CVE-2023-2943: Improper Control of Generation of Code ('Code Injection') (CWE-94)
value: Code Injection in GitHub repository openemr/openemr prior to 7.0.1.
CWE description: The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
CVSS v3 base score: 8.8
Published: 2023-05-27T22:15Z
Repository: https://github.com/openemr/openemr
Language: PHP
Files changed: library/pnotes.inc.php, portal/add_edit_event_user.php, portal/find_appt_popup_user.php, portal/messaging/secure_chat.php, src/PatientPortal/Chat/ChatController.php
Commit date: 2023-01-15 20:32:38 -0500
Commit message: bug fix (#6079)

* bug fix

* better fix and remove prefix underscore private visibility

* better fix

* even better fix

* revert

* jsAttr()

* another fix

* another fix

* use |=

* review fixes

* typo

* remove whitespace
Diff: diff --git a/library/pnotes.inc.php b/library/pnotes.inc.php
index b0bf000c5b0..b9aa83877d7 100644
--- a/library/pnotes.inc.php
+++ b/library/pnotes.inc.php
@@ -387,11 +387,11 @@ function addPnote(
 
     return sqlInsert(
         'INSERT INTO pnotes (date, body, pid, user, groupname, ' .
         'authorized, activity, title, assigned_to, message_status, update_by, update_date) VALUES ' .
         '(?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, NOW())',
-        array($datetime, $body, $pid, $user, $_SESSION['authProvider'], $authorized, $activity, $title, $assigned_to, $message_status, $_SESSION['authUserID'])
+        array($datetime, $body, $pid, $user, ($_SESSION['authProvider'] ?? null), $authorized, $activity, $title, $assigned_to, $message_status, ($_SESSION['authUserID'] ?? null))
     );
 }
 
 function addMailboxPnote(
     $pid,
diff --git a/portal/add_edit_event_user.php b/portal/add_edit_event_user.php
index f6879a76637..254ef464456 100644
--- a/portal/add_edit_event_user.php
+++ b/portal/add_edit_event_user.php
@@ -41,11 +41,11 @@ global $ignoreAuth_onsite_portal;
 require_once("../interface/globals.php");
 require_once("$srcdir/patient.inc.php");
 require_once("$srcdir/forms.inc.php");
 require_once("$srcdir/appointments.inc.php");
 
-use OpenEMR\Core\Header;
+use OpenEMR\Services\AppointmentService;
 
 // Things that might be passed by our opener.
 //
 $eid = $_GET['eid'] ?? null;         // only for existing events
 $date = $_GET['date'] ?? null;        // this and below only for new events
@@ -62,10 +62,28 @@ $checkEidInAppt = array_search($eid, array_column($patient_appointments, 'pc_eid
 if (!empty($eid) && !$checkEidInAppt) {
     echo js_escape("error");
     exit();
 }
 
+if (!empty($_POST['form_pid'])) {
+    if ($_POST['form_pid'] != $_SESSION['pid']) {
+        echo js_escape("error");
+        exit();
+    }
+
+    if (! getAvailableSlots($_POST['form_date'], date('Y-m-d', strtotime("+1 year " . $_POST['form_date'])), $_POST['form_provider_ae'])) {
+        echo js_escape("error");
+        exit();
+    }
+
+    $appointment_service = (new AppointmentService())->getOneCalendarCategory($_POST['form_category']);
+    if (($_POST['form_duration'] * 60) != ($appointment_service[0]['pc_duration'])) {
+        echo js_escape("error");
+        exit();
+    }
+}
+
 if ($date) {
     $date = substr($date, 0, 4) . '-' . substr($date, 4, 2) . '-' . substr($date, 6);
 } else {
     $date = date("Y-m-d");
 }
@@ -133,11 +151,11 @@ if (($_POST['form_action'] ?? null) == "save") {
 //print_r($_POST);
 //exit();
     $event_date = fixDate($_POST['form_date']);
 
 // Compute start and end time strings to be saved.
-    if ($_POST['form_allday']) {
+    if ($_POST['form_allday'] ?? null) {
         $tmph = 0;
         $tmpm = 0;
         $duration = 24 * 60;
     } else {
         $tmph = $_POST['form_hour'] + 0;
@@ -163,11 +181,11 @@ if (($_POST['form_action'] ?? null) == "save") {
     $locationspec = 'a:6:{s:14:"event_location";N;s:13:"event_street1";N;' .
         's:13:"event_street2";N;s:10:"event_city";N;s:11:"event_state";N;s:12:"event_postal";N;}';
 
