Skip to content

Commit

Permalink
Here is the updated forms from capminds technologies
Browse files Browse the repository at this point in the history
  • Loading branch information
@NainaSupp
NainaSupp committed Dec 1, 2012
1 parent 54dbea1 commit 09d31cd
Show file tree
Hide file tree
Showing 15 changed files with 1,189 additions and 0 deletions.
170 changes: 170 additions & 0 deletions interface/forms/Aftercareplan/new.php
View file
@@ -0,0 +1,170 @@
<?php
// Copyright (C) 2012-2013 Naina Mohamed <naina@capminds.com> CapMinds Technologies

This comment has been minimized.

Sign in to view

Copy link
@bradymiller

bradymiller Dec 1, 2012

Use a standard headers()simply cop/paste below and substitute your copyright/author info:
http://www.open-emr.org/wiki/index.php/How_to_Document_Your_Code_Properly#Page-Level_DocBlock

//SANITIZE ALL ESCAPES
$sanitize_all_escapes=true;

//STOP FAKE REGISTER GLOBALS
$fake_register_globals=false;

include_once("../../globals.php");
include_once("$srcdir/api.inc");
require_once("$srcdir/patient.inc");
require_once("$srcdir/options.inc.php");
require_once("$srcdir/htmlspecialchars.inc.php");
formHeader("Form:AfterCare Planning");
$returnurl = $GLOBALS['concurrent_layout'] ? 'encounter_top.php' : 'patient_encounter.php';

?>
<html>
<head>
<?php html_header_show();?>
<script type="text/javascript" src="../../../library/dialog.js"></script>
<!-- pop up calendar -->
<style type="text/css">@import url(<?php echo $GLOBALS['webroot'] ?>/library/dynarch_calendar.css);</style>
<script type="text/javascript" src="<?php echo $GLOBALS['webroot'] ?>/library/dynarch_calendar.js"></script>
<?php include_once("{$GLOBALS['srcdir']}/dynarch_calendar_en.inc.php"); ?>
<script type="text/javascript" src="<?php echo $GLOBALS['webroot'] ?>/library/dynarch_calendar_setup.js"></script>
<script type="text/javascript" src="<?php echo $GLOBALS['webroot'] ?>/library/textformat.js"></script>
<script type="text/javascript" src="<?php echo $GLOBALS['webroot'] ?>/library/dialog.js"></script>
<link rel="stylesheet" href="<?php echo $css_header;?>" type="text/css">
</head>
<body class="body_top">
<p><span class="forms-title"><?php echo xlt('AfterCare Planning'); ?></span></p>
</br>
<form method=post action="<?php echo attr($rootdir);?>/forms/Aftercareplan/save.php?mode=new">
<table border="0">
<tr>
<td align="left" class="forms" class="forms"><?php echo xlt('Client Name' ); ?>:</td>
<td class="forms">
<label class="forms-data"> <?php if (is_numeric($pid)) {
// Check for no access to the patient's squad.
$result = getPatientData($pid, "fname,lname,squad");
echo htmlspecialchars(xlt('','','','').text($result['fname'])." ".text($result['lname']));}

This comment has been minimized.

Sign in to view

Copy link
@bradymiller

bradymiller Dec 1, 2012

Remove the xlt() function from this line.
$patient_name=text($result['fname'])." ".text($result['lname']);
?>
</label>
<input type="hidden" name="client_name" value="<?php echo attr($patient_name);?>">
</td>
<td align="left" class="forms"><?php echo xlt('DOB'); ?>:</td>
<td class="forms">
<label class="forms-data"> <?php if (is_numeric($pid)) {
// Check for no access to the patient's squad.

This comment has been minimized.

Sign in to view

Copy link
@bradymiller

bradymiller Dec 1, 2012

yank this comment
$result = getPatientData($pid, "*");
echo htmlspecialchars( xlt('','','','') . text($result['DOB']));}

This comment has been minimized.

Sign in to view

Copy link
@bradymiller

bradymiller Dec 1, 2012

Remove the xlt() function from this line.
$dob=text($result['DOB']);

This comment has been minimized.

Sign in to view

Copy link
@bradymiller

bradymiller Dec 1, 2012

remove text function (should not escape the variable; note you are properly escaping it with attr below)
?>
</label>
<input type="hidden" name="DOB" value="<?php echo attr($dob);?>">
</td>
</tr>
<tr>


<td align="left" class="forms"><?php echo xlt('Admit Date','e'); ?>:</td>

This comment has been minimized.

Sign in to view

Copy link
@bradymiller

bradymiller Dec 1, 2012

remove the e parameter

<td class="forms">
<input type='text' size='10' name='admit_date' id='admission_date' <?php echo attr($disabled) ?>;
value='<?php echo attr($viewmode) ? substr($result['date'], 0, 10) : date('Y-m-d'); ?>'

This comment has been minimized.

