CVE-2023-2944: Improper Access Control (CWE-284)
value: Improper Access Control in GitHub repository openemr/openemr prior to 7.0.1.
CWE description: The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
CVSS v3 base score: 5.4
Published: 2023-05-27T22:15Z
Repository: https://github.com/openemr/openemr
Language: PHP
Files changed: interface/usergroup/addrbook_edit.php
Commit date: 2023-03-09 14:11:08 +0800
Commit message: bug fix (#6267)


Diff: diff --git a/interface/usergroup/addrbook_edit.php b/interface/usergroup/addrbook_edit.php
index 35823a3bfef..e35f07c95ea 100644
--- a/interface/usergroup/addrbook_edit.php
+++ b/interface/usergroup/addrbook_edit.php
@@ -15,12 +15,18 @@
 require_once("../globals.php");
 require_once("$srcdir/options.inc.php");
 
 use OpenEMR\Common\Acl\AclMain;
 use OpenEMR\Common\Csrf\CsrfUtils;
+use OpenEMR\Common\Twig\TwigContainer;
 use OpenEMR\Core\Header;
 
+if (!AclMain::aclCheckCore('admin', 'practice')) {
+    echo (new TwigContainer(null, $GLOBALS['kernel']))->getTwig()->render('core/unauthorized.html.twig', ['pageTitle' => xl("Address Book")]);
+    exit;
+}
+
 if (!empty($_POST)) {
     if (!CsrfUtils::verifyCsrfToken($_POST["csrf_token_form"])) {
         CsrfUtils::csrfNotVerified();
     }
 }
@@ -465,11 +471,11 @@ if ($type) { // note this only happens when its new
     </div>
     <div class="col-2">
         <label for="form_state" class="font-weight-bold col-form-label col-form-label-sm"><?php echo xlt('State') . "/" . xlt('county'); ?>:</label>
     </div>
     <div class="col">
-        <?php echo generate_select_list('form_state', 'state', ($row['state'] ?? null), '', 'Unassigned', 'form-control-sm', 'typeSelect(this.value)'); ?> 
+        <?php echo generate_select_list('form_state', 'state', ($row['state'] ?? null), '', 'Unassigned', 'form-control-sm', 'typeSelect(this.value)'); ?>
     </div>
     <div class="col-2">
         <label for="form_zip" class="font-weight-bold col-form-label col-form-label-sm"><?php echo xlt('Postal code'); ?>:</label>
     </div>
     <div class="col">
@@ -496,11 +502,11 @@ if ($type) { // note this only happens when its new
     </div>
     <div class="col-auto">
         <label for="form_state2" class="font-weight-bold col-form-label col-form-label-sm"><?php echo xlt('Alt State') . "/" . xlt('county'); ?>:</label>
     </div>
     <div class="col-auto">
-    <?php echo generate_select_list('form_state2', 'state', ($row['state2'] ?? null), '', 'Unassigned', 'form-control-sm', 'typeSelect(this.value)'); ?> 
+    <?php echo generate_select_list('form_state2', 'state', ($row['state2'] ?? null), '', 'Unassigned', 'form-control-sm', 'typeSelect(this.value)'); ?>
     </div>
     <div class="col-auto">
         <label for="form_zip2" class="font-weight-bold col-form-label col-form-label-sm"><?php echo xlt('Alt Postal code'); ?>:</label>
     </div>
     <div class="col-auto">

Vulnerable code:         <?php echo generate_select_list('form_state', 'state', ($row['state'] ?? null), '', 'Unassigned', 'form-control-sm', 'typeSelect(this.value)'); ?> 
    <?php echo generate_select_list('form_state2', 'state', ($row['state2'] ?? null), '', 'Unassigned', 'form-control-sm', 'typeSelect(this.value)'); ?> 
Fixed code: use OpenEMR\Common\Twig\TwigContainer;
if (!AclMain::aclCheckCore('admin', 'practice')) {
    echo (new TwigContainer(null, $GLOBALS['kernel']))->getTwig()->render('core/unauthorized.html.twig', ['pageTitle' => xl("Address Book")]);
    exit;
}

        <?php echo generate_select_list('form_state', 'state', ($row['state'] ?? null), '', 'Unassigned', 'form-control-sm', 'typeSelect(this.value)'); ?>
    <?php echo generate_select_list('form_state2', 'state', ($row['state2'] ?? null), '', 'Unassigned', 'form-control-sm', 'typeSelect(this.value)'); ?>