 // More garbage, but this time 1 character of it is used to save the
 // repeat type.
-    if ($_POST['form_repeat']) {
+    if ($_POST['form_repeat'] ?? null) {
         $recurrspec = 'a:5:{' .
             's:17:"event_repeat_freq";s:1:"' . $_POST['form_repeat_freq'] . '";' .
             's:22:"event_repeat_freq_type";s:1:"' . $_POST['form_repeat_type'] . '";' .
             's:19:"event_repeat_on_num";s:1:"1";' .
             's:19:"event_repeat_on_day";s:1:"0";' .
@@ -183,11 +201,11 @@ if (($_POST['form_action'] ?? null) == "save") {
 
 //The modification of the start date for events that take place on one day of the week
 //for example monday, or thursday. We set the start date on the first day of the week
 //that the event is scheduled. For example if you set the event to repeat on each monday
 //the start date of the event will be set on the first monday after the day the event is scheduled
-    if ($_POST['form_repeat_type'] == 5) {
+    if (($_POST['form_repeat_type'] ?? null) == 5) {
         $exploded_date = explode("-", $event_date);
         $edate = date("D", mktime(0, 0, 0, $exploded_date[1], $exploded_date[2], $exploded_date[0]));
         if ($edate == "Tue") {
             $event_date = date("Y-m-d", mktime(0, 0, 0, $exploded_date[1], $exploded_date[2] + 6, $exploded_date[0]));
         } elseif ($edate == "Wed") {
@@ -199,11 +217,11 @@ if (($_POST['form_action'] ?? null) == "save") {
         } elseif ($edate == "Sat") {
             $event_date = date("Y-m-d", mktime(0, 0, 0, $exploded_date[1], $exploded_date[2] + 2, $exploded_date[0]));
         } elseif ($edate == "Sun") {
             $event_date = date("Y-m-d", mktime(0, 0, 0, $exploded_date[1], $exploded_date[2] + 1, $exploded_date[0]));
         }
-    } elseif ($_POST['form_repeat_type'] == 6) {
+    } elseif (($_POST['form_repeat_type'] ?? null) == 6) {
         $exploded_date = explode("-", $event_date);
         $edate = date("D", mktime(0, 0, 0, $exploded_date[1], $exploded_date[2], $exploded_date[0]));
         if ($edate == "Wed") {
             $event_date = date("Y-m-d", mktime(0, 0, 0, $exploded_date[1], $exploded_date[2] + 6, $exploded_date[0]));
         } elseif ($edate == "Thu") {
@@ -215,11 +233,11 @@ if (($_POST['form_action'] ?? null) == "save") {
         } elseif ($edate == "Sun") {
             $event_date = date("Y-m-d", mktime(0, 0, 0, $exploded_date[1], $exploded_date[2] + 2, $exploded_date[0]));
         } elseif ($edate == "Mon") {
             $event_date = date("Y-m-d", mktime(0, 0, 0, $exploded_date[1], $exploded_date[2] + 1, $exploded_date[0]));
         }
-    } elseif ($_POST['form_repeat_type'] == 7) {
+    } elseif (($_POST['form_repeat_type'] ?? null) == 7) {
         $exploded_date = explode("-", $event_date);
         $edate = date("D", mktime(0, 0, 0, $exploded_date[1], $exploded_date[2], $exploded_date[0]));
         if ($edate == "Thu") {
             $event_date = date("Y-m-d", mktime(0, 0, 0, $exploded_date[1], $exploded_date[2] + 6, $exploded_date[0]));
         } elseif ($edate == "Fri") {
@@ -231,11 +249,11 @@ if (($_POST['form_action'] ?? null) == "save") {
         } elseif ($edate == "Mon") {
             $event_date = date("Y-m-d", mktime(0, 0, 0, $exploded_date[1], $exploded_date[2] + 2, $exploded_date[0]));
         } elseif ($edate == "Tue") {
             $event_date = date("Y-m-d", mktime(0, 0, 0, $exploded_date[1], $exploded_date[2] + 1, $exploded_date[0]));
         }
-    } elseif ($_POST['form_repeat_type'] == 8) {
+    } elseif (($_POST['form_repeat_type'] ?? null) == 8) {
         $exploded_date = explode("-", $event_date);
         $edate = date("D", mktime(0, 0, 0, $exploded_date[1], $exploded_date[2], $exploded_date[0]));
         if ($edate == "Fri") {
             $event_date = date("Y-m-d", mktime(0, 0, 0, $exploded_date[1], $exploded_date[2] + 6, $exploded_date[0]));
         } elseif ($edate == "Sat") {
@@ -247,11 +265,11 @@ if (($_POST['form_action'] ?? null) == "save") {
         } elseif ($edate == "Tue") {
             $event_date = date("Y-m-d", mktime(0, 0, 0, $exploded_date[1], $exploded_date[2] + 2, $exploded_date[0]));
         } elseif ($edate == "Wed") {
             $event_date = date("Y-m-d", mktime(0, 0, 0, $exploded_date[1], $exploded_date[2] + 1, $exploded_date[0]));
         }
-    } elseif ($_POST['form_repeat_type'] == 9) {
+    } elseif (($_POST['form_repeat_type'] ?? null) == 9) {
         $exploded_date = explode("-", $event_date);
         $edate = date("D", mktime(0, 0, 0, $exploded_date[1], $exploded_date[2], $exploded_date[0]));
         if ($edate == "Sat") {
