From 31b4c870ea84f411834abed13f313124afde3cbe Mon Sep 17 00:00:00 2001
From: Brady Miller <brady.g.miller@gmail.com>
Date: Fri, 12 Oct 2018 00:44:50 -0700
Subject: [PATCH] more bug fixes (#1917)

---
 interface/main/authorizations/authorizations.php   | 78 ++++++++++------------
 .../main/authorizations/authorizations_full.php    | 60 ++++++++---------
 interface/main/dated_reminders/dated_reminders.php | 40 +++++------
 .../main/dated_reminders/dated_reminders_add.php   | 60 ++++++++++-------
 .../main/dated_reminders/dated_reminders_log.php   | 55 +++++++--------
 library/dated_reminder_functions.php               | 36 ++++------
 6 files changed, 157 insertions(+), 172 deletions(-)

diff --git a/interface/main/authorizations/authorizations.php b/interface/main/authorizations/authorizations.php
index 91d3f1dc9..5090f3573 100644
--- a/interface/main/authorizations/authorizations.php
+++ b/interface/main/authorizations/authorizations.php
@@ -2,32 +2,22 @@
 /**
  * Authorizations script.
  *
- * LICENSE: This program is free software; you can redistribute it and/or
- * modify it under the terms of the GNU General Public License
- * as published by the Free Software Foundation; either version 2
- * of the License, or (at your option) any later version.
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
- * GNU General Public License for more details.
- * You should have received a copy of the GNU General Public License
- * along with this program. If not, see <http://opensource.org/licenses/gpl-license.php>;.
- *
- * @package OpenEMR
- * @author  Brady Miller <brady.g.miller@gmail.com>
- * @link    http://www.open-emr.org
+ * @package   OpenEMR
+ * @link      http://www.open-emr.org
+ * @author    Brady Miller <brady.g.miller@gmail.com>
+ * @copyright Copyright (c) 2018 Brady Miller <brady.g.miller@gmail.com>
+ * @license   https://github.com/openemr/openemr/blob/master/LICENSE GNU General Public License 3
  */
 
 
-
-include_once("../../globals.php");
-include_once("$srcdir/log.inc");
-include_once("$srcdir/billing.inc");
-include_once("$srcdir/forms.inc");
-include_once("$srcdir/transactions.inc");
-include_once("$srcdir/lists.inc");
-include_once("$srcdir/patient.inc");
-include_once("$srcdir/options.inc.php");
+require_once("../../globals.php");
+require_once("$srcdir/log.inc");
+require_once("$srcdir/billing.inc");
+require_once("$srcdir/forms.inc");
+require_once("$srcdir/transactions.inc");
+require_once("$srcdir/lists.inc");
+require_once("$srcdir/patient.inc");
+require_once("$srcdir/options.inc.php");
 
 // The number of authorizations to display in the quick view:
 // MAR 20041008 the full authorizations screen sucks... no links to the patient charts
@@ -41,6 +31,10 @@ $imauthorized = $_SESSION['userauthorized'] || $see_auth > 2;
 
 // This authorizes everything for the specified patient.
 if (isset($_GET["mode"]) && $_GET["mode"] == "authorize" && $imauthorized) {
+    if (!verifyCsrfToken($_GET["csrf_token_form"])) {
+        die(xlt('Authentication Error'));
+    }
+
     $retVal = getProviderId($_SESSION['authUser']);
     newEvent("authorize", $_SESSION["authUser"], $_SESSION["authProvider"], 1, $_GET["pid"]);
     sqlStatement("update billing set authorized=1 where pid=?", array($_GET["pid"]));
@@ -85,7 +79,7 @@ if (isset($_GET["mode"]) && $_GET["mode"] == "authorize" && $imauthorized) {
 <?php if ($imauthorized) { ?>
 <span class='title'>
 <a href='authorizations_full.php' onclick='top.restoreSession()'>
-<?php echo htmlspecialchars(xl('Authorizations'), ENT_NOQUOTES); ?> <span class='more'><?php echo htmlspecialchars($tmore, ENT_NOQUOTES); ?></span></a>
+<?php echo xlt('Authorizations'); ?> <span class='more'><?php echo text($tmore); ?></span></a>
 <?php
 }
 ?>
@@ -111,7 +105,7 @@ if ($imauthorized && $see_auth > 1) {
         if ($result1) {
             foreach ($result1 as $iter) {
                 $authorize{$iter{"pid"}}{"billing"} .= "<span class=text>" .
-                htmlspecialchars($iter{"code_text"} . " " . date("n/j/Y", strtotime($iter{"date"})), ENT_NOQUOTES) .
+                text($iter{"code_text"} . " " . date("n/j/Y", strtotime($iter{"date"}))) .
                 "</span><br>\n";
             }
         }
@@ -127,7 +121,7 @@ if ($imauthorized && $see_auth > 1) {
         if ($result2) {
             foreach ($result2 as $iter) {
                 $authorize{$iter{"pid"}}{"transaction"} .= "<span class=text>" .
-                htmlspecialchars($iter{"title"} . ": " . (strterm($iter{"body"}, 25)) . " " . date("n/j/Y", strtotime($iter{"date"})), ENT_NOQUOTES) .
+                text($iter{"title"} . ": " . (strterm($iter{"body"}, 25)) . " " . date("n/j/Y", strtotime($iter{"date"}))) .
                 "</span><br>\n";
             }
         }
@@ -144,7 +138,7 @@ if ($imauthorized && $see_auth > 1) {
             if ($result3) {
                 foreach ($result3 as $iter) {
                     $authorize{$iter{"pid"}}{"pnotes"} .= "<span class=text>" .
-                    htmlspecialchars((strterm($iter{"body"}, 25)) . " " . date("n/j/Y", strtotime($iter{"date"})), ENT_NOQUOTES) .
+                    text((strterm($iter{"body"}, 25)) . " " . date("n/j/Y", strtotime($iter{"date"}))) .
                     "</span><br>\n";
                 }
             }
@@ -161,7 +155,7 @@ if ($imauthorized && $see_auth > 1) {
         if ($result4) {
             foreach ($result4 as $iter) {
                 $authorize{$iter{"pid"}}{"forms"} .= "<span class=text>" .
-                htmlspecialchars($iter{"form_name"} . " " . date("n/j/Y", strtotime($iter{"date"})), ENT_NOQUOTES) .
+                text($iter{"form_name"} . " " . date("n/j/Y", strtotime($iter{"date"}))) .
                 "</span><br>\n";
             }
         }
@@ -187,7 +181,7 @@ if ($authorize) {
         if ($count >= $N) {
             print "<tr><td colspan='5' align='center'><a" .
             " href='authorizations_full.php?active=1' class='alert' onclick='top.restoreSession()'>" .
-            htmlspecialchars(xl('Some authorizations were not displayed. Click here to view all'), ENT_NOQUOTES) .
+            xlt('Some authorizations were not displayed. Click here to view all') .
             "</a></td></tr>\n";
             break;
         }
@@ -196,13 +190,13 @@ if ($authorize) {
         // Clicking the patient name will load both frames for that patient,
         // as demographics.php takes care of loading the bottom frame.
         echo "<a href='$rootdir/patient_file/summary/demographics.php?set_pid=" .
-        htmlspecialchars($ppid, ENT_QUOTES) . "' target='RTop' onclick='top.restoreSession()'>";
+            attr(urlencode($ppid)) . "' target='RTop' onclick='top.restoreSession()'>";
 
