From 2832659d134dd690ea8441959eb3e79e782b043c Mon Sep 17 00:00:00 2001 From: bradymiller Date: Fri, 26 Feb 2016 02:33:54 -0800 Subject: [PATCH] Converted problem_encounter.php to standard security model, take 2. --- interface/patient_file/problem_encounter.php | 79 +++++++++++++++------------- 1 file changed, 42 insertions(+), 37 deletions(-) diff --git a/interface/patient_file/problem_encounter.php b/interface/patient_file/problem_encounter.php index a7a0208d1..f604cc655 100644 --- a/interface/patient_file/problem_encounter.php +++ b/interface/patient_file/problem_encounter.php @@ -5,6 +5,7 @@ * * Copyright (C) 2005 Rod Roark * Copyright (C) 2015 Roberto Vasquez + * Copyright (C) 2015 Brady Miller * * LICENSE: This program is free software; you can redistribute it and/or * modify it under the terms of the GNU General Public License @@ -20,9 +21,13 @@ * @package OpenEMR * @author Rod Roark * @author Roberto Vasquez + * @author Brady Miller * @link http://www.open-emr.org */ + $fake_register_globals=false; + $sanitize_all_escapes=true; + include_once("../globals.php"); include_once("$srcdir/patient.inc"); include_once("$srcdir/acl.inc"); @@ -39,7 +44,7 @@ if (!$thisauth) { echo "\n\n"; - echo "

" .xl('You are not authorized for this.'). "

\n"; + echo "

" .xlt('You are not authorized for this.'). "

\n"; echo "\n\n"; exit(); } @@ -71,28 +76,28 @@ } echo "\n"; exit(); } // get problems - $pres = sqlStatement("SELECT * FROM lists WHERE pid = $pid " . - "ORDER BY type, date"); + $pres = sqlStatement("SELECT * FROM lists WHERE pid = ? " . + "ORDER BY type, date", array($pid)); // get encounters - $eres = sqlStatement("SELECT * FROM form_encounter WHERE pid = $pid " . - "ORDER BY date DESC"); + $eres = sqlStatement("SELECT * FROM form_encounter WHERE pid = ? " . + "ORDER BY date DESC", array($pid)); // get problem/encounter relations - $peres = sqlStatement("SELECT * FROM issue_encounter WHERE pid = $pid"); + $peres = sqlStatement("SELECT * FROM issue_encounter WHERE pid = ?", array($pid)); ?> -<?php xl('Issues and Encounters','e'); ?> +<?php echo xlt('Issues and Encounters'); ?>