             $event_date = date("Y-m-d", mktime(0, 0, 0, $exploded_date[1], $exploded_date[2] + 6, $exploded_date[0]));
         } elseif ($edate == "Sun") {
@@ -303,11 +321,11 @@ if (($_POST['form_action'] ?? null) == "save") {
                     sqlStatement("INSERT INTO openemr_postcalendar_events ( pc_catid, pc_multiple, pc_aid, pc_pid, pc_title, pc_time, pc_hometext, pc_informant, pc_eventDate, pc_endDate, pc_duration, pc_recurrtype, pc_recurrspec, pc_startTime, pc_endTime, pc_alldayevent, pc_apptstatus, pc_prefcatid, pc_location, pc_eventstatus, pc_sharing, pc_facility)
             VALUES ( " .
                         "'" . add_escape_custom($_POST['form_category']) . "', " .
                         "'" . add_escape_custom($row['pc_multiple']) . "', " .
                         "'" . add_escape_custom($to_be_inserted) . "', " .
-                        "'" . add_escape_custom($_POST['form_pid']) . "', " .
+                        "'" . add_escape_custom($_SESSION['pid']) . "', " .
                         "'" . add_escape_custom($_POST['form_title']) . "', " .
                         "NOW(), " .
                         "'" . add_escape_custom($_POST['form_comments']) . "', " .
                         "'" . add_escape_custom($_SESSION['providerId']) . "', " .
                         "'" . add_escape_custom($event_date) . "', " .
@@ -330,11 +348,11 @@ if (($_POST['form_action'] ?? null) == "save") {
             // after the two diffs above, we must update for remaining providers
             // those who are intersected in $providers_current and $providers_new
             foreach ($_POST['form_provider_ae'] as $provider) {
                 sqlStatement("UPDATE openemr_postcalendar_events SET " .
                     "pc_catid = '" . add_escape_custom($_POST['form_category']) . "', " .
-                    "pc_pid = '" . add_escape_custom($_POST['form_pid']) . "', " .
+                    "pc_pid = '" . add_escape_custom($_SESSION['pid']) . "', " .
                     "pc_title = '" . add_escape_custom($_POST['form_title']) . "', " .
                     "pc_time = NOW(), " .
                     "pc_hometext = '" . add_escape_custom($_POST['form_comments']) . "', " .
                     "pc_informant = '" . add_escape_custom($_SESSION['providerId']) . "', " .
                     "pc_eventDate = '" . add_escape_custom($event_date) . "', " .
@@ -363,26 +381,26 @@ if (($_POST['form_action'] ?? null) == "save") {
             $insert = false;
             // simple provider case
             sqlStatement("UPDATE openemr_postcalendar_events SET " .
                 "pc_catid = '" . add_escape_custom($_POST['form_category']) . "', " .
                 "pc_aid = '" . add_escape_custom($prov) . "', " .
-                "pc_pid = '" . add_escape_custom($_POST['form_pid']) . "', " .
+                "pc_pid = '" . add_escape_custom($_SESSION['pid']) . "', " .
                 "pc_title = '" . add_escape_custom($_POST['form_title']) . "', " .
                 "pc_time = NOW(), " .
                 "pc_hometext = '" . add_escape_custom($_POST['form_comments']) . "', " .
                 "pc_informant = '" . add_escape_custom($_SESSION['providerId']) . "', " .
                 "pc_eventDate = '" . add_escape_custom($event_date) . "', " .
-                "pc_endDate = '" . add_escape_custom(fixDate($_POST['form_enddate'])) . "', " .
+                "pc_endDate = '" . add_escape_custom(fixDate($_POST['form_enddate'] ?? '')) . "', " .
                 "pc_duration = '" . add_escape_custom(($duration * 60)) . "', " .
-                "pc_recurrtype = '" . ($_POST['form_repeat'] ? '1' : '0') . "', " .
+                "pc_recurrtype = '" . (($_POST['form_repeat'] ?? null) ? '1' : '0') . "', " .
                 "pc_recurrspec = '" . add_escape_custom($recurrspec) . "', " .
                 "pc_startTime = '" . add_escape_custom($starttime) . "', " .
                 "pc_endTime = '" . add_escape_custom($endtime) . "', " .
-                "pc_alldayevent = '" . add_escape_custom($_POST['form_allday']) . "', " .
+                "pc_alldayevent = '" . add_escape_custom(($_POST['form_allday'] ?? '')) . "', " .
                 "pc_apptstatus = '" . add_escape_custom($_POST['form_apptstatus']) . "', " .
-                "pc_prefcatid = '" . add_escape_custom($_POST['form_prefcat']) . "', " .
-                "pc_facility = '" . (int)$_POST['facility'] . "' " . // FF stuff
+                "pc_prefcatid = '" . add_escape_custom(($_POST['form_prefcat'] ?? '')) . "', " .
+                "pc_facility = '" . (int)($_POST['facility'] ?? null) . "' " . // FF stuff
                 "WHERE pc_eid = '" . add_escape_custom($eid) . "'");
         }
 
