CVE-2023-2945: Missing Authorization (CWE-862)
value: Missing Authorization in GitHub repository openemr/openemr prior to 7.0.1.
CWE description: The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
CVSS v3 base score: 5.4
Published: 2023-05-27T22:15Z
Repository: https://github.com/openemr/openemr
Language: PHP
Files changed: portal/messaging/handle_note.php
Commit date: 2023-03-10 13:30:42 +0800
Commit message: fix: bug fix (#6270)


Diff: diff --git a/portal/messaging/handle_note.php b/portal/messaging/handle_note.php
index a7ae74bc1e5..a9a83492e42 100644
--- a/portal/messaging/handle_note.php
+++ b/portal/messaging/handle_note.php
@@ -32,10 +32,33 @@ if (isset($_SESSION['pid']) && isset($_SESSION['patient_portal_onsite_two'])) {
         OpenEMR\Common\Session\SessionUtil::portalSessionCookieDestroy();
         exit;
     }
     // owner is the patient portal_username
     $owner = $_SESSION['portal_username'];
+
+    // ensure the owner is bootstrapped to the $_POST['sender_id'] and
+    //   $_POST['sender_name'], if applicable
+    if (empty($_POST['sender_id']) && !empty($_POST['sender_name'])) {
+        echo xlt("illegal Action");
+        OpenEMR\Common\Session\SessionUtil::portalSessionCookieDestroy();
+        exit;
+    }
+    if (!empty($_POST['sender_id'])) {
+        if ($_POST['sender_id'] != $owner) {
+            echo xlt("illegal Action");
+            OpenEMR\Common\Session\SessionUtil::portalSessionCookieDestroy();
+            exit;
+        }
+    }
+    if (!empty($_POST['sender_name'])) {
+        $nameCheck = sqlQuery("SELECT `fname`, `lname` FROM `patient_data` WHERE `pid` = ?", [$_SESSION['pid']]);
+        if (empty($nameCheck) || ($_POST['sender_name'] != ($nameCheck['fname'] . " " . $nameCheck['lname']))) {
+            echo xlt("illegal Action");
+            OpenEMR\Common\Session\SessionUtil::portalSessionCookieDestroy();
+            exit;
+        }
+    }
 } else {
     OpenEMR\Common\Session\SessionUtil::portalSessionCookieDestroy();
     $ignoreAuth = false;
     require_once(dirname(__FILE__) . "/../../interface/globals.php");
     if (!isset($_SESSION['authUserID']) || empty($_SESSION['authUser'])) {

Fixed code: 
    // ensure the owner is bootstrapped to the $_POST['sender_id'] and
    //   $_POST['sender_name'], if applicable
    if (empty($_POST['sender_id']) && !empty($_POST['sender_name'])) {
        echo xlt("illegal Action");
        OpenEMR\Common\Session\SessionUtil::portalSessionCookieDestroy();
        exit;
    }
    if (!empty($_POST['sender_id'])) {
        if ($_POST['sender_id'] != $owner) {
            echo xlt("illegal Action");
            OpenEMR\Common\Session\SessionUtil::portalSessionCookieDestroy();
            exit;
        }
    }
    if (!empty($_POST['sender_name'])) {
        $nameCheck = sqlQuery("SELECT `fname`, `lname` FROM `patient_data` WHERE `pid` = ?", [$_SESSION['pid']]);
        if (empty($nameCheck) || ($_POST['sender_name'] != ($nameCheck['fname'] . " " . $nameCheck['lname']))) {
            echo xlt("illegal Action");
            OpenEMR\Common\Session\SessionUtil::portalSessionCookieDestroy();
            exit;
        }
    }