Sign in to view

Copy link
@bradymiller

bradymiller Dec 1, 2012

Note this is a conditional and you should not be escaping the conditional (attr is not needed on $viewmode)
title='<?php xla('yyyy-mm-dd Date of service','e'); ?>'

This comment has been minimized.

Sign in to view

Copy link
@bradymiller

bradymiller Dec 1, 2012

remove the e parameter and place echo before xla
onkeyup='datekeyup(this,mypcc)' onblur='dateblur(this,mypcc)' />
<img src='../../pic/show_calendar.gif' align='absbottom' width='24' height='22'
id='img_admission_date' border='0' alt='[?]' style='cursor:pointer;cursor:hand'
title='<?php xla('Click here to choose a date','e'); ?>'>

This comment has been minimized.

Sign in to view

Copy link
@bradymiller

bradymiller Dec 1, 2012

remove the e parameter and place echo before xla
</td>


<td align="left" class="forms"><?php echo xlt('Discharged','e'); ?>:</td>
<td class="forms">
<input type='text' size='10' name='discharged' id='discharge_date' <?php echo attr($disabled)?>;
value='<?php echo attr($viewmode) ? substr($result['date'], 0, 10) : date('Y-m-d'); ?>'
title='<?php xla('yyyy-mm-dd Date of service','e'); ?>'
onkeyup='datekeyup(this,mypcc)' onblur='dateblur(this,mypcc)' />
<img src='../../pic/show_calendar.gif' align='absbottom' width='24' height='22'
id='img_discharge_date' border='0' alt='[?]' style='cursor:pointer;cursor:hand'
title='<?php xla('Click here to choose a date','e'); ?>'>

This comment has been minimized.

Sign in to view

Copy link
@bradymiller

bradymiller Dec 1, 2012

Make same changes here as instructed in above date code
</td>
</tr>
<tr>
</tr>
<tr>
<td align="left colspan="3" style="padding-bottom:7px;"></td>
</tr>
<tr>

<td class="forms-subtitle" colspan="4" class="forms-subtitle"><B><?php echo xlt('Goal and Methods');?></B></td>

</tr>
<tr>
<td align="left colspan="3" style="padding-bottom:7px;"></td>
</tr>
<tr>

<td colspan="4" class="forms-subtitle"><B><?php echo xlt('Goal A');?>:&nbsp;<?php echo xlt('Acute Intoxication/Withdrawal'); ?></td>

</tr>
<tr>
<td align="right" class="forms">1.</td>
<td colspan="3"><textarea name="goal_a_acute_intoxication" rows="2" cols="80" wrap="virtual name"></textarea></td>

</tr>
<tr>
<td align="right" class="forms">2.</td>
<td colspan="3"><textarea name="goal_a_acute_intoxication_I" rows="2" cols="80" wrap="virtual name"></textarea></td>

</tr>
<tr>
<td align="right" class="forms">3.</td>
<td colspan="3"><textarea name="goal_a_acute_intoxication_II" rows="2" cols="80" wrap="virtual name"></textarea></td>


<tr>

<td colspan="4" class="forms-subtitle"><B><?php echo xlt('Goal B');?>:</B>&nbsp;<?php echo xlt('Emotional / Behavioral Conditions & Complications'); ?></td>

</tr>
<tr>
<td align="right" class="forms">1.</td>
<td colspan="3"><textarea name="goal_b_emotional_behavioral_conditions" rows="2" cols="80" wrap="virtual name"></textarea></td>

</tr>
<tr>
<td align="right" class="forms">2.</td>
<td colspan="3"><textarea name="goal_b_emotional_behavioral_conditions_I" rows="2" cols="80" wrap="virtual name"></textarea></td>

</tr>


<td colspan="4" class="forms-subtitle"><B><?php echo xlt('Goal C'); ?>:</B>&nbsp;<?php echo xlt('Relapse Potential'); ?></td>

</tr>
<tr>
<td align="right" class="forms">1.</td>
<td colspan="3"><textarea name="goal_c_relapse_potential" rows="2" cols="80" wrap="virtual name"></textarea></td>

</tr>
<tr>
<td align="right" class="forms">2.</td>
<td colspan="3"><textarea name="goal_c_relapse_potential_I" rows="2" cols="80" wrap="virtual name"></textarea></td>

</tr>

<tr>
</tr>
<tr>
<td></td>
<td>
<input type='submit' value='<?php echo xla('Save','e');?>'class="button-css">&nbsp;

This comment has been minimized.

Sign in to view

Copy link
@bradymiller

bradymiller Dec 1, 2012

remove the e parameter
<input type='button' class="button-css" value='<?php echo xla('Cancel','e');?>'

This comment has been minimized.