         // =======================================
         // EOS multi providers case
@@ -414,11 +432,11 @@ if (($_POST['form_action'] ?? null) == "save") {
                     "pc_apptstatus, pc_prefcatid, pc_location, pc_eventstatus, pc_sharing, pc_facility " .
                     ") VALUES ( " .
                     "'" . add_escape_custom($_POST['form_category']) . "', " .
                     "'" . add_escape_custom($new_multiple_value) . "', " .
                     "'" . add_escape_custom($provider) . "', " .
-                    "'" . add_escape_custom($_POST['form_pid']) . "', " .
+                    "'" . add_escape_custom($_SESSION['pid']) . "', " .
                     "'" . add_escape_custom($_POST['form_title']) . "', " .
                     "NOW(), " .
                     "'" . add_escape_custom($_POST['form_comments']) . "', " .
                     "'" . add_escape_custom($_SESSION['providerId']) . "', " .
                     "'" . add_escape_custom($event_date) . "', " .
@@ -444,28 +462,28 @@ if (($_POST['form_action'] ?? null) == "save") {
                 "pc_recurrspec, pc_startTime, pc_endTime, pc_alldayevent, " .
                 "pc_apptstatus, pc_prefcatid, pc_location, pc_eventstatus, pc_sharing, pc_facility " .
                 ") VALUES ( " .
                 "'" . add_escape_custom($_POST['form_category']) . "', " .
                 "'" . add_escape_custom($_POST['form_provider_ae']) . "', " .
-                "'" . add_escape_custom($_POST['form_pid']) . "', " .
+                "'" . add_escape_custom($_SESSION['pid']) . "', " .
                 "'" . add_escape_custom($_POST['form_title']) . "', " .
                 "NOW(), " .
                 "'" . add_escape_custom($_POST['form_comments']) . "', " .
                 "'" . add_escape_custom($_SESSION['providerId']) . "', " .
                 "'" . add_escape_custom($event_date) . "', " .
-                "'" . add_escape_custom(fixDate($_POST['form_enddate'])) . "', " .
+                "'" . add_escape_custom(fixDate(($_POST['form_enddate'] ?? ''))) . "', " .
                 "'" . add_escape_custom(($duration * 60)) . "', " .
-                "'" . ($_POST['form_repeat'] ? '1' : '0') . "', " .
+                "'" . (($_POST['form_repeat'] ?? null) ? '1' : '0') . "', " .
                 "'" . add_escape_custom($recurrspec) . "', " .
                 "'" . add_escape_custom($starttime) . "', " .
                 "'" . add_escape_custom($endtime) . "', " .
-                "'" . add_escape_custom($_POST['form_allday']) . "', " .
+                "'" . add_escape_custom(($_POST['form_allday'] ?? '')) . "', " .
                 "'" . add_escape_custom($_POST['form_apptstatus']) . "', " .
-                "'" . add_escape_custom($_POST['form_prefcat']) . "', " .
+                "'" . add_escape_custom(($_POST['form_prefcat'] ?? null)) . "', " .
                 "'" . add_escape_custom($locationspec) . "', " .
                 "1, " .
-                "1, " . (int)$_POST['facility'] . ")"); // FF stuff
+                "1, " . (int)($_POST['facility'] ?? null) . ")"); // FF stuff
         } // INSERT single
     } // else - insert
 } elseif (($_POST['form_action'] ?? null) == "delete") {
 // =======================================
 //  multi providers case
@@ -494,11 +512,11 @@ if (!empty($_POST['form_action'])) {
     $note .= $_SESSION['ptName'] . " " . xl("regarding appointment dated") . " " . $event_date . " " . $starttime . ". ";
     $note .= !empty($_POST['form_comments']) ? (xl("Reason") . " " . $_POST['form_comments']) : "";
     $note .= ". " . xl("Use Portal Dashboard to confirm with patient.");
     $title = xl("Patient Reminders");
     $user = sqlQueryNoLog("SELECT users.username FROM users WHERE authorized = 1 And id = ?", array($_POST['form_provider_ae']));
-    $rtn = addPnote($_POST['form_pid'], $note, 1, 1, $title, $user['username'], '', 'New');
+    $rtn = addPnote($_SESSION['pid'], $note, 1, 1, $title, $user['username'], '', 'New');
 