-        echo "<span class='bold'>" . htmlspecialchars($name{"fname"}, ENT_NOQUOTES) . " " .
-        htmlspecialchars($name{"lname"}, ENT_NOQUOTES) . "</span></a><br>" .
+        echo "<span class='bold'>" . text($name{"fname"}) . " " .
+        text($name{"lname"}) . "</span></a><br>" .
         "<a class=link_submit href='authorizations.php?mode=authorize" .
-        "&pid=" . htmlspecialchars($ppid, ENT_QUOTES) . "' onclick='top.restoreSession()'>" .
-        htmlspecialchars(xl('Authorize'), ENT_NOQUOTES) . "</a></td>\n";
+        "&pid=" . attr(urlencode($ppid)) . "&csrf_token_form=" . attr(urlencode(collectCsrfToken())) . "' onclick='top.restoreSession()'>" .
+        xlt('Authorize') . "</a></td>\n";
 
         /****
       //Michael A Rowley MD 20041012.
@@ -218,16 +212,16 @@ if ($authorize) {
             "select lname from users where id = ?",
             array($name['providerID'])
         ));
-      
-        echo "<td valign=top><span class=bold>".htmlspecialchars(xl('Provider'), ENT_NOQUOTES).":</span><span class=text><br>" .
-          htmlspecialchars($providerName{"lname"}, ENT_NOQUOTES) . "</td>\n";
-        echo "<td valign=top><span class=bold>".htmlspecialchars(xl('Billing'), ENT_NOQUOTES).":</span><span class=text><br>" .
+
+        echo "<td valign=top><span class=bold>".xlt('Provider').":</span><span class=text><br>" .
+          text($providerName{"lname"}) . "</td>\n";
+        echo "<td valign=top><span class=bold>".xlt('Billing').":</span><span class=text><br>" .
           $patient{"billing"} . "</td>\n";
-        echo "<td valign=top><span class=bold>".htmlspecialchars(xl('Transactions'), ENT_NOQUOTES).":</span><span class=text><br>" .
+        echo "<td valign=top><span class=bold>".xlt('Transactions').":</span><span class=text><br>" .
           $patient{"transaction"} . "</td>\n";
-        echo "<td valign=top><span class=bold>".htmlspecialchars(xl('Patient Notes'), ENT_NOQUOTES).":</span><span class=text><br>" .
+        echo "<td valign=top><span class=bold>".xlt('Patient Notes').":</span><span class=text><br>" .
           $patient{"pnotes"} . "</td>\n";
-        echo "<td valign=top><span class=bold>".htmlspecialchars(xl('Encounter Forms'), ENT_NOQUOTES).":</span><span class=text><br>" .
+        echo "<td valign=top><span class=bold>".xlt('Encounter Forms').":</span><span class=text><br>" .
           $patient{"forms"} . "</td>\n";
         echo "</tr>\n";
 
