portal fixes (#1795)

openemr · Aug 12, 2018 · 4963fe4 · 4963fe4
1 parent a9bc357
commit 4963fe4
Show file tree

Hide file tree

Showing 3 changed files with 9 additions and 6 deletions.
diff --git a/portal/index.php b/portal/index.php
@@ -349,7 +349,7 @@ function validate_new_pass() {
 
 <?php // if something went wrong
 if (isset($_GET['requestNew'])) {
-    $_SESSION['patient_portal_onsite_two'] = true;
+    $_SESSION['register'] = true;
     $_SESSION['authUser'] = 'portal-user';
     $_SESSION['pid'] = true;
     ?>

diff --git a/portal/lib/appsql.class.php b/portal/lib/appsql.class.php
@@ -169,7 +169,7 @@ public function portalAudit($type = 'insert', $rec = '', array $auditvals, $oelo
                 $logsql = "update onsite_portal_activity set date=?, patient_id=?, activity=?, require_audit=?,".
                         "            pending_action=?, action_taken=?,status=?, narrative=?, table_action=?, table_args=?,".
                                         "action_user=?, action_taken_time=?, checksum=? ";
-                $logsql .= "where id=".$rec ." And patient_id=".$audit['patient_id'];
+                $logsql .= "where id='" . add_escape_custom($rec) . "' And patient_id='" . add_escape_custom($audit['patient_id']) . "'";
             }
 
             $return = sqlStatementNoLog($logsql, $audit);

diff --git a/portal/lib/download_template.php b/portal/lib/download_template.php
@@ -128,10 +128,10 @@ function doSubs($s)
     $nextLocation = 0;
     $groupLevel = 0;
     $groupCount = 0;
-    
+
     while (($keyLocation = strpos($s, '{', $nextLocation)) !== false) {
         $nextLocation = $keyLocation + 1;
-        
+
         if (keySearch($s, '{PatientSignature}')) {
             $fn = $GLOBALS['web_root'] . '/portal/sign/assets/signhere.png';
             $sigfld = '<span>';
@@ -231,7 +231,7 @@ function doSubs($s)
             $patientid = $ptrow['pid'];
             $DOS = substr($enrow['date'], 0, 10);
             // Prefer appointment comment if one is present.
-            $evlist = fetchEvents($DOS, $DOS, " AND pc_pid = '$patientid' ");
+            $evlist = fetchEvents($DOS, $DOS, " AND pc_pid = ? ", null, false, 0, array($patientid));
             foreach ($evlist as $tmp) {
                 if ($tmp['pc_pid'] == $pid && ! empty($tmp['pc_hometext'])) {
                     $cc = $tmp['pc_hometext'];
@@ -345,7 +345,7 @@ function doSubs($s)
             $s = keyReplace($s, dataFixup($data, $title));
         }
     } // End if { character found.
-    
+
     return $s;
 }
 // Get patient demographic info.
@@ -368,9 +368,12 @@ function doSubs($s)
 }
 
 $templatedir = $GLOBALS['OE_SITE_DIR'] . '/documents/onsite_portal_documents/templates';
+
+check_file_dir_name($form_filename);
 $templatepath = "$templatedir/$form_filename";
 // test if this is folder with template, if not, must be for a specific patient
 if (! file_exists($templatepath)) {
+    check_file_dir_name($pid);
     $templatepath = "$templatedir/" . $pid . "/$form_filename";
 }