CVE-2022-2493: Other (NVD-CWE-Other)
value: Data Access from Outside Expected Data Manager Component in GitHub repository openemr/openemr prior to 7.0.0.
CWE description: NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
CVSS v3 base score: 8.1
Published: 2022-07-22T04:15Z
Repository: https://github.com/openemr/openemr
Language: PHP
Files changed: controllers/C_Document.class.php, controllers/C_PracticeSettings.class.php, interface/billing/edit_payment.php, interface/billing/era_payments.php, interface/billing/indigent_patients_report.php, interface/billing/new_payment.php, interface/billing/search_payments.php, interface/billing/sl_eob_search.php, interface/billing/sl_receipts_report.php, interface/main/display_documents.php, interface/orders/orders_results.php, interface/orders/pending_orders.php, interface/orders/procedure_stats.php, interface/orders/types.php, interface/patient_file/ccr_import.php, interface/patient_file/ccr_pending_approval.php, interface/patient_file/encounter/load_form.php, interface/patient_file/front_payment.php, interface/patient_file/pos_checkout_normal.php, interface/patient_file/summary/demographics.php, interface/patient_file/summary/labdata.php, interface/patient_file/transaction/record_request.php, interface/reports/amc_tracking.php, interface/reports/appt_encounter_report.php, interface/reports/clinical_reports.php, interface/reports/custom_report_range.php, interface/reports/daily_summary_report.php, interface/reports/encounters_report.php, interface/reports/front_receipts_report.php, interface/reports/immunization_report.php, interface/reports/insurance_allocation_report.php, interface/reports/non_reported.php, interface/reports/patient_list_creation.php, interface/reports/prescriptions_report.php, interface/reports/receipts_by_method_report.php, interface/reports/referrals_report.php, interface/reports/report_results.php, interface/reports/sales_by_item.php, interface/reports/svc_code_financial_report.php, interface/super/rules/include/header.php, interface/usergroup/addrbook_list.php, interface/usergroup/facilities.php, library/dicom_frame.php, src/Common/Acl/AclMain.php, templates/core/unauthorized-partial.html.twig, templates/core/unauthorized.html.twig
Commit date: 2022-05-03 22:09:56 -0700
Commit message: bug fixes b1 (#5280)


Diff: diff --git a/controllers/C_Document.class.php b/controllers/C_Document.class.php
index e28a024844..75325fab92 100644
--- a/controllers/C_Document.class.php
+++ b/controllers/C_Document.class.php
@@ -14,10 +14,11 @@ require_once(__DIR__ . "/../library/forms.inc");
 require_once(__DIR__ . "/../library/patient.inc");
 
 use OpenEMR\Common\Acl\AclMain;
 use OpenEMR\Common\Crypto\CryptoGen;
 use OpenEMR\Common\Csrf\CsrfUtils;
+use OpenEMR\Common\Twig\TwigContainer;
 use OpenEMR\Services\FacilityService;
 use OpenEMR\Services\PatientService;
 
 class C_Document extends Controller
 {
@@ -1061,13 +1062,21 @@ class C_Document extends Controller
         $is_new = isset($_GET['patient_name']) ? 1 : false;
         $place_hld = isset($_GET['patient_name']) ? filter_input(INPUT_GET, 'patient_name') : xl("Patient search or select.");
         $cur_pid = isset($_GET['patient_id']) ? filter_input(INPUT_GET, 'patient_id') : '';
         $used_msg = xl('Current patient unavailable here. Use Patient Documents');
         if ($cur_pid == '00') {
+            if (!AclMain::aclCheckCore('patients', 'docs', '', ['write', 'addonly'])) {
+                echo (new TwigContainer(null, $GLOBALS['kernel']))->getTwig()->render('core/unauthorized.html.twig', ['pageTitle' => xl("Documents")]);
+                exit;
+            }
             $cur_pid = '0';
             $is_new = 1;
         }
+        if (!AclMain::aclCheckCore('patients', 'docs')) {
+            echo (new TwigContainer(null, $GLOBALS['kernel']))->getTwig()->render('core/unauthorized.html.twig', ['pageTitle' => xl("Documents")]);
+            exit;
+        }
         $this->assign('is_new', $is_new);
         $this->assign('place_hld', $place_hld);
         $this->assign('cur_pid', $cur_pid);
         $this->assign('used_msg', $used_msg);
         $this->assign('demo_pid', ($_SESSION['pid'] ?? null));
diff --git a/controllers/C_PracticeSettings.class.php b/controllers/C_PracticeSettings.class.php
index 4044319ec2..820f22b141 100644
--- a/controllers/C_PracticeSettings.class.php
+++ b/controllers/C_PracticeSettings.class.php
@@ -1,7 +1,10 @@
 <?php
 
+use OpenEMR\Common\Acl\AclMain;
+use OpenEMR\Common\Twig\TwigContainer;
+
 class C_PracticeSettings extends Controller
 {
     var $template_mod;
 
     var $direction;
@@ -12,10 +15,15 @@ class C_PracticeSettings extends Controller
         $this->template_mod = $template_mod;
         $this->assign("FORM_ACTION", $GLOBALS['webroot'] . "/controller.php?" . attr($_SERVER['QUERY_STRING']));
         $this->assign("TOP_ACTION", $GLOBALS['webroot'] . "/controller.php?" . "practice_settings" . "&");
         $this->assign("STYLE", $GLOBALS['style']);
         $this->direction = ($GLOBALS['_SESSION']['language_direction'] == 'rtl') ? 'right' : 'left';
+
+        if (!AclMain::aclCheckCore('admin', 'practice')) {
+            echo (new TwigContainer(null, $GLOBALS['kernel']))->getTwig()->render('core/unauthorized.html.twig', ['pageTitle' => xl("Practice Settings")]);
+            exit;
+        }
     }
 
     function default_action($display = "")
     {
         $this->assign("display", $display);
diff --git a/interface/billing/edit_payment.php b/interface/billing/edit_payment.php
index de74059e83..ac41075cde 100644
--- a/interface/billing/edit_payment.php
+++ b/interface/billing/edit_payment.php
@@ -25,12 +25,19 @@ require_once("$srcdir/auth.inc");
 require_once("../../custom/code_types.inc.php");
 require_once("$srcdir/patient.inc");
 require_once("$srcdir/options.inc.php");
 require_once("$srcdir/payment.inc.php");
 
+use OpenEMR\Common\Acl\AclMain;
+use OpenEMR\Common\Twig\TwigContainer;
 use OpenEMR\Core\Header;
 
+if (!AclMain::aclCheckCore('acct', 'bill', '', 'write') && !AclMain::aclCheckCore('acct', 'eob', '', 'write')) {
+    echo (new TwigContainer(null, $GLOBALS['kernel']))->getTwig()->render('core/unauthorized.html.twig', ['pageTitle' => xl("Confirm Payment")]);
+    exit;
+}
+
 $screen = 'edit_payment';
 
 // Deletion of payment distribution code
 
 if (isset($_POST["mode"])) {
diff --git a/interface/billing/era_payments.php b/interface/billing/era_payments.php
index 139e534c58..a425cba683 100644
--- a/interface/billing/era_payments.php
+++ b/interface/billing/era_payments.php
@@ -21,14 +21,21 @@ require_once("$srcdir/patient.inc");
 require_once($GLOBALS['OE_SITE_DIR'] . "/statement.inc.php");
 require_once("$srcdir/options.inc.php");
 
 use OpenEMR\Billing\ParseERA;
 use OpenEMR\Billing\SLEOB;
+use OpenEMR\Common\Acl\AclMain;
 use OpenEMR\Common\Csrf\CsrfUtils;
+use OpenEMR\Common\Twig\TwigContainer;
 use OpenEMR\Core\Header;
 use OpenEMR\OeUI\OemrUI;
 
+if (!AclMain::aclCheckCore('acct', 'bill', '', 'write') && !AclMain::aclCheckCore('acct', 'eob', '', 'write')) {
+    echo (new TwigContainer(null, $GLOBALS['kernel']))->getTwig()->render('core/unauthorized.html.twig', ['pageTitle' => xl("ERA Posting")]);
+    exit;
+}
+
 $hidden_type_code = isset($_POST['hidden_type_code']) ? $_POST['hidden_type_code'] : '';
 $check_date = isset($_POST['check_date']) ? $_POST['check_date'] : '';
 $post_to_date = isset($_POST['post_to_date']) ? $_POST['post_to_date'] : '';
 $deposit_date = isset($_POST['deposit_date']) ? $_POST['deposit_date'] : '';
 $type_code = isset($_POST['type_code']) ? $_POST['type_code'] : '';
diff --git a/interface/billing/indigent_patients_report.php b/interface/billing/indigent_patients_report.php
index 895a3fa35a..2aad41d3e1 100644
--- a/interface/billing/indigent_patients_report.php
+++ b/interface/billing/indigent_patients_report.php
@@ -15,13 +15,20 @@
  */
 
 require_once("../globals.php");
 require_once("$srcdir/patient.inc");
 
+use OpenEMR\Common\Acl\AclMain;
 use OpenEMR\Common\Csrf\CsrfUtils;
+use OpenEMR\Common\Twig\TwigContainer;
 use OpenEMR\Core\Header;
 
+if (!AclMain::aclCheckCore('acct', 'rep_a')) {
+    echo (new TwigContainer(null, $GLOBALS['kernel']))->getTwig()->render('core/unauthorized.html.twig', ['pageTitle' => xl("Indigent Patients Report")]);
+    exit;
+}
+
 $alertmsg = '';
 
 function bucks($amount)
 {
     if ($amount) {
diff --git a/interface/billing/new_payment.php b/interface/billing/new_payment.php
index 5cb0057f7e..d4c0bf7f86 100644
--- a/interface/billing/new_payment.php
+++ b/interface/billing/new_payment.php
@@ -23,13 +23,20 @@ require_once("../../custom/code_types.inc.php");
 require_once("$srcdir/patient.inc");
 require_once("$srcdir/options.inc.php");
 require_once("$srcdir/payment.inc.php");
 
 use OpenEMR\Billing\ParseERA;
+use OpenEMR\Common\Acl\AclMain;
+use OpenEMR\Common\Twig\TwigContainer;
 use OpenEMR\Core\Header;
 use OpenEMR\OeUI\OemrUI;
 
+if (!AclMain::aclCheckCore('acct', 'bill', '', 'write') && !AclMain::aclCheckCore('acct', 'eob', '', 'write')) {
+    echo (new TwigContainer(null, $GLOBALS['kernel']))->getTwig()->render('core/unauthorized.html.twig', ['pageTitle' => xl("New Payment")]);
+    exit;
+}
+
 //===============================================================================
     $screen = 'new_payment';
 //===============================================================================
 // Initialisations
 $mode                    = isset($_POST['mode'])                   ? $_POST['mode']                   : '';
diff --git a/interface/billing/search_payments.php b/interface/billing/search_payments.php
index 1b8ede6d90..36d4bca145 100644
--- a/interface/billing/search_payments.php
+++ b/interface/billing/search_payments.php
@@ -21,13 +21,20 @@ require_once("../globals.php");
 require_once("../../custom/code_types.inc.php");
 require_once("$srcdir/patient.inc");
 require_once("$srcdir/options.inc.php");
 require_once("$srcdir/payment.inc.php");
 