     $_SESSION['whereto'] = '#appointmentcard';
     header('Location:./home.php');
     exit();
 }
@@ -655,16 +673,16 @@ if ($userid) {
 <body class="skin-blue">
     <div class="container-fluid">
         <form method='post' name='theaddform' id='theaddform' action='add_edit_event_user.php?eid=<?php echo attr_url($eid); ?>'>
             <div class="col-12">
                 <input type="hidden" name="form_action" id="form_action" value="" />
-                <input type='hidden' name='form_title' id='form_title' value='<?php echo $row['pc_catid'] ? attr($row['pc_title']) : xla("Office Visit"); ?>' />
-                <input type='hidden' name='form_apptstatus' id='form_apptstatus' value='<?php echo $row['pc_apptstatus'] ? attr($row['pc_apptstatus']) : "^" ?>' />
+                <input type='hidden' name='form_title' id='form_title' value='<?php echo ($row['pc_catid'] ?? '') ? attr($row['pc_title']) : xla("Office Visit"); ?>' />
+                <input type='hidden' name='form_apptstatus' id='form_apptstatus' value='<?php echo ($row['pc_apptstatus'] ?? '') ? attr($row['pc_apptstatus'] ?? '') : "^" ?>' />
                 <div class="row form-group">
                     <div class="input-group col-12 col-md-6">
                         <label class="mr-2" for="form_category"><?php echo xlt('Visit'); ?>:</label>
-                        <select class="form-control mb-1" onchange='set_category()' id='form_category' name='form_category' value='<?php echo ($row['pc_catid'] > "") ? attr($row['pc_catid']) : '5'; ?>'>
+                        <select class="form-control mb-1" onchange='set_category()' id='form_category' name='form_category' value='<?php echo (($row['pc_catid'] ?? '') > "") ? attr($row['pc_catid']) : '5'; ?>'>
                             <?php echo $catoptions ?>
                         </select>
                     </div>
                     <div class="input-group col-12 col-md-6">
                         <label class="mr-2" for="form_date"><?php echo xlt('Date'); ?>:</label>
@@ -682,11 +700,11 @@ if ($userid) {
                                 <option value='2'<?php echo ($startampm == '2') ? " selected" : ""; ?>><?php echo xlt('PM'); ?></option>
                             </select>
                         </div>
                         <div class="input-group">
                             <label class="mr-2" for="form_duration"><?php echo xlt('Duration'); ?></label>
-                            <input class="form-control" type='text' size='1' id='form_duration' name='form_duration' value='<?php echo $row['pc_duration'] ? ($row['pc_duration'] * 1 / 60) : attr($thisduration) ?>' readonly />
+                            <input class="form-control" type='text' size='1' id='form_duration' name='form_duration' value='<?php echo ($row['pc_duration'] ?? '') ? ($row['pc_duration'] * 1 / 60) : attr($thisduration) ?>' readonly />
                             <span class="input-group-append">
                             <span class="input-group-text"><?php echo "&nbsp;" . xlt('minutes'); ?></span>
                         </span>
                         </div>
                     </div>
@@ -728,11 +746,11 @@ if ($userid) {
                         <label class="mr-2"><?php echo xlt('Reason'); ?>:</label>
                         <input class="form-control" type='text' size='40' name='form_comments' value='<?php echo attr($hometext); ?>' title='<?php echo xla('Optional information about this event'); ?>' />
                     </div>
                 </div>
                 <div class="row input-group my-1">
-                    <?php if ($_GET['eid'] && $row['pc_apptstatus'] !== 'x') { ?>
+                    <?php if (($_GET['eid'] ?? null) && $row['pc_apptstatus'] !== 'x') { ?>
                         <input type='button' id='form_cancel' class='btn btn-danger' onsubmit='return false' value='<?php echo xla('Cancel Appointment'); ?>' onclick="cancel_appointment()" />
                     <?php } ?>
                     <input type='button' name='form_save' class='btn btn-success' onsubmit='return false' value='<?php echo xla('Save'); ?>' onclick="validate()" />
                 </div>
             </div>
diff --git a/portal/find_appt_popup_user.php b/portal/find_appt_popup_user.php
index 012616e7d84..a9468ca849f 100644
--- a/portal/find_appt_popup_user.php
+++ b/portal/find_appt_popup_user.php
@@ -79,14 +79,18 @@ function doOneDay($catid, $udate, $starttime, $duration, $prefcatid)
         if ($catid == 2) {        // in office
             // If a category ID was specified when this popup was invoked, then select
             // only IN events with a matching preferred category or with no preferred
             // category; other IN events are to be treated as OUT events.
             if ($input_catid) {
-                if ($prefcatid == $input_catid || !$prefcatid) {
-                    $slots[$i] |= 1;
+                if (!empty($slots[$i])) {
+                    if ($prefcatid == $input_catid || !$prefcatid) {
+                        $slots[$i] |= 1;
+                    } else {
+                        $slots[$i] |= 2;
+                    }
                 } else {
-                    $slots[$i] |= 2;
+                    $slots[$i] |= 1;
                 }
             } else {
                 $slots[$i] |= 1;
             }
 
