CVE-2017-12064: Improper Encoding or Escaping of Output (CWE-116)
value: The csv_log_html function in library/edihistory/edih_csv_inc.php in OpenEMR 5.0.0 and prior allows attackers to bypass intended access restrictions via a crafted name.
CWE description: The product prepares a structured message for communication with another component, but encoding or escaping of the data is either missing or done incorrectly. As a result, the intended structure of the message is not preserved.
CVSS v3 base score: 7.5
Published: 2017-08-01T05:29Z
Repository: https://github.com/openemr/openemr
Language: PHP
Files changed: library/edihistory/edih_csv_inc.php, library/sanitize.inc.php
Commit date: 2017-06-28 19:14:24 -0700
Commit message: security fix

Diff: diff --git a/library/edihistory/edih_csv_inc.php b/library/edihistory/edih_csv_inc.php
index 209a20729..b0e9c3176 100644
--- a/library/edihistory/edih_csv_inc.php
+++ b/library/edihistory/edih_csv_inc.php
@@ -132,10 +132,11 @@ function csv_edihist_log ( $msg_str ) {
  * html formatted ordered list
  *
  * @return string
  */
 function csv_log_html($logname='') {
+	check_file_dir_name($logname);
 	$html_str = "<div class='filetext'>".PHP_EOL."<ol class='logview'>".PHP_EOL;
     $fp = csv_edih_basedir().DS.'log'.DS.$logname;
     if ( is_file($fp) ) {
 		$fh = fopen( $fp, 'r');
 		if ($fh !== FALSE) {
diff --git a/library/sanitize.inc.php b/library/sanitize.inc.php
index 73727697e..6801d6d05 100644
--- a/library/sanitize.inc.php
+++ b/library/sanitize.inc.php
@@ -1,33 +1,26 @@
 <?php
 /**
 * Function to check and/or sanitize things for security such as
 * directories names, file names, etc.
-*
-* Copyright (C) 2012 by following Brady Miller <brady.g.miller@gmail.com>
-*
-* LICENSE: This program is free software; you can redistribute it and/or
-* modify it under the terms of the GNU General Public License
-* as published by the Free Software Foundation; either version 3
-* of the License, or (at your option) any later version.
-* This program is distributed in the hope that it will be useful,
-* but WITHOUT ANY WARRANTY; without even the implied warranty of
-* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
-* GNU General Public License for more details.
-* You should have received a copy of the GNU General Public License
-* along with this program. If not, see <http://opensource.org/licenses/gpl-license.php>;.
-*
-* @package OpenEMR
-* @author Brady Miller <brady.g.miller@gmail.com>
-* @author Roberto Vasquez <robertogagliotta@gmail.com>
-* @author Shachar Zilbershlag <shaharzi@matrix.co.il>
-* @link http://www.open-emr.org
-*/
+ *
+ * @package OpenEMR
+ * @link    http://www.open-emr.org
+ * @author  Brady Miller <brady.g.miller@gmail.com>
+ * @author  Roberto Vasquez <robertogagliotta@gmail.com>
+ * @author  Shachar Zilbershlag <shaharzi@matrix.co.il>
+ * @copyright Copyright (c) 2012-2017 Brady Miller <brady.g.miller@gmail.com>
+ * @license https://github.com/openemr/openemr/blob/master/LICENSE GNU General Public License 3
+ */
+
+
 // If the label contains any illegal characters, then the script will die.
 function check_file_dir_name($label) {
-  if (empty($label) || preg_match('/[^A-Za-z0-9_.-]/', $label))
+  if (empty($label) || preg_match('/[^A-Za-z0-9_.-]/', $label)) {
+    error_log("ERROR: The following variable contains invalid characters:" . $label);
     die(xlt("ERROR: The following variable contains invalid characters").": ". attr($label));
+  }
 }
 
 // Convert all illegal characters to _
 function convert_safe_file_dir_name($label) {
   return preg_replace('/[^A-Za-z0-9_.-]/','_',$label);

Vulnerable code: *
* Copyright (C) 2012 by following Brady Miller <brady.g.miller@gmail.com>
*
* LICENSE: This program is free software; you can redistribute it and/or
* modify it under the terms of the GNU General Public License
* as published by the Free Software Foundation; either version 3
* of the License, or (at your option) any later version.
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU General Public License for more details.
* You should have received a copy of the GNU General Public License
* along with this program. If not, see <http://opensource.org/licenses/gpl-license.php>;.
*
* @package OpenEMR
* @author Brady Miller <brady.g.miller@gmail.com>
* @author Roberto Vasquez <robertogagliotta@gmail.com>
* @author Shachar Zilbershlag <shaharzi@matrix.co.il>
* @link http://www.open-emr.org
*/
  if (empty($label) || preg_match('/[^A-Za-z0-9_.-]/', $label))
Fixed code: 	check_file_dir_name($logname);
 *
 * @package OpenEMR
 * @link    http://www.open-emr.org
 * @author  Brady Miller <brady.g.miller@gmail.com>
 * @author  Roberto Vasquez <robertogagliotta@gmail.com>
 * @author  Shachar Zilbershlag <shaharzi@matrix.co.il>
 * @copyright Copyright (c) 2012-2017 Brady Miller <brady.g.miller@gmail.com>
 * @license https://github.com/openemr/openemr/blob/master/LICENSE GNU General Public License 3
 */


  if (empty($label) || preg_match('/[^A-Za-z0-9_.-]/', $label)) {
    error_log("ERROR: The following variable contains invalid characters:" . $label);
  }