+use OpenEMR\Common\Acl\AclMain;
+use OpenEMR\Common\Twig\TwigContainer;
 use OpenEMR\Core\Header;
 use OpenEMR\OeUI\OemrUI;
 
+if (!AclMain::aclCheckCore('acct', 'bill', '', 'write') && !AclMain::aclCheckCore('acct', 'eob', '', 'write')) {
+    echo (new TwigContainer(null, $GLOBALS['kernel']))->getTwig()->render('core/unauthorized.html.twig', ['pageTitle' => xl("Search Payment")]);
+    exit;
+}
+
 //===============================================================================
 //Deletion of payment and its corresponding distributions.
 //===============================================================================
 set_time_limit(0);
 if (isset($_POST["mode"])) {
diff --git a/interface/billing/sl_eob_search.php b/interface/billing/sl_eob_search.php
index 5e5e8749be..1ebb43a101 100644
--- a/interface/billing/sl_eob_search.php
+++ b/interface/billing/sl_eob_search.php
@@ -34,14 +34,21 @@ require_once "$srcdir/user.inc";
 
 use Mpdf\Mpdf;
 use OpenEMR\Billing\InvoiceSummary;
 use OpenEMR\Billing\ParseERA;
 use OpenEMR\Billing\SLEOB;
+use OpenEMR\Common\Acl\AclMain;
 use OpenEMR\Common\Csrf\CsrfUtils;
+use OpenEMR\Common\Twig\TwigContainer;
 use OpenEMR\Core\Header;
 use OpenEMR\OeUI\OemrUI;
 
+if (!AclMain::aclCheckCore('acct', 'eob', '', 'write')) {
+    echo (new TwigContainer(null, $GLOBALS['kernel']))->getTwig()->render('core/unauthorized.html.twig', ['pageTitle' => xl("EOB Posting - Search")]);
+    exit;
+}
+
 $DEBUG = 0; // set to 0 for production, 1 to test
 $alertmsg = '';
 $where = '';
 $eraname = '';
 $eracount = 0;
diff --git a/interface/billing/sl_receipts_report.php b/interface/billing/sl_receipts_report.php
index 8cce984f7d..10a8a4d03a 100644
--- a/interface/billing/sl_receipts_report.php
+++ b/interface/billing/sl_receipts_report.php
@@ -34,12 +34,18 @@ require_once($GLOBALS['fileroot'] . '/custom/code_types.inc.php');
 //
 require_once('../forms/fee_sheet/codes.php');
 
 use OpenEMR\Common\Acl\AclMain;
 use OpenEMR\Common\Csrf\CsrfUtils;
+use OpenEMR\Common\Twig\TwigContainer;
 use OpenEMR\Core\Header;
 
+if (!AclMain::aclCheckCore('acct', 'rep') && !AclMain::aclCheckCore('acct', 'rep_a')) {
+    echo (new TwigContainer(null, $GLOBALS['kernel']))->getTwig()->render('core/unauthorized.html.twig', ['pageTitle' => xl("Cash Receipts by Provider")]);
+    exit;
+}
+
 function is_clinic($code)
 {
     global $bcodes;
     $i = strpos($code, ':');
     if ($i) {
@@ -58,15 +64,10 @@ function bucks($amount)
     if ($amount) {
         echo attr(oeFormatMoney($amount));
     }
 }
 
-if (! AclMain::aclCheckCore('acct', 'rep')) {
-    die(xlt("Unauthorized access."));
-}
-
-
 $form_use_edate  = $_POST['form_use_edate'] ?? null;
 
 $form_proc_codefull = trim($_POST['form_proc_codefull'] ?? '');
 // Parse the code type and the code from <code_type>:<code>
 $tmp_code_array = explode(':', $form_proc_codefull);
@@ -371,10 +372,15 @@ $form_facility   = $_POST['form_facility'] ?? null;
                     <?php } ?>
                 </thead>
                     <?php
                     if ($_POST['form_refresh']) {
                         $form_doctor = $_POST['form_doctor'];
+                        if (!AclMain::aclCheckCore('acct', 'rep_a')) {
+                            // only allow user to see their encounter information
+                            $form_doctor = $_SESSION['authUserID'];
+                        }
+
                         $arows = array();
 
                         $ids_to_skip = array();
                         $irow = 0;
 
diff --git a/interface/main/display_documents.php b/interface/main/display_documents.php
index 465530d20f..97b8997849 100644
--- a/interface/main/display_documents.php
+++ b/interface/main/display_documents.php
@@ -16,12 +16,19 @@
  */
 
 require_once('../globals.php');
 require_once("$srcdir/patient.inc");
 
+use OpenEMR\Common\Acl\AclMain;
+use OpenEMR\Common\Twig\TwigContainer;
 use OpenEMR\Core\Header;
 
+if (!AclMain::aclCheckCore('patients', 'lab')) {
+    echo (new TwigContainer(null, $GLOBALS['kernel']))->getTwig()->render('core/unauthorized.html.twig', ['pageTitle' => xl("Lab Documents")]);
+    exit;
+}
+
 $curdate = date_create(date("Y-m-d"));
 date_sub($curdate, date_interval_create_from_date_string("7 days"));
 $sub_date = date_format($curdate, 'Y-m-d');
 
 // Set the default dates for Lab document search
diff --git a/interface/orders/orders_results.php b/interface/orders/orders_results.php
index 70b20fa10a..06fb90c448 100644
--- a/interface/orders/orders_results.php
+++ b/interface/orders/orders_results.php
@@ -15,28 +15,31 @@
 require_once("../globals.php");
 require_once("$srcdir/options.inc.php");
 require_once("$srcdir/lab.inc");
 
 use OpenEMR\Common\Acl\AclMain;
+use OpenEMR\Common\Twig\TwigContainer;
 use OpenEMR\Core\Header;
 
 // Indicates if we are entering in batch mode.
 $form_batch = empty($_GET['batch']) ? 0 : 1;
 
 // Indicates if we are entering in review mode.
 $form_review = empty($_GET['review']) ? 0 : 1;
 
 // Check authorization.
-$thisauth = AclMain::aclCheckCore('patients', 'med');
+$thisauth = AclMain::aclCheckCore('patients', 'lab');
 if (!$thisauth) {
-    die(xlt('Not authorized'));
+    echo (new TwigContainer(null, $GLOBALS['kernel']))->getTwig()->render('core/unauthorized.html.twig', ['pageTitle' => xl("Procedure Results")]);
+    exit;
 }
 
 // Check authorization for pending review.
 $reviewauth = AclMain::aclCheckCore('patients', 'sign');
 if ($form_review and !$reviewauth and !$thisauth) {
-    die(xlt('Not authorized'));
+    echo (new TwigContainer(null, $GLOBALS['kernel']))->getTwig()->render('core/unauthorized.html.twig', ['pageTitle' => xl("Procedure Results")]);
+    exit;
 }
 
 // Set pid for pending review.
 if (!empty($_GET['set_pid']) && $form_review) {
     require_once("$srcdir/pid.inc");
diff --git a/interface/orders/pending_orders.php b/interface/orders/pending_orders.php
index 6ce8aa1848..b07b69b7e6 100644
--- a/interface/orders/pending_orders.php
+++ b/interface/orders/pending_orders.php
@@ -16,12 +16,18 @@ require_once("../globals.php");
 require_once("$srcdir/patient.inc");
 require_once "$srcdir/options.inc.php";
 
 use OpenEMR\Common\Acl\AclMain;
 use OpenEMR\Common\Csrf\CsrfUtils;
+use OpenEMR\Common\Twig\TwigContainer;
 use OpenEMR\Core\Header;
 
+if (!AclMain::aclCheckCore('patients', 'lab')) {
+    echo (new TwigContainer(null, $GLOBALS['kernel']))->getTwig()->render('core/unauthorized.html.twig', ['pageTitle' => xl("Pending Orders")]);
+    exit;
+}
+
 function thisLineItem($row)
 {
     $provname = $row['provider_lname'];
     if (!empty($row['provider_fname'])) {
         $provname .= ', ' . $row['provider_fname'];
@@ -51,14 +57,10 @@ function thisLineItem($row)
  </tr>
         <?php
     } // End not csv export
 }
 
-if (!AclMain::aclCheckCore('acct', 'rep')) {
-    die(xlt("Unauthorized access."));
-}
-
 $form_from_date = isset($_POST['form_from_date']) ? DateToYYYYMMDD($_POST['form_from_date']) : date('Y-m-d');
 $form_to_date   = isset($_POST['form_to_date']) ? DateToYYYYMMDD($_POST['form_to_date']) : date('Y-m-d');
 $form_facility  = $_POST['form_facility'] ?? null;
 
 if (!empty($_POST['form_csvexport'])) {
diff --git a/interface/orders/procedure_stats.php b/interface/orders/procedure_stats.php
index af51f37088..fec85aadbe 100644
--- a/interface/orders/procedure_stats.php
+++ b/interface/orders/procedure_stats.php
@@ -20,16 +20,16 @@ require_once("../../library/patient.inc");
 require_once("../../custom/code_types.inc.php");
 require_once "$srcdir/options.inc.php";
 
 use OpenEMR\Common\Acl\AclMain;
 use OpenEMR\Common\Csrf\CsrfUtils;
+use OpenEMR\Common\Twig\TwigContainer;
 use OpenEMR\Core\Header;
 
-// Might want something different here.
-//
-if (! AclMain::aclCheckCore('acct', 'rep')) {
-    die(xlt("Unauthorized access."));
+if (!AclMain::aclCheckCore('patients', 'lab')) {
+    echo (new TwigContainer(null, $GLOBALS['kernel']))->getTwig()->render('core/unauthorized.html.twig', ['pageTitle' => xl("Procedure Statistics Report")]);
+    exit;
 }
 
 $from_date     = isset($_POST['form_from_date']) ? DateToYYYYMMDD($_POST['form_from_date']) : '0000-00-00';
 $to_date       = isset($_POST['form_to_date']) ? DateToYYYYMMDD($_POST['form_to_date']) : date('Y-m-d');
 $form_by       = $_POST['form_by'] ?? null;     // this is a scalar
diff --git a/interface/orders/types.php b/interface/orders/types.php
index 0462829c38..c9bdf054c2 100644
--- a/interface/orders/types.php
+++ b/interface/orders/types.php
@@ -13,10 +13,12 @@
  * @license   https://github.com/openemr/openemr/blob/master/LICENSE GNU General Public License 3
  */
 
 require_once("../globals.php");
 
