From 21e15cce4507d36c7ffd234f2c4f034b38d1087e Mon Sep 17 00:00:00 2001 From: bradymiller Date: Mon, 2 Aug 2010 20:26:55 +0000 Subject: [PATCH] Clean up and secure the messages-pnotes scripts and related functions-scripts (remove fake globals, run global undomagicquotes, integrate binding into sql queries to prevent sql-injection and integrate htmlspecialchars to prevent xss attacks). Also fixed several bugs and modularized some of the messages.php script. --- interface/main/messages/lab_results_messages.php | 5 +- interface/main/messages/messages.php | 194 ++++++++++++--------- interface/patient_file/summary/pnotes.php | 60 ++++--- interface/patient_file/summary/pnotes_fragment.php | 2 +- interface/patient_file/summary/pnotes_full.php | 128 ++++++++------ interface/patient_file/summary/pnotes_full_add.php | 85 ++++----- interface/patient_file/summary/pnotes_print.php | 22 ++- library/gprelations.inc.php | 8 +- library/pnotes.inc | 49 ++++-- 9 files changed, 324 insertions(+), 229 deletions(-) diff --git a/interface/main/messages/lab_results_messages.php b/interface/main/messages/lab_results_messages.php index 42154c199..21ebd0b4e 100644 --- a/interface/main/messages/lab_results_messages.php +++ b/interface/main/messages/lab_results_messages.php @@ -12,6 +12,7 @@ require_once("$srcdir/auth.inc"); include_once("$srcdir/formdata.inc.php"); function lab_results_messages($set_pid, $rid, $provider_id="") { + global $userauthorized; if ($provider_id != "") { $where = "AND id = '".$provider_id."'"; } @@ -37,7 +38,6 @@ function lab_results_messages($set_pid, $rid, $provider_id="") { if ($thisauth) { // Send lab result message to the ordering provider when there is a new lab report. - $userauthorized = formData("userauthorized"); $pname = getPatientName($set_pid); $link = "here"; @@ -45,8 +45,7 @@ function lab_results_messages($set_pid, $rid, $provider_id="") { $note_type = "Lab Results"; $message_status = "New"; // Add pnote. - $noteid = addPnote($set_pid, $note, $userauthorized, '1', $note_type, $user_detail['username']); - sqlQ("update pnotes set message_status='".$message_status."' where id = '$noteid'"); + $noteid = addPnote($set_pid, $note, $userauthorized, '1', $note_type, $user_detail['username'], '', $message_status); } } } diff --git a/interface/main/messages/messages.php b/interface/main/messages/messages.php index 7be5f8e91..0d1361097 100644 --- a/interface/main/messages/messages.php +++ b/interface/main/messages/messages.php @@ -5,6 +5,14 @@ // as published by the Free Software Foundation; either version 2 // of the License, or (at your option) any later version. +//SANITIZE ALL ESCAPES +$sanitize_all_escapes=true; +// + +//STOP FAKE REGISTER GLOBALS +$fake_register_globals=false; +// + require_once("../../globals.php"); require_once("$srcdir/pnotes.inc"); require_once("$srcdir/patient.inc"); @@ -29,82 +37,83 @@ require_once("$srcdir/formatting.inc.php"); (".xl('Just Mine').")"; + $lnkvar="'messages.php?show_all=no' name='Just Mine' onclick=\"top.restoreSession()\"> (".htmlspecialchars( xl('Just Mine'), ENT_NOQUOTES).")"; } else { $showall = "no"; - $lnkvar="'messages.php?show_all=yes' name='See All' onclick=\"top.restoreSession()\"> (".xl('See All').")"; + $lnkvar="'messages.php?show_all=yes' name='See All' onclick=\"top.restoreSession()\"> (".htmlspecialchars( xl('See All'), ENT_NOQUOTES).")"; } } ?> -

