Skip to content

Commit

Permalink
Updated Forms
Browse files Browse the repository at this point in the history
In this commit,we made changes as per brady's comments.
  • Loading branch information
NainaSupp committed Jan 3, 2013
1 parent 09d31cd commit 01a64a4
Show file tree
Hide file tree
Showing 18 changed files with 1,001 additions and 0 deletions.
1 change: 1 addition & 0 deletions interface/forms/Aftercare_Plan/info.txt
@@ -0,0 +1 @@
Aftercare Plan

This comment has been minimized.

Copy link
@bradymiller

bradymiller Jan 3, 2013

Title looks good.
The path(Aftercare_Plan) should be all lower caps, though, to avoid issues in Windows/Linux compatibility.
Note the path and title do not need to be the same.

191 changes: 191 additions & 0 deletions interface/forms/Aftercare_Plan/new.php
@@ -0,0 +1,191 @@
<?php
/**
*
* Copyright (C) 2012-2013 Naina Mohamed <naina@capminds.com> CapMinds Technologies
*
* LICENSE: This program is free software; you can redistribute it and/or
* modify it under the terms of the GNU General Public License
* as published by the Free Software Foundation; either version 3
* of the License, or (at your option) any later version.
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU General Public License for more details.
* You should have received a copy of the GNU General Public License
* along with this program. If not, see <http://opensource.org/licenses/gpl-license.php>;.
*
* @package OpenEMR
* @author Naina Mohamed <naina@capminds.com>
* @link http://www.open-emr.org
*/


//SANITIZE ALL ESCAPES
$sanitize_all_escapes=true;

//STOP FAKE REGISTER GLOBALS
$fake_register_globals=false;

include_once("../../globals.php");
include_once("$srcdir/api.inc");
require_once("$srcdir/patient.inc");
require_once("$srcdir/options.inc.php");
require_once("$srcdir/htmlspecialchars.inc.php");
formHeader("Form:AfterCare Planning");
$returnurl = $GLOBALS['concurrent_layout'] ? 'encounter_top.php' : 'patient_encounter.php';
$formid = 0 + formData('id', 'G');

This comment has been minimized.

Copy link
@bradymiller

bradymiller Jan 3, 2013

Since your are using new security model, no need to use formData (or else you will strip magic quotes twice if magic quotes is on). to collect $formid, should just use:
$formid = 0 + (isset($_GET[$id]) ? $_GET[$id] : '');

$obj = $formid ? formFetch("form_aftercareplan", $formid) : array();

?>
<html>
<head>
<?php html_header_show();?>
<script type="text/javascript" src="../../../library/dialog.js"></script>
<!-- pop up calendar -->
<style type="text/css">@import url(<?php echo $GLOBALS['webroot'] ?>/library/dynarch_calendar.css);</style>
<script type="text/javascript" src="<?php echo $GLOBALS['webroot'] ?>/library/dynarch_calendar.js"></script>
<?php include_once("{$GLOBALS['srcdir']}/dynarch_calendar_en.inc.php"); ?>
<script type="text/javascript" src="<?php echo $GLOBALS['webroot'] ?>/library/dynarch_calendar_setup.js"></script>
<script type="text/javascript" src="<?php echo $GLOBALS['webroot'] ?>/library/textformat.js"></script>
<script type="text/javascript" src="<?php echo $GLOBALS['webroot'] ?>/library/dialog.js"></script>
<link rel="stylesheet" href="<?php echo $css_header;?>" type="text/css">
</head>
<body class="body_top">
<p><span class="forms-title"><?php echo xlt('AfterCare Planning'); ?></span></p>
</br>
<?php
echo "<form method='post' name='my_form' " .
"action='$rootdir/forms/Aftercare_Plan/save.php?id=$formid'>\n";

This comment has been minimized.

Copy link
@bradymiller

bradymiller Jan 3, 2013

Surround $formid by the attr() function.

