diff --git a/interface/logview/logview.php b/interface/logview/logview.php index 9870290ba07..57227b2234b 100644 --- a/interface/logview/logview.php +++ b/interface/logview/logview.php @@ -6,7 +6,9 @@ * @package OpenEMR * @link http://www.open-emr.org * @author Brady Miller + * @author Jerry Padgett * @copyright Copyright (c) 2017-2019 Brady Miller + * @copyright Copyright (c) 2024 Jerry Padgett * @license https://github.com/openemr/openemr/blob/master/LICENSE GNU General Public License 3 */ @@ -38,19 +40,16 @@ - -
-
-
-
-

+
+
+
+
+

+
-
-
-
-
    - - -
-
-
-
-
-
- $end_date) { - echo "
"; - echo xlt('Start Date should not be greater than End Date'); - echo "
"; - $err_message = 1; - } - - if (!empty($_GET["form_patient"])) { - $form_patient = isset($_GET["form_patient"]) ? $_GET["form_patient"] : ""; - } - - ?> - - -
-

-
- - - - - -
- -
- -
- -
- -
- -
- ' onclick='sel_patient()' title='' /> - -
-
-
- -
- -
- +
+

+ + + + + + +
+ +
+ +
+ +
+ +
+ +
+ ' onclick='sel_patient()' title='' /> + +
+
+
+ +
+ +
+ - -
- -
- -
- \n"; - echo " \n"; - echo "\n"; - } else { - echo " -
-
- -
- -
- - - - -
- -
- - -
- - - - - - - - - - - - - - - " /> - getEvents(array('sdate' => $start_date,'edate' => $end_date, 'user' => $form_user, 'patient' => $form_pid, 'sortby' => $_GET['sortby'], 'levent' => $gev, 'tevent' => $tevent,'direction' => $_GET['direction']))) { - // Set up crypto object (object will increase performance since caches used keys) - $cryptoGen = new CryptoGen(); - - while ($iter = sqlFetchArray($ret)) { - if (empty($iter['id'])) { - //skip empty log items (this means they were deleted and will show up as deleted in the audit log tamper script) - continue; - } - - //translate comments - $patterns = array ('/^success/','/^failure/','/ encounter/'); - $replace = array ( xl('success'), xl('failure'), xl('encounter', '', ' ')); - - if (!empty($iter['encrypt'])) { - $commentEncrStatus = $iter['encrypt']; - } else { - $commentEncrStatus = "No"; - } - if (!empty($iter['version'])) { - $encryptVersion = $iter['version']; - } else { - $encryptVersion = 0; - } - - // Decrypt comment data if encrypted - if ($commentEncrStatus == "Yes") { - if ($encryptVersion >= 3) { - // Use new openssl method - if (extension_loaded('openssl')) { - $trans_comments = $cryptoGen->decryptStandard($iter["comments"]); - if ($trans_comments !== false) { - $trans_comments = preg_replace($patterns, $replace, $trans_comments); - } else { - $trans_comments = xl("Unable to decrypt these comments since decryption failed."); + +
+ +
+ +
+ \n"; + echo " \n"; + echo "\n"; } else { - $trans_comments = xl("Unable to decrypt these comments since the PHP openssl module is not installed."); + echo ""; + ?> +
+ + +
+ +
+ + + +
+ +
+ + +
+
+ + + + + + + + + + + + + + + + " /> + aes256Decrypt_mycrypt($iter["comments"])); + + if (($eventname == "") && ($type_event != "")) { + $tevent = $type_event; + } elseif ($type_event == "" && $eventname != "") { + $gev = $eventname; + } elseif ($eventname == "") { + $gev = ""; } else { - $trans_comments = xl("Unable to decrypt these comments since the PHP mycrypt module is not installed."); + $gev = $getevent; } - } - } else { - // base64 decode if applicable (note the $encryptVersion is a misnomer here, we have added in base64 encoding - // of comments in OpenEMR 6.0.0 and greater when the comments are not encrypted since they hold binary (uuid) elements) - if ($encryptVersion >= 4) { - $iter["comments"] = base64_decode($iter["comments"]); - } - $trans_comments = preg_replace($patterns, $replace, $iter["comments"]); - } - ?