@@ -112,11 +116,11 @@ if ($input_catid) {
 }
 
 $info_msg = "";
 
 $searchdays = 7; // default to a 1-week lookahead
-if ($_REQUEST['searchdays']) {
+if ($_REQUEST['searchdays'] ?? null) {
     $searchdays = $_REQUEST['searchdays'];
 }
 
 // Get a start date.
 if (
diff --git a/portal/messaging/secure_chat.php b/portal/messaging/secure_chat.php
index 2f21efa7309..26db9ea9c8c 100644
--- a/portal/messaging/secure_chat.php
+++ b/portal/messaging/secure_chat.php
@@ -404,11 +404,11 @@ $msgApp = new ChatController();
             $scope.playAudio = function () {
                 $scope.beep && $scope.beep.play();
             };
 
             $scope.renderMessageBody = function (html) {
-                return html;
+                return jsAttr(html);
             };
             $scope.init();
         }]);
     })();
 </script>
diff --git a/src/PatientPortal/Chat/ChatController.php b/src/PatientPortal/Chat/ChatController.php
index 61d07112580..6ffb0f92cb6 100644
--- a/src/PatientPortal/Chat/ChatController.php
+++ b/src/PatientPortal/Chat/ChatController.php
@@ -65,24 +65,24 @@ class ChatController extends ChatDispatcher
             $result = array(
                 'success' => $this->getModel()->addMessage($cleanUsername, $message, $ip, $senderid, $recipid)
             );
         }
 
-        if ($this->_isAdmin($username)) {
-            $this->_parseAdminCommand($message);
+        if ($this->isAdmin($username)) {
+            $this->parseAdminCommand($message);
         }
 
         $this->setHeader(array('Content-Type' => 'application/json'));
         return json_encode($result);
     }
 
-    private function _isAdmin($username)
+    private function isAdmin($username)
     {
         return (bool)IS_DASHBOARD;
     }
 
-    private function _parseAdminCommand($message)
+    private function parseAdminCommand($message)
     {
         if (str_contains($message, '/clear')) {
             $this->getModel()->removeMessages();
             return true;
         }
@@ -98,11 +98,11 @@ class ChatController extends ChatDispatcher
             $this->getModel()->addMessage('Admin Command', $message, '0.0.0.0');
             return true;
         }
     }
 