?>
<table border="0">
<tr>
<td align="left" class="forms" class="forms"><?php echo xlt('Client Name' ); ?>:</td>
<td class="forms">
<label class="forms-data"> <?php if (is_numeric($pid)) {

$result = getPatientData($pid, "fname,lname,squad");
echo htmlspecialchars(text($result['fname'])." ".text($result['lname']));}
$patient_name=text($result['fname'])." ".text($result['lname']);

This comment has been minimized.

Copy link
@bradymiller

bradymiller Jan 3, 2013

remove the text() functions here. You already escape this variable correctly 3 lines below below with the attr() function. To get a good idea of what these escape functions do, see here:
https://github.com/openemr/openemr/blob/master/library/htmlspecialchars.inc.php

?>
</label>
<input type="hidden" name="client_name" value="<?php echo attr($patient_name);?>">
</td>
<td align="left" class="forms"><?php echo xlt('DOB'); ?>:</td>
<td class="forms">
<label class="forms-data"> <?php if (is_numeric($pid)) {

$result = getPatientData($pid, "*");
echo htmlspecialchars($result['DOB']);}
$dob=($result['DOB']);
?>
</label>
<input type="hidden" name="DOB" value="<?php echo attr($dob);?>">
</td>
</tr>
<tr>


<td align="left" class="forms"><?php echo xlt('Admit Date'); ?>:</td>
<td class="forms">
<input type='text' size='10' name='admit_date' id='admission_date' <?php echo attr($disabled); ?>; value='<?php echo stripslashes($obj{"admit_date"}); ?>' title='<?php echo xla('yyyy-mm-dd Date of service'); ?>'

This comment has been minimized.

Copy link
@bradymiller

bradymiller Jan 3, 2013

Change stripslashes() function to attr() function.

onkeyup='datekeyup(this,mypcc)' onblur='dateblur(this,mypcc)' />
<img src='../../pic/show_calendar.gif' align='absbottom' width='24' height='22'
id='img_admission_date' border='0' alt='[?]' style='cursor:pointer;cursor:hand'
title='<?php echo xla('Click here to choose a date'); ?>'>
</td>



<td align="left" class="forms"><?php echo xl('Discharged'); ?>:</td>
<td class="forms">
<input type='text' size='10' name='discharged' id='discharge_date' <?php echo attr($disabled); ?>;
value='<?php echo stripslashes($obj{"discharged"}); ?>'

This comment has been minimized.

Copy link
@bradymiller

bradymiller Jan 3, 2013

Change stripslashes() function to attr() function.

This comment has been minimized.

Copy link
@bradymiller

bradymiller Jan 3, 2013

Actually, are you using stripslashes for a reason here? If so, then you'd wrap the attr() function around the stripslashes functions.

title='<?php echo xla('yyyy-mm-dd Date of service'); ?>'
onkeyup='datekeyup(this,mypcc)' onblur='dateblur(this,mypcc)' />
<img src='../../pic/show_calendar.gif' align='absbottom' width='24' height='22'
id='img_discharge_date' border='0' alt='[?]' style='cursor:pointer;cursor:hand'
title='<?php echo xla('Click here to choose a date'); ?>'>
</td>
</tr>
<tr>
<td align="left colspan="3" style="padding-bottom:7px;"></td>
</tr>
<tr>

<td class="forms-subtitle" colspan="4"><B><?php echo xlt('Goal and Methods');?></B></td>

</tr>
<tr>
<td align="left colspan="3" style="padding-bottom:7px;"></td>
</tr>
<tr>

<td class="forms-subtitle" colspan="4"><B><?php echo xlt('Goal A');?>:</B>&nbsp;<?php echo xlt('Acute Intoxication/Withdrawal'); ?></td>

</tr>
<tr>
<td align="right" class="forms">1.</td>
<td colspan="3"><textarea name="goal_a_acute_intoxication" rows="2" cols="80" wrap="virtual name"><?php echo stripslashes($obj{"goal_a_acute_intoxication"});?></textarea></td>