Sign in to view

Copy link
@bradymiller

bradymiller Dec 1, 2012

remove the e parameter
onclick="top.restoreSession();location='<?php echo "$rootdir/patient_file/encounter/$returnurl" ?>'" /></td>
</tr>
</table>
</form>
<script language="javascript">
/* required for popup calendar */
Calendar.setup({inputField:"admission_date", ifFormat:"%Y-%m-%d", button:"img_admission_date"});
Calendar.setup({inputField:"discharge_date", ifFormat:"%Y-%m-%d", button:"img_discharge_date"});
</script>
<?php
formFooter();
?>
36 changes: 36 additions & 0 deletions interface/forms/Aftercareplan/report.php
View file
@@ -0,0 +1,36 @@

<?php
// Copyright (C) 2012-2013 Naina Mohamed <naina@capminds.com> CapMinds Technologies

This comment has been minimized.

Sign in to view

Copy link
@bradymiller

bradymiller Dec 1, 2012

Use a standard headers()simply cop/paste below and substitute your copyright/author info:
http://www.open-emr.org/wiki/index.php/How_to_Document_Your_Code_Properly#Page-Level_DocBlock

//SANITIZE ALL ESCAPES
$sanitize_all_escapes=true;

//STOP FAKE REGISTER GLOBALS
$fake_register_globals=false;

include_once("../../globals.php");
include_once($GLOBALS["srcdir"]."/api.inc");
function aftercareplan_report( $pid, $encounter, $cols, $id) {
$count = 0;
$data = formFetch("form_aftercareplan", $id);
if ($data) {
print "<table><tr>";
foreach($data as $key => $value) {
if ($key == "id" || $key == "pid" || $key == "user" || $key == "groupname" || $key == "authorized" || $key == "activity" || $key == "date" || $value == "" || $value == "0000-00-00 00:00:00") {
continue;
}
if ($value == "on") {
$value = "yes";
}
$key=ucwords(str_replace("_"," ",$key));
print "<td><span class=bold>$key : </span><span class=text>$value</span></td>";

This comment has been minimized.

Sign in to view

Copy link
@bradymiller

bradymiller Dec 1, 2012

Wrap the $key variable with the xlt() function
$count++;
if ($count == $cols) {
$count = 0;
print "</tr><tr>\n";
}
}
}
print "</tr></table>";
}
?>
39 changes: 39 additions & 0 deletions interface/forms/Aftercareplan/save.php
View file
@@ -0,0 +1,39 @@
<?php
// Copyright (C) 2012-2013 Naina Mohamed <naina@capminds.com> CapMinds Technologies

This comment has been minimized.

Sign in to view

Copy link
@bradymiller

bradymiller Dec 1, 2012

Use a standard headers()simply cop/paste below and substitute your copyright/author info:
http://www.open-emr.org/wiki/index.php/How_to_Document_Your_Code_Properly#Page-Level_DocBlock

This comment has been minimized.

Sign in to view

Copy link
@bradymiller

bradymiller Dec 1, 2012

Place here:
//SANITIZE ALL ESCAPES
$sanitize_all_escapes=true;
//STOP FAKE REGISTER GLOBALS
$fake_register_globals=false;
include_once("../../globals.php");
include_once("$srcdir/api.inc");
include_once("$srcdir/forms.inc");
require_once("$srcdir/htmlspecialchars.inc.php");
require_once("$srcdir/formdata.inc.php");

foreach ($_POST as $k => $var) {
$_POST[$k]= mysql_escape_string($var);
echo "$var\n";
}

This comment has been minimized.

Sign in to view

Copy link
@bradymiller

bradymiller Dec 1, 2012

Remove this entire foreach. The variables are already getting escaped in the formSubmit function or in the code below when updating a form.

This comment has been minimized.

Sign in to view

Copy link
@bradymiller

bradymiller Dec 1, 2012

Actually, wait on this. FormSumbit does not escape, so more thought required.

This comment has been minimized.

Sign in to view

Copy link
@bradymiller

bradymiller Dec 2, 2012

I'm going to quickly fix up the formSubmit function to escape in the main codebase and then will continue this review.

This comment has been minimized.