+use OpenEMR\Common\Acl\AclMain;
+use OpenEMR\Common\Twig\TwigContainer;
 use OpenEMR\Core\Header;
 
 // This script can be run either inside the OpenEMR frameset for order catalog
 // maintenance, or as a popup window for selecting an item to order. In the
 // popup case the GET variables 'popup' (a boolean) and 'order' (an optional
@@ -24,10 +26,19 @@ use OpenEMR\Core\Header;
 
 $popup = empty($_GET['popup']) ? 0 : 1;
 $order = isset($_GET['order']) ? $_GET['order'] + 0 : 0;
 $labid = isset($_GET['labid']) ? $_GET['labid'] + 0 : 0;
 
+if (!$popup && !AclMain::aclCheckCore('admin', 'super')) {
+    echo (new TwigContainer(null, $GLOBALS['kernel']))->getTwig()->render('core/unauthorized.html.twig', ['pageTitle' => xl("Configure Orders and Results")]);
+    exit;
+}
+if ($popup && !AclMain::aclCheckCore('patients', 'lab') && !AclMain::aclCheckCore('admin', 'super')) {
+    echo (new TwigContainer(null, $GLOBALS['kernel']))->getTwig()->render('core/unauthorized.html.twig', ['pageTitle' => xl("Configure Orders and Results")]);
+    exit;
+}
+
 // If Save was clicked, set the result, close the window and exit.
 //
 if ($popup && $_POST['form_save']) {
     $form_order = isset($_GET['form_order']) ? $_GET['form_order'] + 0 : 0;
     $ptrow = sqlQuery("SELECT name FROM procedure_type WHERE procedure_type_id = ?", [$form_order]);
diff --git a/interface/patient_file/ccr_import.php b/interface/patient_file/ccr_import.php
index e05424f97b..d3b877e857 100644
--- a/interface/patient_file/ccr_import.php
+++ b/interface/patient_file/ccr_import.php
@@ -15,12 +15,19 @@
  * @license   https://github.com/openemr/openemr/blob/master/LICENSE GNU General Public License 3
  */
 
 require_once(dirname(__FILE__) . "../../globals.php");
 
+use OpenEMR\Common\Acl\AclMain;
+use OpenEMR\Common\Twig\TwigContainer;
 use OpenEMR\Core\Header;
 
+if (!AclMain::aclCheckCore('patients', 'med', '', 'write')) {
+    echo (new TwigContainer(null, $GLOBALS['kernel']))->getTwig()->render('core/unauthorized.html.twig', ['pageTitle' => xl("Import")]);
+    exit;
+}
+
 ?>
 <html>
 <head>
 <?php Header::setupHeader(); ?>
 <title><?php echo xlt('Import');?></title>
diff --git a/interface/patient_file/ccr_pending_approval.php b/interface/patient_file/ccr_pending_approval.php
index 11f746095b..0829d86b96 100644
--- a/interface/patient_file/ccr_pending_approval.php
+++ b/interface/patient_file/ccr_pending_approval.php
@@ -16,13 +16,20 @@
 require_once(dirname(__FILE__) . "/../globals.php");
 require_once(dirname(__FILE__) . "/../../library/options.inc.php");
 require_once(dirname(__FILE__) . "/../../library/patient.inc");
 require_once(dirname(__FILE__) . "/../../library/parse_patient_xml.php");
 
+use OpenEMR\Common\Acl\AclMain;
 use OpenEMR\Common\Csrf\CsrfUtils;
+use OpenEMR\Common\Twig\TwigContainer;
 use OpenEMR\Core\Header;
 
+if (!AclMain::aclCheckCore('patients', 'med', '', 'write')) {
+    echo (new TwigContainer(null, $GLOBALS['kernel']))->getTwig()->render('core/unauthorized.html.twig', ['pageTitle' => xl("CCR Approve")]);
+    exit;
+}
+
 if (isset($_GET['approve']) && $_GET['approve'] == 1) {
     if (!CsrfUtils::verifyCsrfToken($_GET["csrf_token_form"])) {
         CsrfUtils::csrfNotVerified();
     }
 
diff --git a/interface/patient_file/encounter/load_form.php b/interface/patient_file/encounter/load_form.php
index 8525df54e0..16dfa02d8f 100644
--- a/interface/patient_file/encounter/load_form.php
+++ b/interface/patient_file/encounter/load_form.php
@@ -11,10 +11,15 @@
  * @copyright Copyright (c) 2019 Jerry Padgett <sjpadgett@gmail.com>
  * @license   https://github.com/openemr/openemr/blob/master/LICENSE GNU General Public License 3
  */
 
 require_once("../../globals.php");
+require_once("../../../library/registry.inc");
+
+use OpenEMR\Common\Acl\AclMain;
+use OpenEMR\Common\Twig\TwigContainer;
+
 if (substr($_GET["formname"], 0, 3) === 'LBF') {
     // Use the List Based Forms engine for all LBFxxxxx forms.
     include_once("$incdir/forms/LBF/new.php");
 } else {
     if ((!empty($_GET['pid'])) && ($_GET['pid'] > 0)) {
@@ -23,10 +28,18 @@ if (substr($_GET["formname"], 0, 3) === 'LBF') {
     }
 
     // ensure the path variable has no illegal characters
     check_file_dir_name($_GET["formname"]);
 
+    // ensure authorized to see the form
+    if (!AclMain::aclCheckForm($_GET["formname"])) {
+        $formLabel = xl_form_title(getRegistryEntryByDirectory($_GET["formname"], 'name')['name'] ?? '');
+        $formLabel = (!empty($formLabel)) ? $formLabel : $_GET["formname"];
+        echo (new TwigContainer(null, $GLOBALS['kernel']))->getTwig()->render('core/unauthorized.html.twig', ['pageTitle' => $formLabel]);
+        exit;
+    }
+
     include_once("$incdir/forms/" . $_GET["formname"] . "/new.php");
 }
 
 if (!empty($GLOBALS['text_templates_enabled'])) { ?>
     <script src="<?php echo $GLOBALS['web_root'] ?>/library/js/CustomTemplateLoader.js"></script>
diff --git a/interface/patient_file/front_payment.php b/interface/patient_file/front_payment.php
index 4a5b6ed095..077dd563ff 100644
--- a/interface/patient_file/front_payment.php
+++ b/interface/patient_file/front_payment.php
@@ -21,15 +21,33 @@ require_once("$srcdir/options.inc.php");
 require_once("$srcdir/encounter_events.inc.php");
 
 use OpenEMR\Billing\BillingUtilities;
 use OpenEMR\Common\Acl\AclMain;
 use OpenEMR\Common\Csrf\CsrfUtils;
+use OpenEMR\Common\Twig\TwigContainer;
 use OpenEMR\Core\Header;
 use OpenEMR\OeUI\OemrUI;
 use OpenEMR\PaymentProcessing\Sphere\SpherePayment;
 use OpenEMR\Services\FacilityService;
 
+if (!empty($_REQUEST['receipt']) && empty($_POST['form_save'])) {
+    if (!AclMain::aclCheckCore('acct', 'bill') && !AclMain::aclCheckCore('acct', 'rep_a') && !AclMain::aclCheckCore('patients', 'rx')) {
+        echo (new TwigContainer(null, $GLOBALS['kernel']))->getTwig()->render('core/unauthorized.html.twig', ['pageTitle' => xl("Receipt for Payment")]);
+        exit;
+    }
+} else {
+    if (!AclMain::aclCheckCore('acct', 'bill', '', 'write')) {
+        if (!empty($_POST['form_save'])) {
+            $pageTitle = xl("Receipt for Payment");
+        } else {
+            $pageTitle = xl("Record Payment");
+        }
+        echo (new TwigContainer(null, $GLOBALS['kernel']))->getTwig()->render('core/unauthorized.html.twig', ['pageTitle' => $pageTitle]);
+        exit;
+    }
+}
+
 $pid = (!empty($_REQUEST['hidden_patient_code']) && ($_REQUEST['hidden_patient_code'] > 0)) ? $_REQUEST['hidden_patient_code'] : $pid;
 
 $facilityService = new FacilityService();
 
 ?>
diff --git a/interface/patient_file/pos_checkout_normal.php b/interface/patient_file/pos_checkout_normal.php
index 481044547b..930a935274 100644
--- a/interface/patient_file/pos_checkout_normal.php
+++ b/interface/patient_file/pos_checkout_normal.php
@@ -53,14 +53,20 @@ require_once("$srcdir/patient.inc");
 require_once("../../custom/code_types.inc.php");
 
 use OpenEMR\Billing\BillingUtilities;
 use OpenEMR\Common\Acl\AclMain;
 use OpenEMR\Common\Csrf\CsrfUtils;
+use OpenEMR\Common\Twig\TwigContainer;
 use OpenEMR\Core\Header;
 use OpenEMR\OeUI\OemrUI;
 use OpenEMR\Services\FacilityService;
 
+if (!AclMain::aclCheckCore('acct', 'bill', '', 'write')) {
+    echo (new TwigContainer(null, $GLOBALS['kernel']))->getTwig()->render('core/unauthorized.html.twig', ['pageTitle' => xl("Patient Checkout")]);
+    exit;
+}
+
 $facilityService = new FacilityService();
 
 $currdecimals = $GLOBALS['currency_decimals'];
 
 $details = empty($_GET['details']) ? 0 : 1;
diff --git a/interface/patient_file/summary/demographics.php b/interface/patient_file/summary/demographics.php
index 64018f5bd2..8e947172d4 100644
--- a/interface/patient_file/summary/demographics.php
+++ b/interface/patient_file/summary/demographics.php
@@ -906,11 +906,11 @@ $oemr_ui = new OemrUI($arrOeUiSettings);
     $viewEvent = new ViewEvent($pid);
     $viewEvent = $GLOBALS["kernel"]->getEventDispatcher()->dispatch(ViewEvent::EVENT_HANDLE, $viewEvent, 10);
     $thisauth = AclMain::aclCheckCore('patients', 'demo');
 
     if (!$thisauth || !$viewEvent->authorized()) {
-        echo $twig->getTwig()->render('core/unauthorized.html.twig', ['pageTitle' => xl("Medical Dashboard")]);
+        echo $twig->getTwig()->render('core/unauthorized-partial.html.twig', ['pageTitle' => xl("Medical Dashboard")]);
         exit();
     }
     ?>
 
     <div id="container_div" class="<?php echo $oemr_ui->oeContainer(); ?> mb-2">
diff --git a/interface/patient_file/summary/labdata.php b/interface/patient_file/summary/labdata.php
index ff7c8a69f9..184be5aa81 100644
--- a/interface/patient_file/summary/labdata.php
+++ b/interface/patient_file/summary/labdata.php
@@ -35,13 +35,20 @@
 
 require_once("../../globals.php");
 require_once("../../../library/options.inc.php");
 require_once($GLOBALS["srcdir"] . "/api.inc");
 