</tr>
<tr>
<td align="right" class="forms">2.</td>
<td colspan="3"><textarea name="goal_a_acute_intoxication_I" rows="2" cols="80" wrap="virtual name"><?php echo stripslashes($obj{"goal_a_acute_intoxication_I"});?></textarea></td>

</tr>
<tr>
<td align="right" class="forms">3.</td>
<td colspan="3"><textarea name="goal_a_acute_intoxication_II" rows="2" cols="80" wrap="virtual name"><?php echo stripslashes($obj{"goal_a_acute_intoxication_II"});?></textarea></td>


<tr>

<td class="forms-subtitle" colspan="4"><B><?php echo xlt('Goal B');?>:</B>&nbsp;<?php echo xlt('Emotional / Behavioral Conditions & Complications'); ?></td>

</tr>
<tr>
<td align="right" class="forms">1.</td>
<td colspan="3"><textarea name="goal_b_emotional_behavioral_conditions" rows="2" cols="80" wrap="virtual name"><?php echo stripslashes($obj{"goal_b_emotional_behavioral_conditions"});?></textarea></td>

</tr>
<tr>
<td align="right" class="forms">2.</td>
<td colspan="3"><textarea name="goal_b_emotional_behavioral_conditions_I" rows="2" cols="80" wrap="virtual name"><?php echo stripslashes($obj{"goal_b_emotional_behavioral_conditions_I"});?></textarea></td>

</tr>


<td class="forms-subtitle" colspan="4"><B><?php echo xlt('Goal C');?>:</B>&nbsp;<?php echo xlt('Relapse Potential'); ?></td>

</tr>
<tr>
<td align="right" class="forms">1.</td>
<td colspan="3"><textarea name="goal_c_relapse_potential" rows="2" cols="80" wrap="virtual name"><?php echo stripslashes($obj{"goal_c_relapse_potential"});?></textarea></td>

</tr>
<tr>
<td align="right" class="forms">2.</td>
<td colspan="3"><textarea name="goal_c_relapse_potential_I" rows="2" cols="80" wrap="virtual name"><?php echo stripslashes($obj{"goal_c_relapse_potential_I"});?></textarea></td>

This comment has been minimized.

Copy link
@bradymiller

bradymiller Jan 3, 2013

Regarding stripslashes function use above, are you using this for a reason? (if so, let me know)
If you are then wrap them with the text() functions to html escape.
If you are not then replace them with the text() function.

This comment has been minimized.

Copy link
@capmindstech

capmindstech Jan 4, 2013

Owner

Replaced by text()


</tr>

<tr>
<td align="left colspan="3" style="padding-bottom:7px;"></td>
</tr>
<tr>
<td></td>
<td><input type='submit' value='<?php echo xlt('Save');?>' class="button-css">&nbsp;
<input type='button' value="Print" onclick="window.print()" class="button-css">&nbsp;
<input type='button' class="button-css" value='<?php echo xlt('Cancel');?>'
onclick="top.restoreSession();location='<?php echo "$rootdir/patient_file/encounter/$returnurl" ?>'" /></td>
</tr>
</table>
</form>
<script language="javascript">
/* required for popup calendar */
Calendar.setup({inputField:"admission_date", ifFormat:"%Y-%m-%d", button:"img_admission_date"});
Calendar.setup({inputField:"discharge_date", ifFormat:"%Y-%m-%d", button:"img_discharge_date"});
</script>
<?php
formFooter();
?>
53 changes: 53 additions & 0 deletions interface/forms/Aftercare_Plan/report.php
@@ -0,0 +1,53 @@
<?php
/**
*
* Copyright (C) 2012-2013 Naina Mohamed <naina@capminds.com> CapMinds Technologies
*
* LICENSE: This program is free software; you can redistribute it and/or
* modify it under the terms of the GNU General Public License
* as published by the Free Software Foundation; either version 3
* of the License, or (at your option) any later version.
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU General Public License for more details.
* You should have received a copy of the GNU General Public License
* along with this program. If not, see <http://opensource.org/licenses/gpl-license.php>;.
*
* @package OpenEMR
* @author Naina Mohamed <naina@capminds.com>
* @link http://www.open-emr.org
*/

//SANITIZE ALL ESCAPES
$sanitize_all_escapes=true;

//STOP FAKE REGISTER GLOBALS
$fake_register_globals=false;

This comment has been minimized.