Sign in to view

Copy link
@bradymiller

bradymiller Dec 22, 2012

Ok, the formSubmit function now will support the new security model. So, remove the entire foreach loop above.
if (attr($encounter) == "")
$encounter = date("Ymd");
if($_GET["mode"] == "new"){
$newid = formSubmit("form_aftercareplan", $_POST, $_GET["id"], $userauthorized);
addForm($encounter, "AfterCare Plan Form", $newid, "aftercareplan", $pid, $userauthorized);
}elseif ($_GET["mode"] == "update") {
sqlInsert("update form_aftercareplan set pid = {$_SESSION["pid"]},groupname='".add_escape_custom($_SESSION["authProvider"])."',user='".add_escape_custom($_SESSION["authUser"])."',authorized=$userauthorized,activity=1, date = NOW(),
provider ='".add_escape_custom($_POST["provider"])."',
admit_date ='".add_escape_custom($_POST["admit_date"])."',
discharged ='".add_escape_custom($_POST["discharged"])."',
goal_a_acute_intoxication ='".add_escape_custom($_POST["goal_a_acute_intoxication"])."',
goal_a_acute_intoxication_I ='".add_escape_custom($_POST["goal_a_acute_intoxication_I"])."',
goal_a_acute_intoxication_II ='".add_escape_custom($_POST["goal_a_acute_intoxication_II"])."',
goal_b_emotional_behavioral_conditions ='".add_escape_custom($_POST["goal_b_emotional_behavioral_conditions"])."',
goal_b_emotional_behavioral_conditions_I ='".add_escape_custom($_POST["goal_b_emotional_behavioral_conditions_I"])."',
goal_c_relapse_potential ='".add_escape_custom($_POST["goal_c_relapse_potential"])."',
goal_c_relapse_potential_I ='".add_escape_custom($_POST["goal_c_relapse_potential_I"])."'
where id=$id");

This comment has been minimized.

Sign in to view

Copy link
@bradymiller

bradymiller Dec 1, 2012

Also wrap id with add_escape_custom() fucntion.

}
$_SESSION["encounter"] = attr($encounter);

This comment has been minimized.

Sign in to view

Copy link
@bradymiller

bradymiller Dec 1, 2012

remove the attr here. attr/text functions are for html escaping stuff (they are using htmlspecialchars function), so no need to escape $encounter here.
formHeader("Redirecting....");
formJump();
formFooter();
?>
27 changes: 27 additions & 0 deletions interface/forms/Aftercareplan/table.sql
View file
@@ -0,0 +1,27 @@
--
-- Table structure for table `form_aftercareplan`
--

CREATE TABLE IF NOT EXISTS `form_aftercareplan` (
`id` bigint(20) NOT NULL AUTO_INCREMENT,
`date` datetime DEFAULT NULL,
`pid` bigint(20) DEFAULT NULL,
`user` varchar(255) DEFAULT NULL,
`provider` varchar(255) DEFAULT NULL,
`groupname` varchar(255) DEFAULT NULL,
`authorized` tinyint(4) DEFAULT NULL,
`activity` tinyint(4) DEFAULT NULL,
`client_name` varchar(255) DEFAULT NULL,
`DOB` date DEFAULT NULL,

This comment has been minimized.

Sign in to view

Copy link
@bradymiller

bradymiller Dec 22, 2012

This means you will have redundant patient id info in the database. A better way to do this would be to not dave the DOB here. But to instead grab it (like you do in new.php) to display it in new.php/view.php and even in report.php (grab it and insert it into the $data array; fake that it was actually grabbed from the form).
`admit_date` date DEFAULT NULL,
`discharged` date DEFAULT NULL,
`goal_a_acute_intoxication` text,
`goal_a_acute_intoxication_I` text,
`goal_a_acute_intoxication_II` text,
`goal_b_emotional_behavioral_conditions` text,
`goal_b_emotional_behavioral_conditions_I` text,
`goal_c_relapse_potential` text,
`goal_c_relapse_potential_I` text,
PRIMARY KEY (`id`)
) ENGINE=InnoDB DEFAULT CHARSET=latin1;

This comment has been minimized.

Sign in to view

Copy link
@bradymiller

bradymiller Dec 22, 2012

Do not force the CHARSET type.

5 comments on commit 09d31cd

@bradymiller
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hi,
I am still in the middle of this review. Plan to continue the review this weekend.
-Brady

@bradymiller
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hi,
Still in process of making changes to the formSubmit function to truly support the new security model in your above forms. Once this is done, I'll then finish this review (guessing will be next weekend). Thanks for being so patient,
-brady

@capmindstech
Copy link
Owner

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Brady,
Sure..We will wait for the moment

Thanks,
Naina.
CapMinds Technologies,
www.capminds.com

@bradymiller
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Aftercareplan form testing:
-Kind of odd to have no spacing in the form title Aftercareplan
-Should consider making the folder name more specific (this seems to be drug-abuse type form)
-It is not working. The stuff I type into the form is not getting saved and white screen of death if try to edit form.

transfersummary form testing:
-Kind of odd to have no spacing in the form title transfersummary
-Diagnses is mispelled

treatmentplan form testing:
-Kind of odd to have no spacing in the form title transfersummary
-Diagnses is mispelled

@bradymiller
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I reviewed the code on Aftercareplan and tested all three forms. I suggest extrapolating my code suggestions from the Aftercareplan form to the other two for your next code revision. I look forward to seeing the next code revision.
thanks for being so patient,
-brady

Please sign in to comment.