+use OpenEMR\Common\Acl\AclMain;
 use OpenEMR\Common\Csrf\CsrfUtils;
+use OpenEMR\Common\Twig\TwigContainer;
 use OpenEMR\Core\Header;
 
+if (!AclMain::aclCheckCore('patients', 'lab')) {
+    echo (new TwigContainer(null, $GLOBALS['kernel']))->getTwig()->render('core/unauthorized.html.twig', ['pageTitle' => xl("Labs")]);
+    exit;
+}
+
 // Set the path to this script
 $path_to_this_script = $rootdir . "/patient_file/summary/labdata.php";
 
 
 // is this the printable HTML-option?
diff --git a/interface/patient_file/transaction/record_request.php b/interface/patient_file/transaction/record_request.php
index 8f52d4da60..4fac466631 100644
--- a/interface/patient_file/transaction/record_request.php
+++ b/interface/patient_file/transaction/record_request.php
@@ -10,13 +10,20 @@
  * @license https://github.com/openemr/openemr/blob/master/LICENSE GNU General Public License 3
  */
 
 require_once("../../globals.php");
 
+use OpenEMR\Common\Acl\AclMain;
 use OpenEMR\Common\Csrf\CsrfUtils;
+use OpenEMR\Common\Twig\TwigContainer;
 use OpenEMR\Core\Header;
 
+if (!AclMain::aclCheckCore('patients', 'med')) {
+    echo (new TwigContainer(null, $GLOBALS['kernel']))->getTwig()->render('core/unauthorized.html.twig', ['pageTitle' => xl("Patient Records Request")]);
+    exit;
+}
+
 ?>
 <html>
 <head>
     <title><?php echo xlt('Patient Records Request'); ?></title>
     <?php Header::setupHeader(); ?>
diff --git a/interface/reports/amc_tracking.php b/interface/reports/amc_tracking.php
index cc8f6bc7ed..02e6c9393b 100644
--- a/interface/reports/amc_tracking.php
+++ b/interface/reports/amc_tracking.php
@@ -13,13 +13,20 @@
 require_once("../globals.php");
 require_once("../../library/patient.inc");
 require_once "$srcdir/options.inc.php";
 require_once "$srcdir/amc.php";
 
+use OpenEMR\Common\Acl\AclMain;
 use OpenEMR\Common\Csrf\CsrfUtils;
+use OpenEMR\Common\Twig\TwigContainer;
 use OpenEMR\Core\Header;
 
+if (!AclMain::aclCheckCore('patients', 'med')) {
+    echo (new TwigContainer(null, $GLOBALS['kernel']))->getTwig()->render('core/unauthorized.html.twig', ['pageTitle' => xl("Automated Measure Calculations (AMC) Tracking")]);
+    exit;
+}
+
 if (!empty($_POST)) {
     if (!CsrfUtils::verifyCsrfToken($_POST["csrf_token_form"])) {
         CsrfUtils::csrfNotVerified();
     }
 }
diff --git a/interface/reports/appt_encounter_report.php b/interface/reports/appt_encounter_report.php
index 05fd5997cc..bb86b8ca49 100644
--- a/interface/reports/appt_encounter_report.php
+++ b/interface/reports/appt_encounter_report.php
@@ -31,25 +31,27 @@
 require_once("../globals.php");
 require_once("$srcdir/patient.inc");
 require_once("../../custom/code_types.inc.php");
 
 use OpenEMR\Billing\BillingUtilities;
+use OpenEMR\Common\Acl\AclMain;
 use OpenEMR\Common\Csrf\CsrfUtils;
+use OpenEMR\Common\Twig\TwigContainer;
 use OpenEMR\Core\Header;
 use OpenEMR\Services\FacilityService;
-use OpenEMR\Common\Acl\AclMain;
+
+if (!AclMain::aclCheckCore('acct', 'rep_a')) {
+    echo (new TwigContainer(null, $GLOBALS['kernel']))->getTwig()->render('core/unauthorized.html.twig', ['pageTitle' => xl("Appointments and Encounters")]);
+    exit;
+}
 
 if (!empty($_POST)) {
     if (!CsrfUtils::verifyCsrfToken($_POST["csrf_token_form"])) {
         CsrfUtils::csrfNotVerified();
     }
 }
 
-if (!AclMain::aclCheckCore('patients', 'appt') || !AclMain::aclCheckCore('acct', 'rep_a')) {
-    die(xlt("Unauthorized access."));
-}
-
 $facilityService = new FacilityService();
 
 $errmsg  = "";
 $alertmsg = ''; // not used yet but maybe later
 $grand_total_charges    = 0;
diff --git a/interface/reports/clinical_reports.php b/interface/reports/clinical_reports.php
index 75f8be12a3..efcc431329 100644
--- a/interface/reports/clinical_reports.php
+++ b/interface/reports/clinical_reports.php
@@ -15,13 +15,20 @@ require_once("../globals.php");
 require_once("$srcdir/patient.inc");
 require_once("$srcdir/options.inc.php");
 require_once("../drugs/drugs.inc.php");
 require_once("../../custom/code_types.inc.php");
 
+use OpenEMR\Common\Acl\AclMain;
 use OpenEMR\Common\Csrf\CsrfUtils;
+use OpenEMR\Common\Twig\TwigContainer;
 use OpenEMR\Core\Header;
 
+if (!AclMain::aclCheckCore('patients', 'med')) {
+    echo (new TwigContainer(null, $GLOBALS['kernel']))->getTwig()->render('core/unauthorized.html.twig', ['pageTitle' => xl("Clinical Reports")]);
+    exit;
+}
+
 if (!empty($_POST)) {
     if (!CsrfUtils::verifyCsrfToken($_POST["csrf_token_form"])) {
         CsrfUtils::csrfNotVerified();
     }
 }
diff --git a/interface/reports/custom_report_range.php b/interface/reports/custom_report_range.php
index 276f7164ee..d9f25d9ed8 100644
--- a/interface/reports/custom_report_range.php
+++ b/interface/reports/custom_report_range.php
@@ -13,15 +13,22 @@
 require_once(dirname(__file__) . "/../globals.php");
 require_once("$srcdir/forms.inc");
 require_once("$srcdir/patient.inc");
 require_once("$srcdir/report.inc");
 
+use OpenEMR\Common\Acl\AclMain;
 use OpenEMR\Billing\BillingUtilities;
 use OpenEMR\Common\Csrf\CsrfUtils;
+use OpenEMR\Common\Twig\TwigContainer;
 use OpenEMR\Core\Header;
 use OpenEMR\Services\FacilityService;
 
+if (!AclMain::aclCheckCore('encounters', 'coding_a')) {
+    echo (new TwigContainer(null, $GLOBALS['kernel']))->getTwig()->render('core/unauthorized.html.twig', ['pageTitle' => xl("Superbill")]);
+    exit;
+}
+
 if (!empty($_POST)) {
     if (!CsrfUtils::verifyCsrfToken($_POST["csrf_token_form"])) {
         CsrfUtils::csrfNotVerified();
     }
 }
diff --git a/interface/reports/daily_summary_report.php b/interface/reports/daily_summary_report.php
index eddb35c8e3..20ab055e7f 100644
--- a/interface/reports/daily_summary_report.php
+++ b/interface/reports/daily_summary_report.php
@@ -17,14 +17,21 @@
 
 require_once("../globals.php");
 require_once "$srcdir/options.inc.php";
 require_once "$srcdir/appointments.inc.php";
 
+use OpenEMR\Common\Acl\AclMain;
 use OpenEMR\Common\Csrf\CsrfUtils;
+use OpenEMR\Common\Twig\TwigContainer;
 use OpenEMR\Core\Header;
 use OpenEMR\Services\FacilityService;
 
+if (!AclMain::aclCheckCore('acct', 'rep_a')) {
+    echo (new TwigContainer(null, $GLOBALS['kernel']))->getTwig()->render('core/unauthorized.html.twig', ['pageTitle' => xl("Daily Summary Report")]);
+    exit;
+}
+
 if (!empty($_POST)) {
     if (!CsrfUtils::verifyCsrfToken($_POST["csrf_token_form"])) {
         CsrfUtils::csrfNotVerified();
     }
 }
diff --git a/interface/reports/encounters_report.php b/interface/reports/encounters_report.php
index d190122a40..0dbdde1653 100644
--- a/interface/reports/encounters_report.php
+++ b/interface/reports/encounters_report.php
@@ -20,14 +20,21 @@
 require_once("../globals.php");
 require_once("$srcdir/forms.inc");
 require_once("$srcdir/patient.inc");
 require_once "$srcdir/options.inc.php";
 
+use OpenEMR\Common\Acl\AclMain;
 use OpenEMR\Billing\BillingUtilities;
 use OpenEMR\Common\Csrf\CsrfUtils;
+use OpenEMR\Common\Twig\TwigContainer;
 use OpenEMR\Core\Header;
 
+if (!AclMain::aclCheckCore('encounters', 'coding_a')) {
+    echo (new TwigContainer(null, $GLOBALS['kernel']))->getTwig()->render('core/unauthorized.html.twig', ['pageTitle' => xl("Encounters Report")]);
+    exit;
+}
+
 if (!empty($_POST)) {
     if (!CsrfUtils::verifyCsrfToken($_POST["csrf_token_form"])) {
         CsrfUtils::csrfNotVerified();
     }
 }
diff --git a/interface/reports/front_receipts_report.php b/interface/reports/front_receipts_report.php
index d2dacbdfd2..874e4987b9 100755
--- a/interface/reports/front_receipts_report.php
+++ b/interface/reports/front_receipts_report.php
@@ -14,13 +14,20 @@
 
 require_once("../globals.php");
 require_once("$srcdir/patient.inc");
 require_once "$srcdir/options.inc.php";
 
+use OpenEMR\Common\Acl\AclMain;
 use OpenEMR\Common\Csrf\CsrfUtils;
+use OpenEMR\Common\Twig\TwigContainer;
 use OpenEMR\Core\Header;
 
+if (!AclMain::aclCheckCore('acct', 'rep_a')) {
+    echo (new TwigContainer(null, $GLOBALS['kernel']))->getTwig()->render('core/unauthorized.html.twig', ['pageTitle' => xl("Front Office Receipts")]);
+    exit;
+}
+
 if (!empty($_POST)) {
     if (!CsrfUtils::verifyCsrfToken($_POST["csrf_token_form"])) {
         CsrfUtils::csrfNotVerified();
     }
 }
diff --git a/interface/reports/immunization_report.php b/interface/reports/immunization_report.php
index 4a291956d7..b07cc253c5 100644
--- a/interface/reports/immunization_report.php
+++ b/interface/reports/immunization_report.php
@@ -12,13 +12,20 @@
  */
 
 require_once("../globals.php");
 require_once("$srcdir/patient.inc");
 
+use OpenEMR\Common\Acl\AclMain;
 use OpenEMR\Common\Csrf\CsrfUtils;
+use OpenEMR\Common\Twig\TwigContainer;
 use OpenEMR\Core\Header;
 