> - - - - - - - - - - - - - - - - - getEvents(array('sdate' => $start_date, 'edate' => $end_date, 'user' => $form_user, 'patient' => $form_pid, 'sortby' => $_GET['sortby'], 'levent' => $gev, 'tevent' => $tevent, 'direction' => $_GET['direction']))) { + // Set up crypto object (object will increase performance since caches used keys) + $cryptoGen = new CryptoGen(); + + while ($iter = sqlFetchArray($ret)) { + if (empty($iter['id'])) { + //skip empty log items (this means they were deleted and will show up as deleted in the audit log tamper script) + continue; + } + + //translate comments + $patterns = array('/^success/', '/^failure/', '/ encounter/'); + $replace = array(xl('success'), xl('failure'), xl('encounter', '', ' ')); + + if (!empty($iter['encrypt'])) { + $commentEncrStatus = $iter['encrypt']; + } else { + $commentEncrStatus = "No"; + } + if (!empty($iter['version'])) { + $encryptVersion = $iter['version']; + } else { + $encryptVersion = 0; + } + + // Decrypt comment data if encrypted + if ($commentEncrStatus == "Yes") { + if ($encryptVersion >= 3) { + // Use new openssl method + if (extension_loaded('openssl')) { + $trans_comments = $cryptoGen->decryptStandard($iter["comments"]); + if ($trans_comments !== false) { + $trans_comments = preg_replace($patterns, $replace, $trans_comments); + } else { + $trans_comments = xl("Unable to decrypt these comments since decryption failed."); + } + } else { + $trans_comments = xl("Unable to decrypt these comments since the PHP openssl module is not installed."); + } + } elseif ($encryptVersion == 2) { + // Use new openssl method + if (extension_loaded('openssl')) { + $trans_comments = $cryptoGen->aes256DecryptTwo($iter["comments"]); + if ($trans_comments !== false) { + $trans_comments = preg_replace($patterns, $replace, $trans_comments); + } else { + $trans_comments = xl("Unable to decrypt these comments since decryption failed."); + } + } else { + $trans_comments = xl("Unable to decrypt these comments since the PHP openssl module is not installed."); + } + } elseif ($encryptVersion == 1) { + // Use new openssl method + if (extension_loaded('openssl')) { + $trans_comments = preg_replace($patterns, $replace, $cryptoGen->aes256DecryptOne($iter["comments"])); + } else { + $trans_comments = xl("Unable to decrypt these comments since the PHP openssl module is not installed."); + } + } else { //$encryptVersion == 0 + // Use old mcrypt method + if (extension_loaded('mcrypt')) { + $trans_comments = preg_replace($patterns, $replace, $cryptoGen->aes256Decrypt_mycrypt($iter["comments"])); + } else { + $trans_comments = xl("Unable to decrypt these comments since the PHP mycrypt module is not installed."); + } + } + } else { + // base64 decode if applicable (note the $encryptVersion is a misnomer here, we have added in base64 encoding + // of comments in OpenEMR 6.0.0 and greater when the comments are not encrypted since they hold binary (uuid) elements) + if ($encryptVersion >= 4) { + $iter["comments"] = base64_decode($iter["comments"]); + } + $trans_comments = preg_replace($patterns, $replace, $iter["comments"]); + } + ?> + + + + + + + + + + + + + + + + + + getEvents(array('sdate' => $start_date,'edate' => $end_date, 'user' => $form_user, 'patient' => $form_pid, 'sortby' => $_GET['sortby'], 'event' => $eventname))) { - while ($iter = sqlFetchArray($ret)) { - $comments = xl('Recipient Name') . ":" . $iter["recipient"] . ";" . xl('Disclosure Info') . ":" . $iter["description"]; - ?> - - - - - - - - - - - - - -
-
+
+ if (($eventname == "disclosure") || ($gev == "")) { + $eventname = "disclosure"; + if ($ret = EventAuditLogger::instance()->getEvents(array('sdate' => $start_date, 'edate' => $end_date, 'user' => $form_user, 'patient' => $form_pid, 'sortby' => $_GET['sortby'], 'event' => $eventname))) { + while ($iter = sqlFetchArray($ret)) { + $comments = xl('Recipient Name') . ":" . $iter["recipient"] . ";" . xl('Disclosure Info') . ":" . $iter["description"]; + ?> + + + + + + + + + + + + + + +
+ +
- -
-
+
-
-
-
-
-
-
-
-