-    private function _getMyUniqueHash()
+    private function getMyUniqueHash()
     {
         $unique = $this->getServer('REMOTE_ADDR');
         $unique .= $this->getServer('HTTP_USER_AGENT');
         $unique .= $this->getServer('HTTP_ACCEPT_LANGUAGE');
         $unique .= C_USER;
@@ -110,11 +110,11 @@ class ChatController extends ChatDispatcher
     }
 
     public function pingAction()
     {
         $ip = $this->getServer('REMOTE_ADDR');
-        $hash = $this->_getMyUniqueHash();
+        $hash = $this->getMyUniqueHash();
         $user = $this->getRequest('username', 'No Username');
         if ($user == 'currentol') {
             $onlines = $this->getModel()->getOnline(false);
             $this->setHeader(array('Content-Type' => 'application/json'));
             return json_encode($onlines);

Vulnerable code:         array($datetime, $body, $pid, $user, $_SESSION['authProvider'], $authorized, $activity, $title, $assigned_to, $message_status, $_SESSION['authUserID'])
use OpenEMR\Core\Header;
    if ($_POST['form_allday']) {
    if ($_POST['form_repeat']) {
    if ($_POST['form_repeat_type'] == 5) {
    } elseif ($_POST['form_repeat_type'] == 6) {
    } elseif ($_POST['form_repeat_type'] == 7) {
    } elseif ($_POST['form_repeat_type'] == 8) {
    } elseif ($_POST['form_repeat_type'] == 9) {
                        "'" . add_escape_custom($_POST['form_pid']) . "', " .
                    "pc_pid = '" . add_escape_custom($_POST['form_pid']) . "', " .
                "pc_pid = '" . add_escape_custom($_POST['form_pid']) . "', " .
                "pc_endDate = '" . add_escape_custom(fixDate($_POST['form_enddate'])) . "', " .
                "pc_recurrtype = '" . ($_POST['form_repeat'] ? '1' : '0') . "', " .
                "pc_alldayevent = '" . add_escape_custom($_POST['form_allday']) . "', " .
                "pc_prefcatid = '" . add_escape_custom($_POST['form_prefcat']) . "', " .
                "pc_facility = '" . (int)$_POST['facility'] . "' " . // FF stuff
                    "'" . add_escape_custom($_POST['form_pid']) . "', " .
                "'" . add_escape_custom($_POST['form_pid']) . "', " .
                "'" . add_escape_custom(fixDate($_POST['form_enddate'])) . "', " .
                "'" . ($_POST['form_repeat'] ? '1' : '0') . "', " .
                "'" . add_escape_custom($_POST['form_allday']) . "', " .
                "'" . add_escape_custom($_POST['form_prefcat']) . "', " .
                "1, " . (int)$_POST['facility'] . ")"); // FF stuff
    $rtn = addPnote($_POST['form_pid'], $note, 1, 1, $title, $user['username'], '', 'New');
                <input type='hidden' name='form_title' id='form_title' value='<?php echo $row['pc_catid'] ? attr($row['pc_title']) : xla("Office Visit"); ?>' />
                <input type='hidden' name='form_apptstatus' id='form_apptstatus' value='<?php echo $row['pc_apptstatus'] ? attr($row['pc_apptstatus']) : "^" ?>' />
                        <select class="form-control mb-1" onchange='set_category()' id='form_category' name='form_category' value='<?php echo ($row['pc_catid'] > "") ? attr($row['pc_catid']) : '5'; ?>'>
                            <input class="form-control" type='text' size='1' id='form_duration' name='form_duration' value='<?php echo $row['pc_duration'] ? ($row['pc_duration'] * 1 / 60) : attr($thisduration) ?>' readonly />
                    <?php if ($_GET['eid'] && $row['pc_apptstatus'] !== 'x') { ?>
                if ($prefcatid == $input_catid || !$prefcatid) {
                    $slots[$i] |= 1;
                    $slots[$i] |= 2;
if ($_REQUEST['searchdays']) {
                return html;
        if ($this->_isAdmin($username)) {
            $this->_parseAdminCommand($message);
    private function _isAdmin($username)
    private function _parseAdminCommand($message)
    private function _getMyUniqueHash()
        $hash = $this->_getMyUniqueHash();
Fixed code:         array($datetime, $body, $pid, $user, ($_SESSION['authProvider'] ?? null), $authorized, $activity, $title, $assigned_to, $message_status, ($_SESSION['authUserID'] ?? null))
use OpenEMR\Services\AppointmentService;
if (!empty($_POST['form_pid'])) {
    if ($_POST['form_pid'] != $_SESSION['pid']) {
        echo js_escape("error");
        exit();
    }

    if (! getAvailableSlots($_POST['form_date'], date('Y-m-d', strtotime("+1 year " . $_POST['form_date'])), $_POST['form_provider_ae'])) {
        echo js_escape("error");
        exit();
    }