+

- + "; ?>
- : + : 1,'field_id'=>'note_type','list_id'=>'note_type','empty_title'=>'SKIP','order_by'=>'title'), $title); ?>     - : + :
- :'>: - title='' /> - + title='' /> +     - : + : ".$body.""; } ?> - +
- - - + + + - - + +
@@ -216,7 +225,7 @@ $(document).ready(function(){ var NewNote = function () { top.restoreSession(); if (document.forms[0].reply_to.value.length == 0) { - alert(''); + alert(''); } else { @@ -226,7 +235,7 @@ $(document).ready(function(){ var PrintNote = function () { top.restoreSession(); - window.open('../../patient_file/summary/pnotes_print.php?noteid=', '_blank', 'resizable=1,scrollbars=1,width=600,height=500'); + window.open('../../patient_file/summary/pnotes_print.php?noteid=', '_blank', 'resizable=1,scrollbars=1,width=600,height=500'); } var SaveNote = function () { @@ -257,14 +266,14 @@ $(document).ready(function(){ \"".xl('Sort"; + $sortlink[$i] = "\"".htmlspecialchars("; } for($i = 0; $i < count($sort); $i++) { if($sortby == $sort[$i]) { switch($sortorder) { - case "asc" : $sortlink[$i] = "\"".xl('Sort"; break; - case "desc" : $sortlink[$i] = "\"".xl('Sort"; break; + case "asc" : $sortlink[$i] = "\"".htmlspecialchars("; break; + case "desc" : $sortlink[$i] = "\"".htmlspecialchars("; break; } break; } } // Manage page numbering and display beneath the Messages table. $listnumber = 25; $show_all=='yes' ? $usrvar='_%' : $usrvar=$_SESSION['authUser'] ; - $sql = "select pnotes.id, pnotes.user, pnotes.pid, pnotes.title, pnotes.date, pnotes.message_status, users.fname, users.lname, patient_data.fname, patient_data.lname FROM ((pnotes JOIN users ON pnotes.user = users.username) JOIN patient_data ON pnotes.pid = patient_data.pid) where pnotes.message_status != 'Done' and pnotes.assigned_to LIKE '$usrvar'"; - $result = sqlStatement($sql); + $sql = "select pnotes.id, pnotes.user, pnotes.pid, pnotes.title, pnotes.date, " . + "pnotes.message_status, users.fname, users.lname, patient_data.fname, " . + "patient_data.lname FROM ((pnotes JOIN users ON pnotes.user = users.username) " . + "JOIN patient_data ON pnotes.pid = patient_data.pid) where pnotes.message_status != 'Done' " . + "and pnotes.deleted != '1' and pnotes.assigned_to LIKE ?"; + $result = sqlStatement($sql, array($usrvar) ); if(sqlNumRows($result) != 0) { $total = sqlNumRows($result); } @@ -326,17 +339,31 @@ else { -  ".xl('From')." $sortlink[0] -  ".xl('Patient')." $sortlink[1] -  ".xl('Type')." $sortlink[2] -  ".xl('Date')." $sortlink[3] -  ".xl('Status')." $sortlink[4] +  " . + htmlspecialchars( xl('From'), ENT_NOQUOTES) . " $sortlink[0] +  " . + htmlspecialchars( xl('Patient'), ENT_NOQUOTES) . " $sortlink[1] +  " . + htmlspecialchars( xl('Type'), ENT_NOQUOTES) . " $sortlink[2] +  " . + htmlspecialchars( xl('Date'), ENT_NOQUOTES) . " $sortlink[3] +  " . + htmlspecialchars( xl('Status'), ENT_NOQUOTES) . " $sortlink[4] "; // Display the Messages table body. $count = 0; $show_all=='yes' ? $usrvar='_%' : $usrvar=$_SESSION['authUser'] ; - $sql = "select pnotes.id, pnotes.user, pnotes.pid, pnotes.title, pnotes.date, pnotes.message_status, users.fname AS users_fname, users.lname AS users_lname, patient_data.fname AS patient_data_fname, patient_data.lname AS patient_data_lname FROM ((pnotes JOIN users ON pnotes.user = users.username) JOIN patient_data ON pnotes.pid = patient_data.pid) where pnotes.message_status != 'Done' and pnotes.assigned_to LIKE '$usrvar' order by $sortby $sortorder limit $begin, $listnumber"; - $result = sqlStatement($sql); + $sql = "select pnotes.id, pnotes.user, pnotes.pid, pnotes.title, " . + "pnotes.date, pnotes.message_status, users.fname " . + "AS users_fname, users.lname AS users_lname, patient_data.fname " . + "AS patient_data_fname, patient_data.lname AS patient_data_lname " . + "FROM ((pnotes JOIN users ON pnotes.user = users.username) " . + "JOIN patient_data ON pnotes.pid = patient_data.pid) " . + "where pnotes.message_status != 'Done' and pnotes.deleted != '1' " . + "and pnotes.assigned_to LIKE ? " . + "order by ".add_escape_custom($sortby)." ".add_escape_custom($sortorder). + " limit ".add_escape_custom($begin).", ".add_escape_custom($listnumber); + $result = sqlStatement($sql, array($usrvar) ); while ($myrow = sqlFetchArray($result)) { $name = $myrow['user']; $name = $myrow['users_lname']; @@ -351,12 +378,19 @@ else { $count++; echo " - -
$name
-
$patient
-
".$myrow['title']."
-
" . oeFormatShortDate(substr($myrow['date'], 0, strpos($myrow['date'], " "))) . "
-
".$myrow['message_status']."
+ +
" . + htmlspecialchars( $name, ENT_NOQUOTES) . "
+
" . + htmlspecialchars( $patient, ENT_NOQUOTES) . "
+
" . + htmlspecialchars( $myrow['title'], ENT_NOQUOTES) . "
+
" . + htmlspecialchars( oeFormatShortDate(substr($myrow['date'], 0, strpos($myrow['date'], " "))), ENT_NOQUOTES) . "
+
" . + htmlspecialchars( $myrow['message_status'], ENT_NOQUOTES) . "
"; } // Display the Messages table footer. @@ -364,14 +398,16 @@ else { - +
".xl('Add New')."   ".xl('Delete')."" . + htmlspecialchars( xl('Add New'), ENT_NOQUOTES) . "   " . + htmlspecialchars( xl('Delete'), ENT_NOQUOTES) . " $prevlink   $end of $total   $nextlink

"; ?>