+if (!AclMain::aclCheckCore('patients', 'med')) {
+    echo (new TwigContainer(null, $GLOBALS['kernel']))->getTwig()->render('core/unauthorized.html.twig', ['pageTitle' => xl("Immunization Registry")]);
+    exit;
+}
+
 if (!empty($_POST)) {
     if (!CsrfUtils::verifyCsrfToken($_POST["csrf_token_form"])) {
         CsrfUtils::csrfNotVerified();
     }
 }
diff --git a/interface/reports/insurance_allocation_report.php b/interface/reports/insurance_allocation_report.php
index c648e756d5..575d23f6b3 100644
--- a/interface/reports/insurance_allocation_report.php
+++ b/interface/reports/insurance_allocation_report.php
@@ -13,13 +13,20 @@
  */
 
 require_once("../globals.php");
 require_once("../../library/patient.inc");
 
+use OpenEMR\Common\Acl\AclMain;
 use OpenEMR\Common\Csrf\CsrfUtils;
+use OpenEMR\Common\Twig\TwigContainer;
 use OpenEMR\Core\Header;
 
+if (!AclMain::aclCheckCore('acct', 'rep_a')) {
+    echo (new TwigContainer(null, $GLOBALS['kernel']))->getTwig()->render('core/unauthorized.html.twig', ['pageTitle' => xl("Patient Insurance Distribution")]);
+    exit;
+}
+
 if (!empty($_POST)) {
     if (!CsrfUtils::verifyCsrfToken($_POST["csrf_token_form"])) {
         CsrfUtils::csrfNotVerified();
     }
 }
diff --git a/interface/reports/non_reported.php b/interface/reports/non_reported.php
index f749c8162d..0d209cd4dd 100644
--- a/interface/reports/non_reported.php
+++ b/interface/reports/non_reported.php
@@ -20,13 +20,20 @@
 
 require_once("../globals.php");
 require_once("$srcdir/patient.inc");
 require_once("../../custom/code_types.inc.php");
 
+use OpenEMR\Common\Acl\AclMain;
 use OpenEMR\Common\Csrf\CsrfUtils;
+use OpenEMR\Common\Twig\TwigContainer;
 use OpenEMR\Core\Header;
 
+if (!AclMain::aclCheckCore('patients', 'med')) {
+    echo (new TwigContainer(null, $GLOBALS['kernel']))->getTwig()->render('core/unauthorized.html.twig', ['pageTitle' => xl("Syndromic Surveillance - Non Reported Issues")]);
+    exit;
+}
+
 if (!empty($_POST)) {
     if (!CsrfUtils::verifyCsrfToken($_POST["csrf_token_form"])) {
         CsrfUtils::csrfNotVerified();
     }
 }
diff --git a/interface/reports/patient_list_creation.php b/interface/reports/patient_list_creation.php
index 5e09a64ce2..f7ab3fc8a6 100644
--- a/interface/reports/patient_list_creation.php
+++ b/interface/reports/patient_list_creation.php
@@ -17,13 +17,20 @@ require_once("../globals.php");
 require_once("$srcdir/patient.inc");
 require_once("$srcdir/options.inc.php");
 require_once("../drugs/drugs.inc.php");
 require_once("$srcdir/payment_jav.inc.php");
 
+use OpenEMR\Common\Acl\AclMain;
 use OpenEMR\Common\Csrf\CsrfUtils;
+use OpenEMR\Common\Twig\TwigContainer;
 use OpenEMR\Core\Header;
 
+if (!AclMain::aclCheckCore('patients', 'med')) {
+    echo (new TwigContainer(null, $GLOBALS['kernel']))->getTwig()->render('core/unauthorized.html.twig', ['pageTitle' => xl("Patient List Creation")]);
+    exit;
+}
+
 if (!empty($_POST)) {
     if (!CsrfUtils::verifyCsrfToken($_POST["csrf_token_form"])) {
         CsrfUtils::csrfNotVerified();
     }
 }
@@ -196,22 +203,22 @@ $insurance_company = trim($_POST["insurance_companies"] ?? '');
 
             function srch_option_change(elem) {
                 $('#sortby').val('');
                 $('#sortorder').val('');
 
-                if(elem.value == 'Communication') { 
+                if(elem.value == 'Communication') {
                     $('#communication').val('');
                     $('#com_pref').show();
-                } else { 
+                } else {
                     $('#communication').val('');
                     $('#com_pref').hide();
                 }
-                
-                if(elem.value == 'Insurance Companies') { 
+
+                if(elem.value == 'Insurance Companies') {
                     $('#insurance_companies').val('');
                     $('#ins_co').show();
-                } else { 
+                } else {
                     $('#insurance_companies').val('');
                     $('#ins_co').hide();
                     }
             }
 
@@ -266,14 +273,14 @@ $insurance_company = trim($_POST["insurance_companies"] ?? '');
                                 <td class='col-form-label'><?php echo xlt('To{{range}}'); ?>: </td>
                                 <td><input type='text' class='datetimepicker form-control' name='date_to' id="date_to" size='18' value='<?php echo attr(oeFormatDateTime($sql_date_to, 0, true)); ?>'>
                                 </td>
                                 <td class='col-form-label'><?php echo xlt('Option'); ?>: </td>
                                 <td class='col-form-label'>
-                                    <select class="form-control" name="srch_option" id="srch_option" 
+                                    <select class="form-control" name="srch_option" id="srch_option"
                                         onchange="srch_option_change(this)">
                                         <?php foreach ($search_options as $skey => $svalue) { ?>
-                                            <option <?php echo (!empty($_POST['srch_option']) && ($_POST['srch_option'] == $skey)) ? 'selected' : ''; ?> 
+                                            <option <?php echo (!empty($_POST['srch_option']) && ($_POST['srch_option'] == $skey)) ? 'selected' : ''; ?>
                                             value="<?php echo attr($skey); ?>"><?php echo text($svalue); ?></option>
                                         <?php } ?>
                                     </select>
                                     <?php ?>
                                 </td>
diff --git a/interface/reports/prescriptions_report.php b/interface/reports/prescriptions_report.php
index edd8d8ba07..02d042fd9f 100644
--- a/interface/reports/prescriptions_report.php
+++ b/interface/reports/prescriptions_report.php
@@ -16,13 +16,20 @@
 require_once("../globals.php");
 require_once("$srcdir/patient.inc");
 require_once("$srcdir/options.inc.php");
 require_once("../drugs/drugs.inc.php");
 
+use OpenEMR\Common\Acl\AclMain;
 use OpenEMR\Common\Csrf\CsrfUtils;
+use OpenEMR\Common\Twig\TwigContainer;
 use OpenEMR\Core\Header;
 
+if (!AclMain::aclCheckCore('patients', 'rx')) {
+    echo (new TwigContainer(null, $GLOBALS['kernel']))->getTwig()->render('core/unauthorized.html.twig', ['pageTitle' => xl("Prescriptions and Dispensations")]);
+    exit;
+}
+
 if (!empty($_POST)) {
     if (!CsrfUtils::verifyCsrfToken($_POST["csrf_token_form"])) {
         CsrfUtils::csrfNotVerified();
     }
 }
diff --git a/interface/reports/receipts_by_method_report.php b/interface/reports/receipts_by_method_report.php
index 42bfa66c6a..c119635f8d 100644
--- a/interface/reports/receipts_by_method_report.php
+++ b/interface/reports/receipts_by_method_report.php
@@ -26,14 +26,20 @@ require_once("$srcdir/patient.inc");
 require_once("$srcdir/options.inc.php");
 require_once("../../custom/code_types.inc.php");
 
 use OpenEMR\Common\Acl\AclMain;
 use OpenEMR\Common\Csrf\CsrfUtils;
+use OpenEMR\Common\Twig\TwigContainer;
 use OpenEMR\Core\Header;
 use OpenEMR\Services\InsuranceCompanyService;
 use OpenEMR\Services\InsuranceService;
 
+if (!AclMain::aclCheckCore('acct', 'rep_a')) {
+    echo (new TwigContainer(null, $GLOBALS['kernel']))->getTwig()->render('core/unauthorized.html.twig', ['pageTitle' => xl("Receipts Summary")]);
+    exit;
+}
+
 if (!empty($_POST)) {
     if (!CsrfUtils::verifyCsrfToken($_POST["csrf_token_form"])) {
         CsrfUtils::csrfNotVerified();
     }
 }
@@ -226,14 +232,10 @@ function payerCmp($a, $b)
     }
 
     return 0;
 }
 
-if (! AclMain::aclCheckCore('acct', 'rep')) {
-    die(xlt("Unauthorized access."));
-}
-
 $form_from_date = (isset($_POST['form_from_date'])) ? DateToYYYYMMDD($_POST['form_from_date']) : date('Y-m-d');
 $form_to_date   = (isset($_POST['form_to_date'])) ? DateToYYYYMMDD($_POST['form_to_date']) : date('Y-m-d');
 $form_use_edate = $_POST['form_use_edate'] ?? null;
 $form_facility  = $_POST['form_facility'] ?? null;
 $form_report_by = $_POST['form_report_by'] ?? null;
diff --git a/interface/reports/referrals_report.php b/interface/reports/referrals_report.php
index 6f63d4d2d0..87b5642948 100644
--- a/interface/reports/referrals_report.php
+++ b/interface/reports/referrals_report.php
@@ -16,13 +16,20 @@
 
 require_once("../globals.php");
 require_once("$srcdir/patient.inc");
 require_once "$srcdir/options.inc.php";
 
+use OpenEMR\Common\Acl\AclMain;
 use OpenEMR\Common\Csrf\CsrfUtils;
+use OpenEMR\Common\Twig\TwigContainer;
 use OpenEMR\Core\Header;
 
+if (!AclMain::aclCheckCore('patients', 'med')) {
+    echo (new TwigContainer(null, $GLOBALS['kernel']))->getTwig()->render('core/unauthorized.html.twig', ['pageTitle' => xl("Referrals")]);
+    exit;
+}
+
 if (!empty($_POST)) {
     if (!CsrfUtils::verifyCsrfToken($_POST["csrf_token_form"])) {
         CsrfUtils::csrfNotVerified();
     }
 }
diff --git a/interface/reports/report_results.php b/interface/reports/report_results.php
index e844e493e6..7ff19e4615 100644
--- a/interface/reports/report_results.php
+++ b/interface/reports/report_results.php
@@ -16,13 +16,20 @@ require_once("../../library/patient.inc");
 require_once "$srcdir/options.inc.php";
 require_once "$srcdir/clinical_rules.php";
 require_once "$srcdir/report_database.inc";
 
 use OpenEMR\ClinicialDecisionRules\AMC\CertificationReportTypes;
+use OpenEMR\Common\Acl\AclMain;
 use OpenEMR\Common\Csrf\CsrfUtils;
+use OpenEMR\Common\Twig\TwigContainer;
 use OpenEMR\Core\Header;
 