@@ -263,7 +257,7 @@ var EditNote = function(note) {
     location.href = "<?php echo $GLOBALS['webroot']; ?>/interface/patient_file/summary/pnotes_full.php?noteid=" + parts[1] + "&set_pid=" + parts[0] + "&active=1";
 <?php else : ?>
     // no-op
-    alert("<?php echo htmlspecialchars(xl('You do not have access to view/edit this note'), ENT_QUOTES); ?>");
+    alert("<?php echo xls('You do not have access to view/edit this note'); ?>");
 <?php endif; ?>
 }
 
diff --git a/interface/main/authorizations/authorizations_full.php b/interface/main/authorizations/authorizations_full.php
index 03edb97d2..1d30ccfe3 100644
--- a/interface/main/authorizations/authorizations_full.php
+++ b/interface/main/authorizations/authorizations_full.php
@@ -2,28 +2,22 @@
 /**
  * Authorizations full script.
  *
- * LICENSE: This program is free software; you can redistribute it and/or
- * modify it under the terms of the GNU General Public License
- * as published by the Free Software Foundation; either version 2
- * of the License, or (at your option) any later version.
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
- * GNU General Public License for more details.
- * You should have received a copy of the GNU General Public License
- * along with this program. If not, see <http://opensource.org/licenses/gpl-license.php>;.
- *
- * @package OpenEMR
- * @author  Brady Miller <brady.g.miller@gmail.com>
- * @link    http://www.open-emr.org
+ * @package   OpenEMR
+ * @link      http://www.open-emr.org
+ * @author    Brady Miller <brady.g.miller@gmail.com>
+ * @copyright Copyright (c) 2018 Brady Miller <brady.g.miller@gmail.com>
+ * @license   https://github.com/openemr/openemr/blob/master/LICENSE GNU General Public License 3
  */
 
 
-
-include_once("../../globals.php");
-include_once("$srcdir/patient.inc");
+require_once("../../globals.php");
+require_once("$srcdir/patient.inc");
 
 if (isset($_GET["mode"]) && $_GET["mode"] == "authorize") {
+    if (!verifyCsrfToken($_GET["csrf_token_form"])) {
+        die(xlt('Authentication Error'));
+    }
+
     newEvent("authorize", $_SESSION["authUser"], $_SESSION["authProvider"], 1, '', $_GET["pid"]);
     sqlStatement("update billing set authorized=1 where pid=?", array($_GET["pid"]));
     sqlStatement("update forms set authorized=1 where pid=?", array($_GET["pid"]));
@@ -39,8 +33,8 @@ if (isset($_GET["mode"]) && $_GET["mode"] == "authorize") {
 <body class="body_top">
 
 <a href="authorizations.php" onclick='top.restoreSession()'>
-<font class=title><?php echo htmlspecialchars(xl('Authorizations'), ENT_NOQUOTES); ?></font>
-<font class=more><?php echo htmlspecialchars($tback, ENT_NOQUOTES); ?></font></a>
+<font class=title><?php echo xlt('Authorizations'); ?></font>
+<font class=more><?php echo text($tback); ?></font></a>
 
 <?php
 //	billing
@@ -57,8 +51,8 @@ if ($res = sqlStatement("select *, concat(u.fname,' ', u.lname) as user from bil
     if ($result) {
         foreach ($result as $iter) {
             $authorize{$iter{"pid"}}{"billing"} .= "<span class=small>" .
-              htmlspecialchars($iter{"user"}, ENT_NOQUOTES) . ": </span><span class=text>" .
-              htmlspecialchars($iter{"code_text"} . " " . date("n/j/Y", strtotime($iter{"date"})), ENT_NOQUOTES) .
+              text($iter{"user"}) . ": </span><span class=text>" .
+              text($iter{"code_text"} . " " . date("n/j/Y", strtotime($iter{"date"}))) .
               "</span><br>\n";
         }
     }
@@ -73,8 +67,8 @@ if ($res = sqlStatement("select * from transactions where authorized=0 and group
     if ($result2) {
         foreach ($result2 as $iter) {
             $authorize{$iter{"pid"}}{"transaction"} .= "<span class=small>" .
-              htmlspecialchars($iter{"user"}, ENT_NOQUOTES) . ": </span><span class=text>" .
-              htmlspecialchars($iter{"title"} . ": " . strterm($iter{"body"}, 25) . " " . date("n/j/Y", strtotime($iter{"date"})), ENT_NOQUOTES) .
+              text($iter{"user"}) . ": </span><span class=text>" .
+              text($iter{"title"} . ": " . strterm($iter{"body"}, 25) . " " . date("n/j/Y", strtotime($iter{"date"}))) .
               "</span><br>\n";
         }
     }
@@ -91,8 +85,8 @@ if (empty($GLOBALS['ignore_pnotes_authorization'])) {
         if ($result3) {
             foreach ($result3 as $iter) {
                 $authorize{$iter{"pid"}}{"pnotes"} .= "<span class=small>" .
-                htmlspecialchars($iter{"user"}, ENT_NOQUOTES) . ": </span><span class=text>" .
-                htmlspecialchars(strterm($iter{"body"}, 25) . " " . date("n/j/Y", strtotime($iter{"date"})), ENT_NOQUOTES) .
+                text($iter{"user"}) . ": </span><span class=text>" .
+                text(strterm($iter{"body"}, 25) . " " . date("n/j/Y", strtotime($iter{"date"}))) .
                 "</span><br>\n";
             }
         }
@@ -108,8 +102,8 @@ if ($res = sqlStatement("select * from forms where authorized=0 and groupname=?"
     if ($result4) {
         foreach ($result4 as $iter) {
             $authorize{$iter{"pid"}}{"forms"} .= "<span class=small>" .
-              htmlspecialchars($iter{"user"}, ENT_NOQUOTES) . ": </span><span class=text>" .
-              htmlspecialchars($iter{"form_name"} . " " . date("n/j/Y", strtotime($iter{"date"})), ENT_NOQUOTES) .
+              text($iter{"user"}) . ": </span><span class=text>" .
+              text($iter{"form_name"} . " " . date("n/j/Y", strtotime($iter{"date"}))) .
               "</span><br>\n";
         }
     }
@@ -125,16 +119,16 @@ if ($authorize) {
     while (list($ppid,$patient) = each($authorize)) {
         $name = getPatientData($ppid);
 