-
- '> - '> +
+
+
+
+
+

+
+ '> + '> +
-
-
- - +
+ + diff --git a/interface/usergroup/usergroup_admin.php b/interface/usergroup/usergroup_admin.php index 490afe73691..6de22846478 100644 --- a/interface/usergroup/usergroup_admin.php +++ b/interface/usergroup/usergroup_admin.php @@ -34,14 +34,8 @@ use OpenEMR\Events\User\UserUpdatedEvent; use OpenEMR\Events\User\UserCreatedEvent; -if (!empty($_POST)) { - if (!CsrfUtils::verifyCsrfToken($_POST["csrf_token_form"])) { - CsrfUtils::csrfNotVerified(); - } -} - -if (!empty($_GET)) { - if (!CsrfUtils::verifyCsrfToken($_GET["csrf_token_form"])) { +if (!empty($_REQUEST)) { + if (!CsrfUtils::verifyCsrfToken($_REQUEST["csrf_token_form"])) { CsrfUtils::csrfNotVerified(); } } @@ -260,7 +254,7 @@ sqlStatement("UPDATE users SET authorized = ?, active = ?, " . "calendar = ?, portal_user = ?, see_auth = ? WHERE " . "id = ? ", array($tqvar, $actvar, $calvar, $portalvar, $_POST['see_auth'], $_POST["id"])); - //Display message when Emergency Login user was activated + //Display message when Emergency Login user was activated if (is_countable($_POST['access_group'])) { $bg_count = count($_POST['access_group']); for ($i = 0; $i < $bg_count; $i++) { @@ -278,28 +272,28 @@ } } - if ($_POST["comments"]) { + if (isset($_POST["comments"])) { sqlStatement("update users set info = ? where id = ? ", array($_POST["comments"], $_POST["id"])); } - $erxrole = isset($_POST['erxrole']) ? $_POST['erxrole'] : ''; + $erxrole = $_POST['erxrole'] ?? ''; sqlStatement("update users set newcrop_user_role = ? where id = ? ", array($erxrole, $_POST["id"])); - if ($_POST["physician_type"]) { + if (isset($_POST["physician_type"])) { sqlStatement("update users set physician_type = ? where id = ? ", array($_POST["physician_type"], $_POST["id"])); } - if ($_POST["main_menu_role"]) { + if (isset($_POST["main_menu_role"])) { $mainMenuRole = filter_input(INPUT_POST, 'main_menu_role'); sqlStatement("update `users` set `main_menu_role` = ? where `id` = ? ", array($mainMenuRole, $_POST["id"])); } - if ($_POST["patient_menu_role"]) { + if (isset($_POST["patient_menu_role"])) { $patientMenuRole = filter_input(INPUT_POST, 'patient_menu_role'); sqlStatement("update `users` set `patient_menu_role` = ? where `id` = ? ", array($patientMenuRole, $_POST["id"])); } - if ($_POST["erxprid"]) { + if (isset($_POST["erxprid"])) { sqlStatement("update users set weno_prov_id = ? where id = ? ", array($_POST["erxprid"], $_POST["id"])); } @@ -532,13 +526,13 @@ } } } -// added for form submit's from usergroup_admin_add and user_admin.php +// added for form submits from usergroup_admin_add and user_admin.php // sjp 12/29/17 if (isset($_REQUEST["mode"])) { exit(text(trim($alertmsg))); } -$form_inactive = empty($_POST['form_inactive']) ? false : true; +$form_inactive = !empty($_POST['form_inactive']); ?>