+if (!AclMain::aclCheckCore('patients', 'med')) {
+    echo (new TwigContainer(null, $GLOBALS['kernel']))->getTwig()->render('core/unauthorized.html.twig', ['pageTitle' => xl("Report Results/History")]);
+    exit;
+}
+
 if (!empty($_POST)) {
     if (!CsrfUtils::verifyCsrfToken($_POST["csrf_token_form"])) {
         CsrfUtils::csrfNotVerified();
     }
 }
diff --git a/interface/reports/sales_by_item.php b/interface/reports/sales_by_item.php
index 3e30aa5fd0..5b4460b393 100644
--- a/interface/reports/sales_by_item.php
+++ b/interface/reports/sales_by_item.php
@@ -18,19 +18,30 @@ require_once("../globals.php");
 require_once("$srcdir/patient.inc");
 require_once "$srcdir/options.inc.php";
 
 use OpenEMR\Common\Acl\AclMain;
 use OpenEMR\Common\Csrf\CsrfUtils;
+use OpenEMR\Common\Twig\TwigContainer;
 use OpenEMR\Core\Header;
 
+if (!AclMain::aclCheckCore('acct', 'rep') && !AclMain::aclCheckCore('acct', 'rep_a')) {
+    echo (new TwigContainer(null, $GLOBALS['kernel']))->getTwig()->render('core/unauthorized.html.twig', ['pageTitle' => xl("Sales by Item")]);
+    exit;
+}
+
 if (!empty($_POST)) {
     if (!CsrfUtils::verifyCsrfToken($_POST["csrf_token_form"])) {
         CsrfUtils::csrfNotVerified();
     }
 }
 
 $form_provider  = $_POST['form_provider'] ?? null;
+if (!AclMain::aclCheckCore('acct', 'rep_a')) {
+    // only allow user to see their encounter information
+    $form_provider = $_SESSION['authUserID'];
+}
+
 if (!empty($_POST['form_refresh']) || !empty($_POST['form_csvexport'])) {
     $form_details = (!empty($_POST['form_details'])) ? true : false;
 } else {
     $form_details = false;
 }
@@ -246,14 +257,10 @@ function thisLineItem($patient_id, $encounter_id, $rowcat, $description, $transd
     $productqty   += $qty;
     $catqty       += $qty;
     $grandqty     += $qty;
 } // end function
 
-if (! AclMain::aclCheckCore('acct', 'rep')) {
-    die(xlt("Unauthorized access."));
-}
-
 $form_from_date = (isset($_POST['form_from_date'])) ? DateToYYYYMMDD($_POST['form_from_date']) : date('Y-m-d');
 $form_to_date   = (isset($_POST['form_to_date'])) ? DateToYYYYMMDD($_POST['form_to_date']) : date('Y-m-d');
 $form_facility  = $_POST['form_facility'] ?? null;
 
 if (!empty($_POST['form_csvexport'])) {
diff --git a/interface/reports/svc_code_financial_report.php b/interface/reports/svc_code_financial_report.php
index a85e5fc3fd..c46ae73b09 100644
--- a/interface/reports/svc_code_financial_report.php
+++ b/interface/reports/svc_code_financial_report.php
@@ -24,12 +24,18 @@ require_once("$srcdir/patient.inc");
 require_once "$srcdir/options.inc.php";
 require_once "$srcdir/appointments.inc.php";
 
 use OpenEMR\Common\Acl\AclMain;
 use OpenEMR\Common\Csrf\CsrfUtils;
+use OpenEMR\Common\Twig\TwigContainer;
 use OpenEMR\Core\Header;
 
+if (!AclMain::aclCheckCore('acct', 'rep_a')) {
+    echo (new TwigContainer(null, $GLOBALS['kernel']))->getTwig()->render('core/unauthorized.html.twig', ['pageTitle' => xl("Financial Summary by Service Code")]);
+    exit;
+}
+
 if (!empty($_POST)) {
     if (!CsrfUtils::verifyCsrfToken($_POST["csrf_token_form"])) {
         CsrfUtils::csrfNotVerified();
     }
 }
@@ -38,15 +44,10 @@ $grand_total_units  = 0;
 $grand_total_amt_billed  = 0;
 $grand_total_amt_paid  = 0;
 $grand_total_amt_adjustment  = 0;
 $grand_total_amt_balance  = 0;
 
-
-if (!AclMain::aclCheckCore('acct', 'rep')) {
-    die(xlt("Unauthorized access."));
-}
-
 $form_from_date = (isset($_POST['form_from_date'])) ? DateToYYYYMMDD($_POST['form_from_date']) : date('Y-m-d');
 $form_to_date   = (isset($_POST['form_to_date'])) ? DateToYYYYMMDD($_POST['form_to_date']) : date('Y-m-d');
 $form_facility  = $_POST['form_facility'] ?? null;
 $form_provider  = $_POST['form_provider'] ?? null;
 
diff --git a/interface/super/rules/include/header.php b/interface/super/rules/include/header.php
index f798e44c37..3ad1bbb78c 100644
--- a/interface/super/rules/include/header.php
+++ b/interface/super/rules/include/header.php
@@ -6,15 +6,22 @@
  // modify it under the terms of the GNU General Public License
  // as published by the Free Software Foundation; either version 2
  // of the License, or (at your option) any later version.
 
 
-require("../../globals.php");
-
+require_once("../../globals.php");
 require_once("ui.php");
 require_once("common.php");
 
+use OpenEMR\Common\Acl\AclMain;
+use OpenEMR\Common\Twig\TwigContainer;
+
+if (!AclMain::aclCheckCore('admin', 'super')) {
+    echo (new TwigContainer(null, $GLOBALS['kernel']))->getTwig()->render('core/unauthorized.html.twig', ['pageTitle' => xl("Rules")]);
+    exit;
+}
+
 // recursively require all .php files in the base library folder
 foreach (glob(base_dir() . "base/library/*.php") as $filename) {
     require_once($filename);
 }
 
diff --git a/interface/usergroup/addrbook_list.php b/interface/usergroup/addrbook_list.php
index 5a879a57df..e4ce28e5a9 100644
--- a/interface/usergroup/addrbook_list.php
+++ b/interface/usergroup/addrbook_list.php
@@ -18,12 +18,18 @@
 require_once("../globals.php");
 require_once("$srcdir/options.inc.php");
 
 use OpenEMR\Common\Acl\AclMain;
 use OpenEMR\Common\Csrf\CsrfUtils;
+use OpenEMR\Common\Twig\TwigContainer;
 use OpenEMR\Core\Header;
 
+if (!AclMain::aclCheckCore('admin', 'practice')) {
+    echo (new TwigContainer(null, $GLOBALS['kernel']))->getTwig()->render('core/unauthorized.html.twig', ['pageTitle' => xl("Address Book")]);
+    exit;
+}
+
 if (!empty($_POST)) {
     if (!CsrfUtils::verifyCsrfToken($_POST["csrf_token_form"])) {
         CsrfUtils::csrfNotVerified();
     }
 }
diff --git a/interface/usergroup/facilities.php b/interface/usergroup/facilities.php
index f50246ff70..1399eb69b9 100644
--- a/interface/usergroup/facilities.php
+++ b/interface/usergroup/facilities.php
@@ -14,14 +14,21 @@
  * @license   https://github.com/openemr/openemr/blob/master/LICENSE GNU General Public License 3
  */
 
 require_once("../globals.php");
 
+use OpenEMR\Common\Acl\AclMain;
 use OpenEMR\Common\Csrf\CsrfUtils;
+use OpenEMR\Common\Twig\TwigContainer;
 use OpenEMR\Core\Header;
 use OpenEMR\Services\FacilityService;
 
+if (!AclMain::aclCheckCore('admin', 'users')) {
+    echo (new TwigContainer(null, $GLOBALS['kernel']))->getTwig()->render('core/unauthorized.html.twig', ['pageTitle' => xl("Facilities")]);
+    exit;
+}
+
 if (!empty($_POST)) {
     if (!CsrfUtils::verifyCsrfToken($_POST["csrf_token_form"])) {
         CsrfUtils::csrfNotVerified();
     }
 }
diff --git a/library/dicom_frame.php b/library/dicom_frame.php
index 0bc9eb20f6..39f178d918 100644
--- a/library/dicom_frame.php
+++ b/library/dicom_frame.php
@@ -16,12 +16,19 @@
 *  should not be used inside this script due to style conflicts with viewer, namely, hidden class.
 */
 
 require_once('../interface/globals.php');
 
-use OpenEMR\Core\Header;
+use OpenEMR\Common\Acl\AclMain;
 use OpenEMR\Common\Csrf\CsrfUtils;
+use OpenEMR\Common\Twig\TwigContainer;
+use OpenEMR\Core\Header;
+
+if (!AclMain::aclCheckCore('patients', 'docs')) {
+    echo (new TwigContainer(null, $GLOBALS['kernel']))->getTwig()->render('core/unauthorized.html.twig', ['pageTitle' => xl("Dicom Viewer")]);
+    exit;
+}
 
 $web_path = $_REQUEST['web_path'] ?? null;
 if ($web_path) {
     $patid = $_REQUEST['patient_id'] ?? null;
     $docid = isset($_REQUEST['document_id']) ? $_REQUEST['document_id'] : ($_REQUEST['doc_id'] ?? null);
diff --git a/src/Common/Acl/AclMain.php b/src/Common/Acl/AclMain.php
index 3eeba7a6ab..45759062ca 100644
--- a/src/Common/Acl/AclMain.php
+++ b/src/Common/Acl/AclMain.php
@@ -155,16 +155,13 @@ class AclMain
      *
      * @param string       $section      Category of ACO
      * @param string       $value        Subcategory of ACO
      * @param string       $user         Optional user being checked for access.
      * @param string|array $return_value Type or types of access being requested.
-     * @return bool|array  FALSE if access is denied, TRUE if allowed. An
-     *                     array() of bools is returned if $return_value is an
-     *             array, representing results for each type of access
-     *             requested.
+     * @return bool  FALSE if access is denied, TRUE if allowed.
      */
-    public static function aclCheckCore($section, $value, $user = '', $return_value = '')
+    public static function aclCheckCore($section, $value, $user = '', $return_value = ''): bool
     {
         if (! $user) {
             $user = $_SESSION['authUser'];
         }
 
diff --git a/templates/core/unauthorized-partial.html.twig b/templates/core/unauthorized-partial.html.twig
new file mode 100644
index 0000000000..4e03c1825c
--- /dev/null
+++ b/templates/core/unauthorized-partial.html.twig
@@ -0,0 +1,7 @@
+<div class="d-flex w-100 h-75 align-items-center justify-content-center">
+    <h3>
+        {{ pageTitle|text }} {{ "Not Authorized"|xlt }}
+    </h3>
+</div>
+</body>
+</html>
diff --git a/templates/core/unauthorized.html.twig b/templates/core/unauthorized.html.twig
index 4e03c1825c..92441498b2 100644
--- a/templates/core/unauthorized.html.twig
+++ b/templates/core/unauthorized.html.twig
@@ -1,7 +1,13 @@
-<div class="d-flex w-100 h-75 align-items-center justify-content-center">
-    <h3>
-        {{ pageTitle|text }} {{ "Not Authorized"|xlt }}
-    </h3>
-</div>
-</body>
+<html>
+    <head>
+        <title>{{ pageTitle|text }}</title>
+        {{ setupHeader() }}
+    </head>
+    <body>
+        <div class="d-flex w-100 h-75 align-items-center justify-content-center">
+            <h3>
+                {{ pageTitle|text }} {{ "Not Authorized"|xlt }}
+            </h3>
+        </div>
+    </body>
 </html>