-        echo "<tr><td valign=top><span class=bold>". htmlspecialchars($name{"fname"} . " " . $name{"lname"}, ENT_NOQUOTES) .
+        echo "<tr><td valign=top><span class=bold>". text($name{"fname"} . " " . $name{"lname"}) .
              "</span><br><a class=link_submit href='authorizations_full.php?mode=authorize&pid=" .
-             htmlspecialchars($ppid, ENT_QUOTES) . "' onclick='top.restoreSession()'>" . htmlspecialchars(xl('Authorize'), ENT_NOQUOTES) . "</a></td>\n";
-        echo "<td valign=top><span class=bold>".htmlspecialchars(xl('Billing'), ENT_NOQUOTES).
+             attr(urlencode($ppid)) . "&csrf_token_form=" . attr(urlencode(collectCsrfToken())) . "' onclick='top.restoreSession()'>" . xlt('Authorize') . "</a></td>\n";
+        echo "<td valign=top><span class=bold>".xlt('Billing').
              ":</span><span class=text><br>" . $patient{"billing"} . "</td>\n";
-        echo "<td valign=top><span class=bold>".htmlspecialchars(xl('Transactions'), ENT_NOQUOTES).
+        echo "<td valign=top><span class=bold>".xlt('Transactions').
              ":</span><span class=text><br>" . $patient{"transaction"} . "</td>\n";
-        echo "<td valign=top><span class=bold>".htmlspecialchars(xl('Patient Notes'), ENT_NOQUOTES).
+        echo "<td valign=top><span class=bold>".xlt('Patient Notes').
              ":</span><span class=text><br>" . $patient{"pnotes"} . "</td>\n";
-        echo "<td valign=top><span class=bold>".htmlspecialchars(xl('Encounter Forms'), ENT_NOQUOTES).
+        echo "<td valign=top><span class=bold>".xlt('Encounter Forms').
              ":</span><span class=text><br>" . $patient{"forms"} . "</td>\n";
         echo "</tr>\n";
         $count++;
diff --git a/interface/main/dated_reminders/dated_reminders.php b/interface/main/dated_reminders/dated_reminders.php
index 0defe6035..4068afbbd 100644
--- a/interface/main/dated_reminders/dated_reminders.php
+++ b/interface/main/dated_reminders/dated_reminders.php
@@ -2,24 +2,16 @@
 /**
  * Used for displaying dated reminders.
  *
- * Copyright (C) 2012 tajemo.co.za <http://www.tajemo.co.za/>
- *
- * LICENSE: This program is free software; you can redistribute it and/or
- * modify it under the terms of the GNU General Public License
- * as published by the Free Software Foundation; either version 3
- * of the License, or (at your option) any later version.
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
- * GNU General Public License for more details.
- * You should have received a copy of the GNU General Public License
- * along with this program. If not, see <http://opensource.org/licenses/gpl-license.php>;.
- *
- * @package OpenEMR
- * @author  Craig Bezuidenhout <http://www.tajemo.co.za/>
- * @link    http://www.open-emr.org
+ * @package   OpenEMR
+ * @link      http://www.open-emr.org
+ * @author    Craig Bezuidenhout <http://www.tajemo.co.za/>
+ * @author    Brady Miller <brady.g.miller@gmail.com>
+ * @copyright Copyright (c) 2012 tajemo.co.za <http://www.tajemo.co.za/>
+ * @copyright Copyright (c) 2018 Brady Miller <brady.g.miller@gmail.com>
+ * @license   https://github.com/openemr/openemr/blob/master/LICENSE GNU General Public License 3
  */
 
+
 // removed as jquery is already called in messages page (if you need to use jQuery, uncomment it futher down)
 require_once('../../globals.php');
 require_once("$srcdir/dated_reminder_functions.php");
@@ -43,6 +35,10 @@ require_once("$srcdir/dated_reminder_functions.php");
 // Javascript will send a post
 // ----------------------------------------------------------------------------
 if (isset($_POST['drR'])) {
+    if (!verifyCsrfToken($_POST["csrf_token_form"])) {
+        die(xlt('Authentication Error'));
+    }
+
     // set as processed
     setReminderAsProcessed($_POST['drR']);
     // ----- get updated data
@@ -108,12 +104,12 @@ if (isset($_POST['drR'])) {
                dlgopen('<?php echo $GLOBALS['webroot']; ?>/interface/main/dated_reminders/dated_reminders_add.php', '_drAdd', 700, 500);
              }else{
                top.restoreSession();
-               dlgopen('<?php echo $GLOBALS['webroot']; ?>/interface/main/dated_reminders/dated_reminders_add.php?mID='+id, '_drAdd', 700, 500);
+               dlgopen('<?php echo $GLOBALS['webroot']; ?>/interface/main/dated_reminders/dated_reminders_add.php?mID='+encodeURIComponent(id)+'&csrf_token_form=<?php echo attr(urlencode(collectCsrfToken())); ?>', '_drAdd', 700, 500);
              }
            }
 
