security fix (#1388)
[openemr.git] / custom / chart_tracker.php
blobb930348b56c1172d480241405407d5a94f75b7c5
1 <?php
2 /**
3 * The Chart Tracker feature facilitates the old traditional paper charts updates.
4 * This feature requires a new list:
5 * <pre>
6 * INSERT INTO list_options VALUES ('lists','chartloc','Chart Storage Locations',51,0,0);
7 * </pre>
9 * @package OpenEMR
10 * @link http://www.open-emr.org
11 * @author Rod Roark <rod@sunsetsystems.com>
12 * @author Brady Miller <brady.g.miller@gmail.com>
13 * @author Roberto Vasquez <robertogagliotta@gmail.com>
14 * @Copyright (C) 2008-2012 Rod Roark <rod@sunsetsystems.com>
15 * @Copyright (C) 2011-2017 Brady Miller <brady.g.miller@gmail.com>
16 * @Copyright (C) 2017 Roberto Vasquez <robertogagliotta@gmail.com>
22 require_once("../interface/globals.php");
23 require_once("$srcdir/acl.inc");
24 require_once("$srcdir/options.inc.php");
26 use OpenEMR\Core\Header;
27 use OpenEMR\Entities\ChartTracker;
28 use OpenEMR\Services\ChartTrackerService;
29 use OpenEMR\Services\UserService;
31 $form_newid = isset($_POST['form_newid' ]) ? trim($_POST['form_newid' ]) : '';
32 $form_curpid = isset($_POST['form_curpid' ]) ? trim($_POST['form_curpid' ]) : '';
33 $form_curid = isset($_POST['form_curid' ]) ? trim($_POST['form_curid' ]) : '';
34 $form_newloc = isset($_POST['form_newloc' ]) ? trim($_POST['form_newloc' ]) : '';
35 $form_newuser = isset($_POST['form_newuser']) ? trim($_POST['form_newuser']) : '';
37 if ($form_newuser) {
38 $form_newloc = '';
39 } else {
40 $form_newuser = 0;
43 <html>
45 <head>
46 <?php Header::setupHeader(); ?>
47 <title><?php echo xlt('Chart Tracker'); ?></title>
49 <script language="JavaScript">
51 function locationSelect() {
52 var f = document.forms[0];
53 var i = f.form_newloc.selectedIndex;
54 if (i > 0) {
55 f.form_newuser.selectedIndex = 0;
59 function userSelect() {
60 var f = document.forms[0];
61 var i = f.form_newuser.selectedIndex;
62 if (i > 0) {
63 f.form_newloc.selectedIndex = 0;
67 </script>
69 </head>
71 <body class="body_top">
72 <div class="container">
74 <div class="row">
75 <div class="col-xs-12">
76 <div class="page-header">
77 <h1><?php echo xlt('Chart Tracker'); ?></h1>
78 </div>
79 </div>
80 </div>
82 <form method='post' action='chart_tracker.php' class='form-horizontal' onsubmit='return top.restoreSession()'>
84 <?php
85 // This is the place for status messages.
87 if ($form_newloc || $form_newuser) {
88 $tracker = new ChartTracker();
89 $tracker->setPid($form_curpid);
90 $tracker->setWhen(new \DateTime(date('Y-m-d H:i:s')));
91 $tracker->setUserId($form_newuser);
92 $tracker->setLocation($form_newloc);
93 $chartTrackerService = new ChartTrackerService();
94 $chartTrackerService->trackPatientLocation($tracker);
95 echo "<div class='alert alert-success'>" . xlt('Save Successful for chart ID') . " " . "'" . text($form_curid) . "'.</div>";
98 $row = array();
100 if ($form_newid) {
101 // Find out where the chart is now.
102 $query = "SELECT pd.pid, pd.pubpid, pd.fname, pd.mname, pd.lname, " .
103 "pd.ss, pd.DOB, ct.ct_userid, ct.ct_location, ct.ct_when " .
104 "FROM patient_data AS pd " .
105 "LEFT OUTER JOIN chart_tracker AS ct ON ct.ct_pid = pd.pid " .
106 "WHERE pd.pubpid = ? " .