Vulnerable code: if (! AclMain::aclCheckCore('acct', 'rep')) {
    die(xlt("Unauthorized access."));
}


$thisauth = AclMain::aclCheckCore('patients', 'med');
    die(xlt('Not authorized'));
    die(xlt('Not authorized'));
if (!AclMain::aclCheckCore('acct', 'rep')) {
    die(xlt("Unauthorized access."));
}

// Might want something different here.
//
if (! AclMain::aclCheckCore('acct', 'rep')) {
    die(xlt("Unauthorized access."));
        echo $twig->getTwig()->render('core/unauthorized.html.twig', ['pageTitle' => xl("Medical Dashboard")]);
use OpenEMR\Common\Acl\AclMain;
if (!AclMain::aclCheckCore('patients', 'appt') || !AclMain::aclCheckCore('acct', 'rep_a')) {
    die(xlt("Unauthorized access."));
}

                if(elem.value == 'Communication') { 
                } else { 
                
                if(elem.value == 'Insurance Companies') { 
                } else { 
                                    <select class="form-control" name="srch_option" id="srch_option" 
                                            <option <?php echo (!empty($_POST['srch_option']) && ($_POST['srch_option'] == $skey)) ? 'selected' : ''; ?> 
if (! AclMain::aclCheckCore('acct', 'rep')) {
    die(xlt("Unauthorized access."));
}

if (! AclMain::aclCheckCore('acct', 'rep')) {
    die(xlt("Unauthorized access."));
}


if (!AclMain::aclCheckCore('acct', 'rep')) {
    die(xlt("Unauthorized access."));
}

require("../../globals.php");

use OpenEMR\Core\Header;
     * @return bool|array  FALSE if access is denied, TRUE if allowed. An
     *                     array() of bools is returned if $return_value is an
     *             array, representing results for each type of access
     *             requested.
    public static function aclCheckCore($section, $value, $user = '', $return_value = '')
<div class="d-flex w-100 h-75 align-items-center justify-content-center">
    <h3>
        {{ pageTitle|text }} {{ "Not Authorized"|xlt }}
    </h3>
</div>
</body>
Fixed code: use OpenEMR\Common\Twig\TwigContainer;
            if (!AclMain::aclCheckCore('patients', 'docs', '', ['write', 'addonly'])) {
                echo (new TwigContainer(null, $GLOBALS['kernel']))->getTwig()->render('core/unauthorized.html.twig', ['pageTitle' => xl("Documents")]);
                exit;
            }
        if (!AclMain::aclCheckCore('patients', 'docs')) {
            echo (new TwigContainer(null, $GLOBALS['kernel']))->getTwig()->render('core/unauthorized.html.twig', ['pageTitle' => xl("Documents")]);
            exit;
        }
use OpenEMR\Common\Acl\AclMain;
use OpenEMR\Common\Twig\TwigContainer;


        if (!AclMain::aclCheckCore('admin', 'practice')) {
            echo (new TwigContainer(null, $GLOBALS['kernel']))->getTwig()->render('core/unauthorized.html.twig', ['pageTitle' => xl("Practice Settings")]);
            exit;
        }
use OpenEMR\Common\Acl\AclMain;
use OpenEMR\Common\Twig\TwigContainer;
if (!AclMain::aclCheckCore('acct', 'bill', '', 'write') && !AclMain::aclCheckCore('acct', 'eob', '', 'write')) {
    echo (new TwigContainer(null, $GLOBALS['kernel']))->getTwig()->render('core/unauthorized.html.twig', ['pageTitle' => xl("Confirm Payment")]);
    exit;
}

use OpenEMR\Common\Acl\AclMain;
use OpenEMR\Common\Twig\TwigContainer;
if (!AclMain::aclCheckCore('acct', 'bill', '', 'write') && !AclMain::aclCheckCore('acct', 'eob', '', 'write')) {
    echo (new TwigContainer(null, $GLOBALS['kernel']))->getTwig()->render('core/unauthorized.html.twig', ['pageTitle' => xl("ERA Posting")]);
    exit;
}

use OpenEMR\Common\Acl\AclMain;
use OpenEMR\Common\Twig\TwigContainer;
if (!AclMain::aclCheckCore('acct', 'rep_a')) {
    echo (new TwigContainer(null, $GLOBALS['kernel']))->getTwig()->render('core/unauthorized.html.twig', ['pageTitle' => xl("Indigent Patients Report")]);
    exit;
}

use OpenEMR\Common\Acl\AclMain;
use OpenEMR\Common\Twig\TwigContainer;
if (!AclMain::aclCheckCore('acct', 'bill', '', 'write') && !AclMain::aclCheckCore('acct', 'eob', '', 'write')) {
    echo (new TwigContainer(null, $GLOBALS['kernel']))->getTwig()->render('core/unauthorized.html.twig', ['pageTitle' => xl("New Payment")]);
    exit;
}

use OpenEMR\Common\Acl\AclMain;
use OpenEMR\Common\Twig\TwigContainer;
if (!AclMain::aclCheckCore('acct', 'bill', '', 'write') && !AclMain::aclCheckCore('acct', 'eob', '', 'write')) {
    echo (new TwigContainer(null, $GLOBALS['kernel']))->getTwig()->render('core/unauthorized.html.twig', ['pageTitle' => xl("Search Payment")]);
    exit;
}

use OpenEMR\Common\Acl\AclMain;
use OpenEMR\Common\Twig\TwigContainer;
if (!AclMain::aclCheckCore('acct', 'eob', '', 'write')) {
    echo (new TwigContainer(null, $GLOBALS['kernel']))->getTwig()->render('core/unauthorized.html.twig', ['pageTitle' => xl("EOB Posting - Search")]);
    exit;
}

use OpenEMR\Common\Twig\TwigContainer;
if (!AclMain::aclCheckCore('acct', 'rep') && !AclMain::aclCheckCore('acct', 'rep_a')) {
    echo (new TwigContainer(null, $GLOBALS['kernel']))->getTwig()->render('core/unauthorized.html.twig', ['pageTitle' => xl("Cash Receipts by Provider")]);
    exit;
}

                        if (!AclMain::aclCheckCore('acct', 'rep_a')) {
                            // only allow user to see their encounter information
                            $form_doctor = $_SESSION['authUserID'];
                        }

use OpenEMR\Common\Acl\AclMain;
use OpenEMR\Common\Twig\TwigContainer;
if (!AclMain::aclCheckCore('patients', 'lab')) {
    echo (new TwigContainer(null, $GLOBALS['kernel']))->getTwig()->render('core/unauthorized.html.twig', ['pageTitle' => xl("Lab Documents")]);
    exit;
}

use OpenEMR\Common\Twig\TwigContainer;
$thisauth = AclMain::aclCheckCore('patients', 'lab');
    echo (new TwigContainer(null, $GLOBALS['kernel']))->getTwig()->render('core/unauthorized.html.twig', ['pageTitle' => xl("Procedure Results")]);
    exit;
    echo (new TwigContainer(null, $GLOBALS['kernel']))->getTwig()->render('core/unauthorized.html.twig', ['pageTitle' => xl("Procedure Results")]);
    exit;
use OpenEMR\Common\Twig\TwigContainer;
if (!AclMain::aclCheckCore('patients', 'lab')) {
    echo (new TwigContainer(null, $GLOBALS['kernel']))->getTwig()->render('core/unauthorized.html.twig', ['pageTitle' => xl("Pending Orders")]);
    exit;
}

use OpenEMR\Common\Twig\TwigContainer;
if (!AclMain::aclCheckCore('patients', 'lab')) {
    echo (new TwigContainer(null, $GLOBALS['kernel']))->getTwig()->render('core/unauthorized.html.twig', ['pageTitle' => xl("Procedure Statistics Report")]);
    exit;
use OpenEMR\Common\Acl\AclMain;
use OpenEMR\Common\Twig\TwigContainer;
if (!$popup && !AclMain::aclCheckCore('admin', 'super')) {
    echo (new TwigContainer(null, $GLOBALS['kernel']))->getTwig()->render('core/unauthorized.html.twig', ['pageTitle' => xl("Configure Orders and Results")]);
    exit;
}
if ($popup && !AclMain::aclCheckCore('patients', 'lab') && !AclMain::aclCheckCore('admin', 'super')) {
    echo (new TwigContainer(null, $GLOBALS['kernel']))->getTwig()->render('core/unauthorized.html.twig', ['pageTitle' => xl("Configure Orders and Results")]);
    exit;
}

use OpenEMR\Common\Acl\AclMain;
use OpenEMR\Common\Twig\TwigContainer;
if (!AclMain::aclCheckCore('patients', 'med', '', 'write')) {
    echo (new TwigContainer(null, $GLOBALS['kernel']))->getTwig()->render('core/unauthorized.html.twig', ['pageTitle' => xl("Import")]);
    exit;
}

use OpenEMR\Common\Acl\AclMain;
use OpenEMR\Common\Twig\TwigContainer;
if (!AclMain::aclCheckCore('patients', 'med', '', 'write')) {
    echo (new TwigContainer(null, $GLOBALS['kernel']))->getTwig()->render('core/unauthorized.html.twig', ['pageTitle' => xl("CCR Approve")]);
    exit;
}

require_once("../../../library/registry.inc");

use OpenEMR\Common\Acl\AclMain;
use OpenEMR\Common\Twig\TwigContainer;