            function updateme(id){
-             refreshInterval = <?php echo $updateDelay ?>;
+             refreshInterval = <?php echo attr($updateDelay); ?>;
              if(id > 0){
               $(".drTD").html('<p style="text-size:3em; margin-left:200px; color:black; font-weight:bold;"><?php echo xla("Processing") ?>...</p>');
              }
@@ -124,10 +120,14 @@ if (isset($_POST['drR'])) {
              // Send the skip_timeout_reset parameter to not count this as a manual entry in the
              //  timing out mechanism in OpenEMR.
              $.post("<?php echo $GLOBALS['webroot']; ?>/interface/main/dated_reminders/dated_reminders.php",
-               { drR: id, skip_timeout_reset: "1" },
+               {
+                drR: id,
+                skip_timeout_reset: "1",
+                csrf_token_form: "<?php echo attr(collectCsrfToken()); ?>"
+               },
                function(data) {
                 if(data == 'error'){
-                  alert("<?php echo addslashes(xl('Error Removing Message')) ?>");
+                  alert("<?php echo xls('Error Removing Message') ?>");
                 }else{
                   if(id > 0){
                     $(".drTD").html('<p style="text-size:3em; margin-left:200px; color:black; font-weight:bold;"><?php echo xla("Refreshing Reminders") ?> ...</p>');
diff --git a/interface/main/dated_reminders/dated_reminders_add.php b/interface/main/dated_reminders/dated_reminders_add.php
index 51aa67245..14fa7fde0 100644
--- a/interface/main/dated_reminders/dated_reminders_add.php
+++ b/interface/main/dated_reminders/dated_reminders_add.php
@@ -2,13 +2,13 @@
 /**
  * Used for adding dated reminders.
  *
- * @package OpenEMR
- * @author  Craig Bezuidenhout <http://www.tajemo.co.za/>
- * @author Brady Miller <brady.g.miller@gmail.com>
- * @copyright Copyright (C) 2012 tajemo.co.za <http://www.tajemo.co.za/>
- * @copyright Copyright (C) 2017 Brady Miller <brady.g.miller@gmail.com>
- * @link    http://www.open-emr.org
- */
+ * @package   OpenEMR
+ * @link      http://www.open-emr.org
+ * @author    Craig Bezuidenhout <http://www.tajemo.co.za/>
+ * @author    Brady Miller <brady.g.miller@gmail.com>
+ * @copyright Copyright (c) 2012 tajemo.co.za <http://www.tajemo.co.za/>
+ * @copyright Copyright (c) 2017-2018 Brady Miller <brady.g.miller@gmail.com>
+  */
 
 require_once("../../globals.php");
 require_once("$srcdir/dated_reminder_functions.php");
@@ -53,6 +53,10 @@ $max_reminder_words=160;
 
 // ---------------- FOR FORWARDING MESSAGES ------------->
 if (isset($_GET['mID']) and is_numeric($_GET['mID'])) {
+    if (!verifyCsrfToken($_GET["csrf_token_form"])) {
+        die(xlt('Authentication Error'));
+    }
+
     $forwarding = true;
     $this_message = getReminderById($_GET['mID']);
 }
@@ -63,6 +67,10 @@ if (isset($_GET['mID']) and is_numeric($_GET['mID'])) {
 
 // --- add reminders
 if ($_POST) {
+    if (!verifyCsrfToken($_POST["csrf_token_form"])) {
+        die(xlt('Authentication Error'));
+    }
+
 // --- initialize $output as blank
     $output = '';
     $output = '<div><fieldset id="error_info" style="border:1px solid #ff5d5a !Important; background-color: #ff5d5a !Important; color: #fff ! Important; font-weight: bold; font-family:sans-serif; border-radius:5px; padding:20px 5px !Important;">';// needs in-line styling because stylesheets not yet initialized
@@ -112,7 +120,7 @@ if ($_POST) {
       // ------------ 1) refresh parent window this updates if sent to self
             echo '  if (opener && !opener.closed && opener.updateme) opener.updateme("new");';
       // ------------ 2) communicate with user
-            echo '   alert("'.addslashes(xl('Reminder Sent')).'");';
+            echo '   alert("'.xls('Reminder Sent').'");';
       // ------------ 3) close this window
             echo '  dlgclose();';
             echo '</script></body></html>';
@@ -137,10 +145,10 @@ if ($_POST) {
 // get current patient, first check if this is a forwarded message, if it is use the original pid
 if (isset($this_message['pid'])) {
     $patientID = (isset($this_message['pid']) ? $this_message['pid'] : 0);
-    $reminder_title = xlt("Forward this Reminder");
+    $reminder_title = xl("Forward this Reminder");
 } else {
     $patientID = (isset($pid) ? $pid : 0);
-    $reminder_title = xlt("Send a Reminder");
+    $reminder_title = xl("Send a Reminder");
 }
     ?>
 <html>
@@ -237,7 +245,7 @@ if (isset($this_message['pid'])) {
         })
           // update word counter
           var messegeTextarea=$("#message")[0];
-          limitText(messegeTextarea.form.message,messegeTextarea.form.countdown,<?php echo $max_reminder_words ?>);
+          limitText(messegeTextarea.form.message,messegeTextarea.form.countdown,<?php echo attr($max_reminder_words); ?>);
 