Copy link
@bradymiller

bradymiller Jan 3, 2013

Actually, I just realized that this script is just a library (ie. only contains function(s)), so should remove above flags (the flags will already be called in the calling scripts).


include_once("../../globals.php");
include_once($GLOBALS["srcdir"]."/api.inc");
function Aftercare_Plan_report( $pid, $encounter, $cols, $id) {
$count = 0;
$data = formFetch("form_aftercareplan", $id);
if ($data) {
print "<table><tr>";
foreach($data as $key => $value) {
if ($key == "id" || $key == "pid" || $key == "user" || $key == "groupname" || $key == "authorized" || $key == "activity" || $key == "date" || $value == "" || $value == "0000-00-00 00:00:00") {
continue;
}
if ($value == "on") {
$value = "yes";
}
$key=ucwords(str_replace("_"," ",$key));
print "<td><span class=bold>".xlt($key). ": </span><span class=text>$value</span></td>";

This comment has been minimized.

Copy link
@bradymiller

bradymiller Jan 3, 2013

Wrap the $value with the text() function.

$count++;
if ($count == $cols) {
$count = 0;
print "</tr><tr>\n";
}
}
}
print "</tr></table>";
}
?>
69 changes: 69 additions & 0 deletions interface/forms/Aftercare_Plan/save.php
@@ -0,0 +1,69 @@
<?php

This comment has been minimized.

Copy link
@bradymiller

bradymiller Jan 3, 2013

Why did you make such "drastic" changes from you previous revision here:
I am specifically wondering why you removed the call to the addForm() function and not using the $_GET['mode'] variables to decide what to do?

This comment has been minimized.

Copy link
@capmindstech

capmindstech Jan 4, 2013

Owner

Brady,
Instead of using $_GET['mode'] we used empty($id) to decide whether it's a new or view files,FYI : we used the addForm() below,

This comment has been minimized.

Copy link
@capmindstech

capmindstech Jan 4, 2013

Owner

Brady,
If you feel is anything need to change.please let me know

This comment has been minimized.

Copy link
@bradymiller

bradymiller Jan 4, 2013

As long as it works, no change needed here (I was just curious).

/**
*
* Copyright (C) 2012-2013 Naina Mohamed <naina@capminds.com> CapMinds Technologies
*
* LICENSE: This program is free software; you can redistribute it and/or
* modify it under the terms of the GNU General Public License
* as published by the Free Software Foundation; either version 3
* of the License, or (at your option) any later version.
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU General Public License for more details.
* You should have received a copy of the GNU General Public License
* along with this program. If not, see <http://opensource.org/licenses/gpl-license.php>;.
*
* @package OpenEMR
* @author Naina Mohamed <naina@capminds.com>
* @link http://www.open-emr.org
*/

//SANITIZE ALL ESCAPES
$sanitize_all_escapes=$_POST['true'];

//STOP FAKE REGISTER GLOBALS
$fake_register_globals=$_POST['false'];

include_once("../../globals.php");
include_once("$srcdir/api.inc");
include_once("$srcdir/forms.inc");
require_once("$srcdir/htmlspecialchars.inc.php");
require_once("$srcdir/formdata.inc.php");

if (! $encounter) { // comes from globals.php
die(xl("Internal error: we do not seem to be in an encounter!"));
}

$id = formData('id','G') + 0;

This comment has been minimized.