    // ensure authorized to see the form
    if (!AclMain::aclCheckForm($_GET["formname"])) {
        $formLabel = xl_form_title(getRegistryEntryByDirectory($_GET["formname"], 'name')['name'] ?? '');
        $formLabel = (!empty($formLabel)) ? $formLabel : $_GET["formname"];
        echo (new TwigContainer(null, $GLOBALS['kernel']))->getTwig()->render('core/unauthorized.html.twig', ['pageTitle' => $formLabel]);
        exit;
    }

use OpenEMR\Common\Twig\TwigContainer;
if (!empty($_REQUEST['receipt']) && empty($_POST['form_save'])) {
    if (!AclMain::aclCheckCore('acct', 'bill') && !AclMain::aclCheckCore('acct', 'rep_a') && !AclMain::aclCheckCore('patients', 'rx')) {
        echo (new TwigContainer(null, $GLOBALS['kernel']))->getTwig()->render('core/unauthorized.html.twig', ['pageTitle' => xl("Receipt for Payment")]);
        exit;
    }
} else {
    if (!AclMain::aclCheckCore('acct', 'bill', '', 'write')) {
        if (!empty($_POST['form_save'])) {
            $pageTitle = xl("Receipt for Payment");
        } else {
            $pageTitle = xl("Record Payment");
        }
        echo (new TwigContainer(null, $GLOBALS['kernel']))->getTwig()->render('core/unauthorized.html.twig', ['pageTitle' => $pageTitle]);
        exit;
    }
}

use OpenEMR\Common\Twig\TwigContainer;
if (!AclMain::aclCheckCore('acct', 'bill', '', 'write')) {
    echo (new TwigContainer(null, $GLOBALS['kernel']))->getTwig()->render('core/unauthorized.html.twig', ['pageTitle' => xl("Patient Checkout")]);
    exit;
}

        echo $twig->getTwig()->render('core/unauthorized-partial.html.twig', ['pageTitle' => xl("Medical Dashboard")]);
use OpenEMR\Common\Acl\AclMain;
use OpenEMR\Common\Twig\TwigContainer;
if (!AclMain::aclCheckCore('patients', 'lab')) {
    echo (new TwigContainer(null, $GLOBALS['kernel']))->getTwig()->render('core/unauthorized.html.twig', ['pageTitle' => xl("Labs")]);
    exit;
}

use OpenEMR\Common\Acl\AclMain;
use OpenEMR\Common\Twig\TwigContainer;
if (!AclMain::aclCheckCore('patients', 'med')) {
    echo (new TwigContainer(null, $GLOBALS['kernel']))->getTwig()->render('core/unauthorized.html.twig', ['pageTitle' => xl("Patient Records Request")]);
    exit;
}

use OpenEMR\Common\Acl\AclMain;
use OpenEMR\Common\Twig\TwigContainer;
if (!AclMain::aclCheckCore('patients', 'med')) {
    echo (new TwigContainer(null, $GLOBALS['kernel']))->getTwig()->render('core/unauthorized.html.twig', ['pageTitle' => xl("Automated Measure Calculations (AMC) Tracking")]);
    exit;
}

use OpenEMR\Common\Acl\AclMain;
use OpenEMR\Common\Twig\TwigContainer;

if (!AclMain::aclCheckCore('acct', 'rep_a')) {
    echo (new TwigContainer(null, $GLOBALS['kernel']))->getTwig()->render('core/unauthorized.html.twig', ['pageTitle' => xl("Appointments and Encounters")]);
    exit;
}
use OpenEMR\Common\Acl\AclMain;
use OpenEMR\Common\Twig\TwigContainer;
if (!AclMain::aclCheckCore('patients', 'med')) {
    echo (new TwigContainer(null, $GLOBALS['kernel']))->getTwig()->render('core/unauthorized.html.twig', ['pageTitle' => xl("Clinical Reports")]);
    exit;
}

use OpenEMR\Common\Acl\AclMain;
use OpenEMR\Common\Twig\TwigContainer;
if (!AclMain::aclCheckCore('encounters', 'coding_a')) {
    echo (new TwigContainer(null, $GLOBALS['kernel']))->getTwig()->render('core/unauthorized.html.twig', ['pageTitle' => xl("Superbill")]);
    exit;
}

use OpenEMR\Common\Acl\AclMain;
use OpenEMR\Common\Twig\TwigContainer;
if (!AclMain::aclCheckCore('acct', 'rep_a')) {
    echo (new TwigContainer(null, $GLOBALS['kernel']))->getTwig()->render('core/unauthorized.html.twig', ['pageTitle' => xl("Daily Summary Report")]);
    exit;
}

use OpenEMR\Common\Acl\AclMain;
use OpenEMR\Common\Twig\TwigContainer;
if (!AclMain::aclCheckCore('encounters', 'coding_a')) {
    echo (new TwigContainer(null, $GLOBALS['kernel']))->getTwig()->render('core/unauthorized.html.twig', ['pageTitle' => xl("Encounters Report")]);
    exit;
}

use OpenEMR\Common\Acl\AclMain;
use OpenEMR\Common\Twig\TwigContainer;
if (!AclMain::aclCheckCore('acct', 'rep_a')) {
    echo (new TwigContainer(null, $GLOBALS['kernel']))->getTwig()->render('core/unauthorized.html.twig', ['pageTitle' => xl("Front Office Receipts")]);
    exit;
}

use OpenEMR\Common\Acl\AclMain;
use OpenEMR\Common\Twig\TwigContainer;
if (!AclMain::aclCheckCore('patients', 'med')) {
    echo (new TwigContainer(null, $GLOBALS['kernel']))->getTwig()->render('core/unauthorized.html.twig', ['pageTitle' => xl("Immunization Registry")]);
    exit;
}

use OpenEMR\Common\Acl\AclMain;
use OpenEMR\Common\Twig\TwigContainer;
if (!AclMain::aclCheckCore('acct', 'rep_a')) {
    echo (new TwigContainer(null, $GLOBALS['kernel']))->getTwig()->render('core/unauthorized.html.twig', ['pageTitle' => xl("Patient Insurance Distribution")]);
    exit;
}

use OpenEMR\Common\Acl\AclMain;
use OpenEMR\Common\Twig\TwigContainer;
if (!AclMain::aclCheckCore('patients', 'med')) {
    echo (new TwigContainer(null, $GLOBALS['kernel']))->getTwig()->render('core/unauthorized.html.twig', ['pageTitle' => xl("Syndromic Surveillance - Non Reported Issues")]);
    exit;
}

use OpenEMR\Common\Acl\AclMain;
use OpenEMR\Common\Twig\TwigContainer;
if (!AclMain::aclCheckCore('patients', 'med')) {
    echo (new TwigContainer(null, $GLOBALS['kernel']))->getTwig()->render('core/unauthorized.html.twig', ['pageTitle' => xl("Patient List Creation")]);
    exit;
}

                if(elem.value == 'Communication') {
                } else {

                if(elem.value == 'Insurance Companies') {
                } else {
                                    <select class="form-control" name="srch_option" id="srch_option"
                                            <option <?php echo (!empty($_POST['srch_option']) && ($_POST['srch_option'] == $skey)) ? 'selected' : ''; ?>
use OpenEMR\Common\Acl\AclMain;
use OpenEMR\Common\Twig\TwigContainer;
if (!AclMain::aclCheckCore('patients', 'rx')) {
    echo (new TwigContainer(null, $GLOBALS['kernel']))->getTwig()->render('core/unauthorized.html.twig', ['pageTitle' => xl("Prescriptions and Dispensations")]);
    exit;
}

use OpenEMR\Common\Twig\TwigContainer;
if (!AclMain::aclCheckCore('acct', 'rep_a')) {
    echo (new TwigContainer(null, $GLOBALS['kernel']))->getTwig()->render('core/unauthorized.html.twig', ['pageTitle' => xl("Receipts Summary")]);
    exit;
}

use OpenEMR\Common\Acl\AclMain;
use OpenEMR\Common\Twig\TwigContainer;
if (!AclMain::aclCheckCore('patients', 'med')) {
    echo (new TwigContainer(null, $GLOBALS['kernel']))->getTwig()->render('core/unauthorized.html.twig', ['pageTitle' => xl("Referrals")]);
    exit;
}

use OpenEMR\Common\Acl\AclMain;
use OpenEMR\Common\Twig\TwigContainer;
if (!AclMain::aclCheckCore('patients', 'med')) {
    echo (new TwigContainer(null, $GLOBALS['kernel']))->getTwig()->render('core/unauthorized.html.twig', ['pageTitle' => xl("Report Results/History")]);
    exit;
}

use OpenEMR\Common\Twig\TwigContainer;
if (!AclMain::aclCheckCore('acct', 'rep') && !AclMain::aclCheckCore('acct', 'rep_a')) {
    echo (new TwigContainer(null, $GLOBALS['kernel']))->getTwig()->render('core/unauthorized.html.twig', ['pageTitle' => xl("Sales by Item")]);
    exit;
}

if (!AclMain::aclCheckCore('acct', 'rep_a')) {
    // only allow user to see their encounter information
    $form_provider = $_SESSION['authUserID'];
}

use OpenEMR\Common\Twig\TwigContainer;
if (!AclMain::aclCheckCore('acct', 'rep_a')) {
    echo (new TwigContainer(null, $GLOBALS['kernel']))->getTwig()->render('core/unauthorized.html.twig', ['pageTitle' => xl("Financial Summary by Service Code")]);
    exit;
}

require_once("../../globals.php");
use OpenEMR\Common\Acl\AclMain;
use OpenEMR\Common\Twig\TwigContainer;

if (!AclMain::aclCheckCore('admin', 'super')) {
    echo (new TwigContainer(null, $GLOBALS['kernel']))->getTwig()->render('core/unauthorized.html.twig', ['pageTitle' => xl("Rules")]);
    exit;
}

use OpenEMR\Common\Twig\TwigContainer;
if (!AclMain::aclCheckCore('admin', 'practice')) {
    echo (new TwigContainer(null, $GLOBALS['kernel']))->getTwig()->render('core/unauthorized.html.twig', ['pageTitle' => xl("Address Book")]);
    exit;
}

use OpenEMR\Common\Acl\AclMain;
use OpenEMR\Common\Twig\TwigContainer;
if (!AclMain::aclCheckCore('admin', 'users')) {
    echo (new TwigContainer(null, $GLOBALS['kernel']))->getTwig()->render('core/unauthorized.html.twig', ['pageTitle' => xl("Facilities")]);
    exit;
}

use OpenEMR\Common\Acl\AclMain;
use OpenEMR\Common\Twig\TwigContainer;
use OpenEMR\Core\Header;

if (!AclMain::aclCheckCore('patients', 'docs')) {
    echo (new TwigContainer(null, $GLOBALS['kernel']))->getTwig()->render('core/unauthorized.html.twig', ['pageTitle' => xl("Dicom Viewer")]);
    exit;
}
     * @return bool  FALSE if access is denied, TRUE if allowed.
    public static function aclCheckCore($section, $value, $user = '', $return_value = ''): bool
<div class="d-flex w-100 h-75 align-items-center justify-content-center">
    <h3>
        {{ pageTitle|text }} {{ "Not Authorized"|xlt }}
    </h3>
</div>
</body>
</html>
<html>
    <head>
        <title>{{ pageTitle|text }}</title>
        {{ setupHeader() }}
    </head>
    <body>
        <div class="d-flex w-100 h-75 align-items-center justify-content-center">
            <h3>
                {{ pageTitle|text }} {{ "Not Authorized"|xlt }}
            </h3>
        </div>
    </body>