         $('.datepicker').datetimepicker({
             <?php $datetimepicker_timepicker = false; ?>
@@ -287,7 +295,7 @@ if (isset($this_message['pid'])) {
             border-radius: 5px;
             padding: 20px 5px !Important;
         }
-    </style> 
+    </style>
 
   </head>
   <body class="body_top">
@@ -297,9 +305,11 @@ if (isset($this_message['pid'])) {
     <div class="container">
     <h4><?php echo attr($reminder_title) ?></h4>
     <form id="addDR"  class="form-horizontal" id="newMessage" method="post" onsubmit="return top.restoreSession()">
+    <input type="hidden" name="csrf_token_form" value="<?php echo attr(collectCsrfToken()); ?>" />
+
        <fieldset id='error-info' class='oe-error-modal' style="display:none">
         <div style="text-align:center;" id="errorMessage"></div>
-       </fieldset> 
+       </fieldset>
      <fieldset>
      <div class="col-xs-12" style="margin-top:20px;">
         <div class="form-group">
@@ -327,7 +337,7 @@ if (isset($this_message['pid'])) {
                             <?php //
                             $uSQL = sqlStatement('SELECT id, fname,	mname, lname  FROM  `users` WHERE  `active` = 1 AND `facility_id` > 0 AND id != ?', array(intval($_SESSION['authId'])));
                             for ($i=2; $uRow=sqlFetchArray($uSQL); $i++) {
-                                echo '<option value="',attr($uRow['id']),'">',text($uRow['fname'].' '.$uRow['mname'].' '.$uRow['lname']),'</option>';
+                                echo '<option value="' . attr($uRow['id']) . '">' . text($uRow['fname'] . ' ' . $uRow['mname'] . ' ' . $uRow['lname']) . '</option>';
                             }
                             ?>
                     </select>
@@ -339,7 +349,7 @@ if (isset($this_message['pid'])) {
             <div class="form-group">
                 <div class="checkbox col-xs-5 col-xs-offset-3">
                     <label>
-                        <input type="checkbox" name="sendSeperately" id="sendSeperately" title="<?php echo xlt('Selecting this will create a message that needs to be processed by each recipient individually (this is not a group task).') ?>" >  <i id="select-tooltip" class="fa fa-info-circle text-primary" aria-hidden="true" data-original-title="" title=""></i> <?php echo xlt('Each recipient must set their own messages as completed.') ?>
+                        <input type="checkbox" name="sendSeperately" id="sendSeperately" title="<?php echo xla('Selecting this will create a message that needs to be processed by each recipient individually (this is not a group task).') ?>" >  <i id="select-tooltip" class="fa fa-info-circle text-primary" aria-hidden="true" data-original-title="" title=""></i> <?php echo xlt('Each recipient must set their own messages as completed.') ?>
                     </label>
                 </div>
             </div>
@@ -395,16 +405,16 @@ if (isset($this_message['pid'])) {
             <div class="form-group">
                  <div class="col-xs-12">
                 <label class="control-label text-right" for="message"><?php echo xlt('Type Your message here');?>:</label>
-                <textarea onKeyDown="limitText(this.form.message,this.form.countdown,<?php echo $max_reminder_words ?>);"
-                    onKeyUp="limitText(this.form.message,this.form.countdown,<?php echo $max_reminder_words ?>);"
+                <textarea onKeyDown="limitText(this.form.message,this.form.countdown,<?php echo attr(addslashes($max_reminder_words)); ?>);"
+                    onKeyUp="limitText(this.form.message,this.form.countdown,<?php echo attr(addslashes($max_reminder_words)); ?>);"
                     class="form-control oe-text-to-left" style= "height:75px !Important" name="message" id="message"
-                    placeholder="<?php echo xlt('Maximum characters') ?> : <?php echo $max_reminder_words ?>"><?php echo text($this_message['dr_message_text']);?></textarea>
+                    placeholder="<?php echo xla('Maximum characters') ?> : <?php echo attr($max_reminder_words); ?>"><?php echo text($this_message['dr_message_text']);?></textarea>
                 </div>
             </div>
             <div class="form-group">
                 <label class="control-label col-xs-6 text-right" for="countdown"><?php echo xlt('Characters Remaining') ?>:</label>
                 <div class="col-xs-2">
-                    <input class="form-control" readonly type="text" name="countdown" id="countdown" value="<?php echo $max_reminder_words; ?>">
+                    <input class="form-control" readonly type="text" name="countdown" id="countdown" value="<?php echo attr($max_reminder_words); ?>">
                 </div>
             </div>
         </div>
@@ -432,7 +442,7 @@ if (isset($this_message['pid'])) {
         $remindersArray[$RA['messageID']]['dDate'] = $RA['dDate'];
     }
 