Copy link
@bradymiller

bradymiller Jan 3, 2013

Since your are using new security model, no need to use formData (or else you will strip magic quotes twice if magic quotes is on). to collect $formid, should just use:
$formid = 0 + (isset($_GET[$id]) ? $_GET[$id] : '');


$sets = "pid = {$_SESSION["pid"]},
groupname = '" . $_SESSION["authProvider"] . "',
user = '" . $_SESSION["authUser"] . "',
authorized = $userauthorized, activity=1, date = NOW(),
provider = '" . add_escape_custom(formData("provider")) . "',
client_name = '" . add_escape_custom(formData("client_name")) . "',
admit_date = '" . add_escape_custom(formData("admit_date")) . "',
discharged = '" . add_escape_custom(formData("discharged")) . "',
goal_a_acute_intoxication = '" . add_escape_custom(formData("goal_a_acute_intoxication")) . "',
goal_a_acute_intoxication_I = '" . add_escape_custom(formData("goal_a_acute_intoxication_I")) . "',
goal_a_acute_intoxication_II = '" . add_escape_custom(formData("goal_a_acute_intoxication_II")) . "',
goal_b_emotional_behavioral_conditions = '" . add_escape_custom(formData("goal_b_emotional_behavioral_conditions")) . "',
goal_b_emotional_behavioral_conditions_I = '" . add_escape_custom(formData("goal_b_emotional_behavioral_conditions_I")) . "',
goal_c_relapse_potential = '" . add_escape_custom(formData("goal_c_relapse_potential")) . "',
goal_c_relapse_potential_I = '" . add_escape_custom(formData("goal_c_relapse_potential_I")) . "'";


if (empty($id)) {
$newid = sqlInsert("INSERT INTO form_aftercareplan SET $sets");
addForm($encounter, "AfterCare Plan", $newid, "Aftercare_Plan", $pid, $userauthorized);
}
else {
sqlStatement("UPDATE form_aftercareplan SET $sets WHERE id = '". add_escape_custom("$id"). "'");
}

$_SESSION["encounter"] = htmlspecialchars($encounter);
formHeader("Redirecting....");
formJump();
formFooter();
?>
27 changes: 27 additions & 0 deletions interface/forms/Aftercare_Plan/table.sql
@@ -0,0 +1,27 @@
--
-- Table structure for table `form_aftercareplan`
--

CREATE TABLE IF NOT EXISTS `form_aftercareplan` (
`id` bigint(20) NOT NULL AUTO_INCREMENT,
`date` datetime DEFAULT NULL,
`pid` bigint(20) DEFAULT NULL,
`user` varchar(255) DEFAULT NULL,
`provider` varchar(255) DEFAULT NULL,
`groupname` varchar(255) DEFAULT NULL,
`authorized` tinyint(4) DEFAULT NULL,
`activity` tinyint(4) DEFAULT NULL,
`client_name` varchar(255) DEFAULT NULL,
`admit_date` date DEFAULT NULL,
`discharged` date DEFAULT NULL,
`goal_a_acute_intoxication` text,
`goal_a_acute_intoxication_I` text,
`goal_a_acute_intoxication_II` text,
`goal_b_emotional_behavioral_conditions` text,
`goal_b_emotional_behavioral_conditions_I` text,
`goal_c_relapse_potential` text,
`goal_c_relapse_potential_I` text,

PRIMARY KEY (`id`)
) ENGINE=InnoDB;

3 changes: 3 additions & 0 deletions interface/forms/Aftercare_Plan/view.php
@@ -0,0 +1,3 @@
<?php
require("new.php");
?>
1 change: 1 addition & 0 deletions interface/forms/Transfer_summary/info.txt
@@ -0,0 +1 @@
Transfer summary

1 comment on commit 01a64a4

@bradymiller
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hi, finished my code review. This is getting very close to submission. I only reviewed the first form, but all 3 forms have the same issues (or questions that I have brought up). I didn't test it, but will do that in the next revision, which I am guessing will be ready for going into the codebase at that time.

When we commit this in the future I think one of the big questions will be (we should ask the community when these form are ready) are going to be whether these forms should go into contrib form directory or into the interface/forms directory (ie. are they mainstream enough?).

Please sign in to comment.