portal/import_template.php

   1 <?php
   2 /**
   3  * import_template.php
   4  *
   5  * @package   OpenEMR
   6  * @link      https://www.open-emr.org
   7  * @author    Jerry Padgett <sjpadgett@gmail.com>
   8  * @copyright Copyright (c) 2016-2017 Jerry Padgett <sjpadgett@gmail.com>
   9  * @license   https://github.com/openemr/openemr/blob/master/LICENSE GNU General Public License 3
  10  */
  11
  12
  13 require_once("../interface/globals.php");
  14
  15 if ($_POST['mode'] == 'get') {
  16     $rebuilt = validateFile($_POST['docid']);
  17     if ($rebuilt) {
  18         echo file_get_contents($rebuilt);
  19         exit();
  20     } else {
  21         die(xlt('Invalid File'));
  22     }
  23 } else if ($_POST['mode'] == 'save') {
  24     $rebuilt = validateFile($_POST['docid']);
  25     if ($rebuilt) {
  26         if (stripos($_POST['content'], "<?php") === false) {
  27             file_put_contents($rebuilt, $_POST['content']);
  28             exit(true);
  29         } else {
  30             die(xlt('Invalid Content'));
  31         }
  32     } else {
  33         die(xlt('Invalid File'));
  34     }
  35 } else if ($_POST['mode'] == 'delete') {
  36     $rebuilt = validateFile($_POST['docid']);
  37     if ($rebuilt) {
  38         unlink($rebuilt);
  39         exit(true);
  40     } else {
  41         die(xlt('Invalid File'));
  42     }
  43 }
  44
  45 // so it is an import
  46 if (!isset($_POST['up_dir'])) {
  47     define("UPLOAD_DIR", $GLOBALS['OE_SITE_DIR'] . '/documents/onsite_portal_documents/templates/');
  48 } else {
  49     if ($_POST['up_dir'] > 0) {
  50         define("UPLOAD_DIR", $GLOBALS['OE_SITE_DIR'] . '/documents/onsite_portal_documents/templates/' . convert_safe_file_dir_name($_POST['up_dir']) . '/');
  51     } else {
  52         define("UPLOAD_DIR", $GLOBALS['OE_SITE_DIR'] . '/documents/onsite_portal_documents/templates/');
  53     }
  54 }
  55
  56 if (!empty($_FILES["tplFile"])) {
  57     $tplFile = $_FILES["tplFile"];
  58
  59     if ($tplFile["error"] !== UPLOAD_ERR_OK) {
  60         header("refresh:2;url= import_template_ui.php");
  61         echo "<p>" . xlt("An error occurred: Missing file to upload: Use back button!") . "</p>";
  62         exit;
  63     }
  64
  65     // ensure a safe filename
  66     $name = preg_replace("/[^A-Z0-9._-]/i", "_", $tplFile["name"]);
  67     if (preg_match("/(.*)\.(php|php3|php4|php5|php7)$/i", $name) !== 0) {
  68         die(xlt('Executables not allowed'));
  69     }
  70     $parts = pathinfo($name);
  71     $name = $parts["filename"] . '.tpl';
  72     // don't overwrite an existing file
  73     while (file_exists(UPLOAD_DIR . $name)) {
  74         $i = rand(0, 128);
  75         $newname = $parts["filename"] . "-" . $i . "." . $parts["extension"] . ".replaced";
  76         rename(UPLOAD_DIR . $name, UPLOAD_DIR . $newname);
  77     }
  78
  79     // preserve file from temporary directory
  80     $success = move_uploaded_file($tplFile["tmp_name"], UPLOAD_DIR . $name);
  81     if (!$success) {
  82         echo "<p>" . xlt("Unable to save file: Use back button!") . "</p>";
  83         exit;
  84     }
  85
  86     // set proper permissions on the new file
  87     chmod(UPLOAD_DIR . $name, 0644);
  88     header("location: " . $_SERVER['HTTP_REFERER']);
  89     die();
  90 }
  91
  92 function validateFile($filename = '')
  93 {
  94     $knownPath = $GLOBALS['OE_SITE_DIR'] . '/documents/onsite_portal_documents/templates/'; // default path
  95     $unknown = str_replace("\\", "/", realpath($filename)); // normalize requested path
  96     $parts = pathinfo($unknown);
  97     $unkParts = explode('/', $parts['dirname']);
  98     $ptpid = $unkParts[count($unkParts) - 1]; // is this a patient or global template
  99     $ptpid = ($ptpid == 'templates') ? '' : ($ptpid . '/'); // last part should be pid or template
 100     $rebuiltPath = $knownPath . $ptpid . $parts['filename'] . '.tpl';
 101     if (file_exists($rebuiltPath) === false || $parts['extension'] != 'tpl') {
 102         redirect();
 103     } elseif (realpath($rebuiltPath) != realpath($filename)) { // these need to match to be valid request
 104         redirect();
 105     } elseif (stripos(realpath($filename), realpath($knownPath)) === false) { // this needs to pass be a valid request
 106         redirect();
 107     }
 108
 109     return $rebuiltPath;
 110 }
 111
 112 function redirect()
 113 {
 114     header('HTTP/1.0 404 Not Found');
 115     die();
 116 }