-        echo '<h4>',xlt('Messages You have sent Today'),'</h4>';
+        echo '<h4>'.xlt('Messages You have sent Today').'</h4>';
         echo '<table class="table table-bordered" id="logTable">
                 <thead>
                   <tr>
@@ -447,11 +457,11 @@ if (isset($this_message['pid'])) {
 
     foreach ($remindersArray as $RA) {
         echo '<tr class="heading">
-                  <td>',text($RA['messageID']),'</td>
-                  <td>',text($RA['ToName']),'</td>
-                  <td>',text($RA['PatientName']),'</td>
-                  <td>',text($RA['message']),'</td>
-                  <td>',text($RA['dDate']),'</td>
+                  <td>'.text($RA['messageID']).'</td>
+                  <td>'.text($RA['ToName']).'</td>
+                  <td>'.text($RA['PatientName']).'</td>
+                  <td>'.text($RA['message']).'</td>
+                  <td>'.text($RA['dDate']).'</td>
                 </tr>';
     }
 
diff --git a/interface/main/dated_reminders/dated_reminders_log.php b/interface/main/dated_reminders/dated_reminders_log.php
index 32c377627..72515ab2d 100644
--- a/interface/main/dated_reminders/dated_reminders_log.php
+++ b/interface/main/dated_reminders/dated_reminders_log.php
@@ -1,31 +1,20 @@
 <?php
 /**
- * Used for displaying log of dated reminders.
+ * Used for adding dated reminders.
  *
- * Copyright (C) 2012 tajemo.co.za <http://www.tajemo.co.za/>
- * Copyright (C) 2017 Brady Miller <brady.g.miller@gmail.com>
- *
- * LICENSE: This program is free software; you can redistribute it and/or
- * modify it under the terms of the GNU General Public License
- * as published by the Free Software Foundation; either version 3
- * of the License, or (at your option) any later version.
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
- * GNU General Public License for more details.
- * You should have received a copy of the GNU General Public License
- * along with this program. If not, see <http://opensource.org/licenses/gpl-license.php>;.
- *
- * @package OpenEMR
- * @author  Craig Bezuidenhout <http://www.tajemo.co.za/>
- * @author Brady Miller <brady.g.miller@gmail.com>
- * @link    http://www.open-emr.org
+ * @package   OpenEMR
+ * @link      http://www.open-emr.org
+ * @author    Craig Bezuidenhout <http://www.tajemo.co.za/>
+ * @author    Brady Miller <brady.g.miller@gmail.com>
+ * @copyright Copyright (c) 2012 tajemo.co.za <http://www.tajemo.co.za/>
+ * @copyright Copyright (c) 2017-2018 Brady Miller <brady.g.miller@gmail.com>
  */
 
 
     require_once("../../globals.php");
     require_once("$srcdir/acl.inc");
     require_once("$srcdir/dated_reminder_functions.php");
+
     use OpenEMR\Core\Header;
 
     $isAdmin =acl_check('admin', 'users');
@@ -35,6 +24,10 @@
     -------------------  HANDLE POST ---------------------
   */
 if ($_GET) {
+    if (!verifyCsrfToken($_GET["csrf_token_form"])) {
+        die(xlt('Authentication Error'));
+    }
+
     if (!$isAdmin) {
         if (empty($_GET['sentBy']) and empty($_GET['sentTo'])) {
             $_GET['sentTo'] = array(intval($_SESSION['authId']));
@@ -74,15 +67,15 @@ if ($_GET) {
 
     foreach ($remindersArray as $RA) {
         echo '<tr class="heading">
-              <td>',text($RA['messageID']),'</td>
-              <td>',text($RA['sDate']),'</td>
-              <td>',text($RA['fromName']),'</td>
-              <td>',text($RA['ToName']),'</td>
-              <td>',text($RA['PatientName']),'</td>
-              <td>',text($RA['message']),'</td>
-              <td>',text($RA['dDate']),'</td>
-              <td>',text($RA['pDate']),'</td>
-              <td>',text($RA['processedByName']),'</td>
+              <td>'.text($RA['messageID']).'</td>
+              <td>'.text($RA['sDate']).'</td>
+              <td>'.text($RA['fromName']).'</td>
+              <td>'.text($RA['ToName']).'</td>
+              <td>'.text($RA['PatientName']).'</td>
+              <td>'.text($RA['message']).'</td>
+              <td>'.text($RA['dDate']).'</td>
+              <td>'.text($RA['pDate']).'</td>
+              <td>'.text($RA['processedByName']).'</td>
             </tr>';
     }
 