107 "ORDER BY pd.pid ASC, ct.ct_when DESC LIMIT 1";
108 $row = sqlQuery($query, array($form_newid));
109 if (empty($row)) {
110 echo "<div class='alert alert-danger'>" . xlt('Chart ID') . " " . "'" . text($form_newid) . "' " . xlt('not found') . "!</div>";
115 <?php
116 if (!empty($row)) {
117 $userService = new UserService();
118 $ct_userid = $row['ct_userid'];
119 $ct_location = $row['ct_location'];
120 $current_location = xlt('Unassigned');
121 if ($ct_userid) {
122 $user = $userService->getUser($ct_userid);
123 $current_location = text($user->getLname() . ", " . $user->getFname() . " " . $user->getMname() . " " . $row['ct_when']);
124 } else if ($ct_location) {
125 $current_location = generate_display_field(array('data_type'=>'1','list_id'=>'chartloc'), $ct_location);
129 <div class="row">
130 <div class="col-sm-6 well">
131 <div class="form-group">
132 <label for="form_pat_id" class='control-label col-sm-3'><?php echo xlt('Patient ID') . ":"; ?></label>
133 <div class='col-sm-9'>
134 <p class="form-control-static"><?php echo text($row['pid']) ?></p>
135 <input type='hidden' name='form_curpid' value='<?php echo attr($row['pid']); ?>' />
136 <input type='hidden' name='form_curid' value='<?php echo attr($row['pubpid']); ?>' />
137 </div>
138 </div>
139 <div class="form-group">
140 <label for="form_pat_id" class='control-label col-sm-3'><?php echo xlt('Name') . ":"; ?></label>
141 <div class='col-sm-9'>
142 <p class="form-control-static"><?php echo text($row['lname'] . ", " . $row['fname'] . " " . $row['mname']) ?></p>
143 </div>
144 </div>
145 <div class="form-group">
146 <label for="form_pat_id" class='control-label col-sm-3'><?php echo xlt('DOB') . ":"; ?></label>
147 <div class='col-sm-9'>
148 <p class="form-control-static"><?php echo text($row['DOB']) ?></p>
149 </div>
150 </div>
151 <div class="form-group">
152 <label for="form_pat_id" class='control-label col-sm-3'><?php echo xlt('SSN') . ":"; ?></label>
153 <div class='col-sm-9'>
154 <p class="form-control-static"><?php echo text($row['ss']) ?></p>
155 </div>
156 </div>
157 <div class="form-group">
158 <label for="form_pat_id" class='control-label col-sm-3'><?php echo xlt('Current Location') . ":"; ?></label>
159 <div class='col-sm-9'>
160 <p class="form-control-static"><?php echo text($current_location) ?></p>
161 </div>
162 </div>
163 <div class="form-group">
164 <label for="form_curr_loc" class='control-label col-sm-3'><?php echo xlt('Check In To') . ":"; ?></label>
165 <div class='col-sm-9'>
166 <?php generate_form_field(array('data_type'=>1,'field_id'=>'newloc','list_id'=>'chartloc','empty_title'=>''), ''); ?>
167 </div>
168 </div>
169 <div class="form-group">
170 <label for="form_out_to" class='control-label col-sm-3'><?php echo xlt('Our Out To') . ":"; ?></label>
171 <div class='col-sm-9'>
172 <select name='form_newuser' class='form-control' onchange='userSelect()'>
173 <option value=''></option>
174 <?php
175 $users = $userService->getActiveUsers();
177 foreach ($users as $activeUser) {
178 echo " <option value='" . attr($activeUser->getId()) . "'";
179 echo ">" . text($activeUser->getLname()) . ', ' . text($activeUser->getFname()) . ' ' . text($activeUser->getMname()) .
180 "</option>\n";
183 </select>
184 </div>
185 </div>
186 <div class="form-group">
187 <div class="col-sm-offset-3 col-sm-9">
188 <button type='submit' class='btn btn-default btn-save' name='form_save'><?php echo xlt("Save"); ?></button>
189 </div>
190 </div>
191 </div>
194 <?php
197 <div class="row">
198 <div class="col-sm-6 well">
199 <div class="form-group">
200 <label for='form_newid' class='control-label col-sm-3'><?php echo xlt('New Patient ID') . ":"; ?></label>
201 <div class='col-sm-9'>
202 <input type='text' name='form_newid' id='form_newid' class='form-control' title='<?php echo xla('Type or scan the patient identifier here'); ?>'>
203 </div>
204 </div>
205 <div class="form-group">
206 <div class='col-sm-offset-3 col-sm-9'>
207 <button type='submit' class='btn btn-default btn-search' name='form_lookup'><?php echo xlt("Look Up"); ?></button>
208 </div>
209 </div>
210 </div>
211 </form>
213 </div>
215 </body>
216 </html>