credentials = $var[0];
 265          if(UserService::valid($data_credentials))
 266               {
 267                      $audit_master_id_to_delete=$var['audit_master_id_to_delete'];
 268                      $approval_status=$var['approval_status'];
 269                      $type=$var['type'];
 270                      $ip_address=$var['ip_address'];
 271                      $table_name_array=$var['table_name_array'];
 272                      $field_name_value_array=$var['field_name_value_array'];
 273                      $entry_identification_array=$var['entry_identification_array'];
 274
 275                      if($audit_master_id_to_delete){
 276                      $qry = "DELETE from audit_master WHERE id=?";
 277                      sqlStatement($qry,array($audit_master_id_to_delete));
 278                      $qry = "DELETE from audit_details WHERE audit_master_id=?";
 279                      sqlStatement($qry,array($audit_master_id_to_delete));
 280                      }
 281
 282                      $master_query="INSERT INTO audit_master SET
 283                        pid = ?,
 284                        approval_status = ?,
 285                        ip_address = ?,
 286                        type = ?";
 287                      $audit_master_id= sqlInsert($master_query,array($pid,$approval_status,$ip_address,$type));
 288                      $detail_query="INSERT INTO `audit_details` (`table_name`, `field_name`, `field_value`, `audit_master_id`, `entry_identification`) VALUES ";
 289                      $detail_query_array='';
 290                      foreach($table_name_array as $key=>$table_name)
 291                       {
 292                              foreach($field_name_value_array[$key] as $field_name=>$field_value)
 293                               {
 294                                      $detail_query.="(? ,? ,? ,? ,?),";
 295                                      $detail_query_array[] = $table_name;
 296                                      $detail_query_array[] = trim($field_name);
 297                                      $detail_query_array[] = trim($field_value);
 298                                      $detail_query_array[] = $audit_master_id;
 299                                      $detail_query_array[] = trim($entry_identification_array[$key]);
 300                               }
 301                       }
 302                      $detail_query = substr($detail_query, 0, -1);
 303                      $detail_query=$detail_query.';';
 304                      sqlInsert($detail_query,$detail_query_array);
 305                      if($var['auto_update']==1)
 306                      {
 307                             $var['audit_master_id'] = $audit_master_id;
 308                             UserAudit::update_audited_data($var);
 309                      }
 310               }
 311              else
 312               {
 313                      throw new SoapFault("Server", "credentials failed");
 314               }
 315     }
 316
 317
 318 //Data from portal is inserted through this function. It will wait for audit and approval
 319 //according to the facility settings. This is the master table entry.
 320
 321   public function insert_audit_master($var)
 322        {
 323         global $pid;
 324         $data_credentials=$var[0];
 325         if(UserService::valid($data_credentials))
 326                  {
 327                      $approval_status=$var['approval_status'];
 328                      $type=$var['type'];
 329                      $ip_address=$var['ip_address'];
 330
 331                      $master_query="INSERT INTO audit_master SET
 332                        pid = ?,
 333                        approval_status = ?,
 334                        ip_address = ?,
 335                        type =?";
 336                      $audit_master_id= sqlInsert($master_query,array($pid,$approval_status,$ip_address,$type));
 337                  }
 338                 else
 339                  {
 340                         throw new SoapFault("Server", "credentials failed");
 341                  }
 342        }
 343 }
 344 ?>