Accounting account can upload file as Admin account

[khanhnv-2091]

I just discovered a vulnerability that allows an accounting account to upload files like an admin account
POC: https://drive.google.com/file/d/1uMVhHLkvf5bdAt0__vq8wG1hcHAaHALy/view?usp=sharing
If you need any further information don't hesitate to email me: nguyenkhanh.actvn@gmail.com

[fabriziofadigati]

Hi @khanhnv-2091,
I tried to replicate the steps from the video but I see OpenEMR is completely different now.
There is no an accounting account (now it's called accountant).

@tywrenn I think the issue could be closed

[tywrenn]

@sjpadgett Can u help me verify that this issue was fixed? I've been working a full-time job and barely have spare time on this nowadays lol