    $appointment_service = (new AppointmentService())->getOneCalendarCategory($_POST['form_category']);
    if (($_POST['form_duration'] * 60) != ($appointment_service[0]['pc_duration'])) {
        echo js_escape("error");
        exit();
    }
}

    if ($_POST['form_allday'] ?? null) {
    if ($_POST['form_repeat'] ?? null) {
    if (($_POST['form_repeat_type'] ?? null) == 5) {
    } elseif (($_POST['form_repeat_type'] ?? null) == 6) {
    } elseif (($_POST['form_repeat_type'] ?? null) == 7) {
    } elseif (($_POST['form_repeat_type'] ?? null) == 8) {
    } elseif (($_POST['form_repeat_type'] ?? null) == 9) {
                        "'" . add_escape_custom($_SESSION['pid']) . "', " .
                    "pc_pid = '" . add_escape_custom($_SESSION['pid']) . "', " .
                "pc_pid = '" . add_escape_custom($_SESSION['pid']) . "', " .
                "pc_endDate = '" . add_escape_custom(fixDate($_POST['form_enddate'] ?? '')) . "', " .
                "pc_recurrtype = '" . (($_POST['form_repeat'] ?? null) ? '1' : '0') . "', " .
                "pc_alldayevent = '" . add_escape_custom(($_POST['form_allday'] ?? '')) . "', " .
                "pc_prefcatid = '" . add_escape_custom(($_POST['form_prefcat'] ?? '')) . "', " .
                "pc_facility = '" . (int)($_POST['facility'] ?? null) . "' " . // FF stuff
                    "'" . add_escape_custom($_SESSION['pid']) . "', " .
                "'" . add_escape_custom($_SESSION['pid']) . "', " .
                "'" . add_escape_custom(fixDate(($_POST['form_enddate'] ?? ''))) . "', " .
                "'" . (($_POST['form_repeat'] ?? null) ? '1' : '0') . "', " .
                "'" . add_escape_custom(($_POST['form_allday'] ?? '')) . "', " .
                "'" . add_escape_custom(($_POST['form_prefcat'] ?? null)) . "', " .
                "1, " . (int)($_POST['facility'] ?? null) . ")"); // FF stuff
    $rtn = addPnote($_SESSION['pid'], $note, 1, 1, $title, $user['username'], '', 'New');
                <input type='hidden' name='form_title' id='form_title' value='<?php echo ($row['pc_catid'] ?? '') ? attr($row['pc_title']) : xla("Office Visit"); ?>' />
                <input type='hidden' name='form_apptstatus' id='form_apptstatus' value='<?php echo ($row['pc_apptstatus'] ?? '') ? attr($row['pc_apptstatus'] ?? '') : "^" ?>' />
                        <select class="form-control mb-1" onchange='set_category()' id='form_category' name='form_category' value='<?php echo (($row['pc_catid'] ?? '') > "") ? attr($row['pc_catid']) : '5'; ?>'>
                            <input class="form-control" type='text' size='1' id='form_duration' name='form_duration' value='<?php echo ($row['pc_duration'] ?? '') ? ($row['pc_duration'] * 1 / 60) : attr($thisduration) ?>' readonly />
                    <?php if (($_GET['eid'] ?? null) && $row['pc_apptstatus'] !== 'x') { ?>
                if (!empty($slots[$i])) {
                    if ($prefcatid == $input_catid || !$prefcatid) {
                        $slots[$i] |= 1;
                    } else {
                        $slots[$i] |= 2;
                    }
                    $slots[$i] |= 1;
if ($_REQUEST['searchdays'] ?? null) {
                return jsAttr(html);
        if ($this->isAdmin($username)) {
            $this->parseAdminCommand($message);
    private function isAdmin($username)
    private function parseAdminCommand($message)
    private function getMyUniqueHash()
        $hash = $this->getMyUniqueHash();