@@ -152,6 +145,8 @@ if ($_GET) {
         <div class="row hideaway">
             <div class="col-xs-12">
                 <form method="get" id="logForm" onsubmit="return top.restoreSession()">
+                    <input type="hidden" name="csrf_token_form" value="<?php echo attr(collectCsrfToken()); ?>" />
+
                     <fieldset>
                         <legend><?php echo xlt('Filters') ?></legend>
                         <div class="col-xs-12">
@@ -173,7 +168,7 @@ if ($_GET) {
                                     <?php
                                     if ($isAdmin) {
                                         foreach ($allUsers as $user) {
-                                            echo '<option value="',attr($user['id']),'">',text($user['fname'].' '.$user['mname'].' '.$user['lname']),'</option>';
+                                            echo '<option value="'.attr($user['id']).'">'.text($user['fname'].' '.$user['mname'].' '.$user['lname']).'</option>';
                                         }
                                     }
                                     ?>
@@ -186,7 +181,7 @@ if ($_GET) {
                                     <?php
                                     if ($isAdmin) {
                                         foreach ($allUsers as $user) {
-                                            echo '<option value="',attr($user['id']),'">',text($user['fname'].' '.$user['mname'].' '.$user['lname']),'</option>';
+                                            echo '<option value="'.attr($user['id']).'">'.text($user['fname'].' '.$user['mname'].' '.$user['lname']).'</option>';
                                         }
                                     }
                                     ?>
diff --git a/library/dated_reminder_functions.php b/library/dated_reminder_functions.php
index 265b15525..10f0585c1 100644
--- a/library/dated_reminder_functions.php
+++ b/library/dated_reminder_functions.php
@@ -2,24 +2,16 @@
 /**
  * Contains functions used in the dated reminders.
  *
- * Copyright (C) 2012 tajemo.co.za <http://www.tajemo.co.za/>
- *
- * LICENSE: This program is free software; you can redistribute it and/or
- * modify it under the terms of the GNU General Public License
- * as published by the Free Software Foundation; either version 3
- * of the License, or (at your option) any later version.
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
- * GNU General Public License for more details.
- * You should have received a copy of the GNU General Public License
- * along with this program. If not, see <http://opensource.org/licenses/gpl-license.php>;.
- *
- * @package OpenEMR
- * @author  Craig Bezuidenhout <http://www.tajemo.co.za/>
- * @link    http://www.open-emr.org
+ * @package   OpenEMR
+ * @link      http://www.open-emr.org
+ * @author    Craig Bezuidenhout <http://www.tajemo.co.za/>
+ * @author    Brady Miller <brady.g.miller@gmail.com>
+ * @copyright Copyright (c) 2012 tajemo.co.za <http://www.tajemo.co.za/>
+ * @copyright Copyright (c) 2018 Brady Miller <brady.g.miller@gmail.com>
+ * @license   https://github.com/openemr/openemr/blob/master/LICENSE GNU General Public License 3
  */
 
+
 /**
  * Get Portal Alerts function
  *
@@ -75,8 +67,8 @@ function RemindersArray($days_to_show, $today, $alerts_to_show, $userID = false)
                             JOIN `dated_reminders_link` drl ON dr.dr_id = drl.dr_id  
                             WHERE drl.to_id = ? 
                             AND dr.`message_processed` = 0
-                            AND dr.`dr_message_due_date` < ADDDATE(NOW(), INTERVAL $days_to_show DAY) 
-                            ORDER BY `dr_message_due_date` ASC , `message_priority` ASC LIMIT 0,$alerts_to_show",
+                            AND dr.`dr_message_due_date` < ADDDATE(NOW(), INTERVAL " . escape_limit($days_to_show) . " DAY) 
+                            ORDER BY `dr_message_due_date` ASC , `message_priority` ASC LIMIT 0," . escape_limit($alerts_to_show),
         array($userID)
     );
 
@@ -140,7 +132,7 @@ function GetDueReminderCount($days_to_show, $today, $userID = false)
                             JOIN `dated_reminders_link` drl ON dr.dr_id = drl.dr_id  
                             WHERE drl.to_id = ? 
                             AND dr.`message_processed` = 0
-                            AND dr.`dr_message_due_date` < ADDDATE(NOW(), INTERVAL $days_to_show DAY)",
+                            AND dr.`dr_message_due_date` < ADDDATE(NOW(), INTERVAL " . escape_limit($days_to_show) . " DAY)",
         array($userID)
     );
 
@@ -214,13 +206,13 @@ function getRemindersHTML($today, $reminders = array())
         // end check if reminder is due or overdue
         // apend to html string
         $pdHTML .= '<p id="p_' . attr($r['messageID']) . '">
-            <a onclick="openAddScreen(' . attr($r['messageID']) . ')" class="dnForwarder btn btn-default btn-send-msg" id="' . attr($r['messageID']) . '" href="#"> ' . xlt('Forward') . ' </a>
-            <a class="dnRemover btn btn-default btn-save" onclick="updateme(' . "'" . attr($r['messageID']) . "'" . ')" id="' . attr($r['messageID']) . '" href="#">
+            <a onclick="openAddScreen(' . attr(addslashes($r['messageID'])) . ')" class="dnForwarder btn btn-default btn-send-msg" id="' . attr($r['messageID']) . '" href="#"> ' . xlt('Forward') . ' </a>
+            <a class="dnRemover btn btn-default btn-save" onclick="updateme(' . "'" . attr(addslashes($r['messageID'])) . "'" . ')" id="' . attr($r['messageID']) . '" href="#">
             <span>' . xlt('Set As Completed') . '</span>
             </a>
             <span title="' . ($r['PatientID'] > 0 ? xla('Click Patient Name to Open Patient File') : '') . '" class="' . attr($class) . '">' .
             $warning . '         
-            <span onclick="goPid(' . attr($r['PatientID']) . ')" class="patLink" id="' . attr($r['PatientID']) . '">' .
+            <span onclick="goPid(' . attr(addslashes($r['PatientID'])) . ')" class="patLink" id="' . attr($r['PatientID']) . '">' .
             text($r['PatientName']) . '
             </span> ' .
             text($r['message']) . ' - [' . text($r['fromName']) . ']
-- 
2.11.4.GIT