CVE-2022-2824 (PHP, published 2022-08-15T16:15Z)
Description: value: Authorization Bypass Through User-Controlled Key in GitHub repository openemr/openemr prior to 7.0.0.1.


Severity: nan (CVSS v3 base score: 5.4)
Weakness: CWE-639 \u2014 Authorization Bypass Through User-Controlled Key
The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.
Repository: https://github.com/openemr/openemr
Files changed:
portal/patient/fwk/libs/verysimple/Phreeze/Criteria.php
portal/patient/fwk/libs/verysimple/Phreeze/DataPage.php
portal/patient/fwk/libs/verysimple/Phreeze/DataSet.php
portal/patient/fwk/libs/verysimple/Phreeze/Phreezable.php
portal/patient/fwk/libs/verysimple/Phreeze/Reporter.php
portal/patient/libs/Controller/PortalPatientController.php
portal/patient/templates/OnsiteActivityViewListView.tpl.php
portal/patient/templates/ProviderHome.tpl.php
portal/report/portal_patient_report.php
portal/sign/lib/save-signature.php
portal/sign/lib/show-signature.php
src/Gacl/Gacl.php
Commit message: bug fix and php8.1 fixes (#5664)

* bug fix and php8.1 fixes

* styling

Vulnerable code:
                    } elseif (substr($prop, - 7) == "_Equals" && strlen($this->$prop)) {
                    } elseif (substr($prop, - 10) == "_NotEquals" && strlen($this->$prop)) {
                    } elseif (substr($prop, - 8) == "_IsEmpty" && $this->$prop) {
                    } elseif (substr($prop, - 11) == "_IsNotEmpty" && $this->$prop) {
                    } elseif (substr($prop, - 7) == "_IsLike" && strlen($this->$prop)) {
                    } elseif (substr($prop, - 10) == "_IsNotLike" && strlen($this->$prop)) {
                    } elseif (substr($prop, - 11) == "_BeginsWith" && strlen($this->$prop)) {
                    } elseif (substr($prop, - 9) == "_EndsWith" && strlen($this->$prop)) {
                    } elseif (substr($prop, - 12) == "_GreaterThan" && strlen($this->$prop)) {
                    } elseif (substr($prop, - 19) == "_GreaterThanOrEqual" && strlen($this->$prop)) {
                    } elseif (substr($prop, - 9) == "_LessThan" && strlen($this->$prop)) {
                    } elseif (substr($prop, - 16) == "_LessThanOrEqual" && strlen($this->$prop)) {
                    } elseif (substr($prop, - 10) == "_BitwiseOr" && strlen($this->$prop)) {
                    } elseif (substr($prop, - 11) == "_BitwiseAnd" && strlen($this->$prop)) {
                    } elseif (substr($prop, - 16) == "_LiteralFunction" && strlen($this->$prop)) {
                            if (strtotime($this->$prop) === '') {
            $patient->Regdate = date('Y-m-d', strtotime($this->SafeGetVal($json, 'regdate', $patient->Regdate)));
    $this->assign('title', xlt('Portal') . ' | ' . xlt('Activity'));
    $this->assign('nav', 'onsiteactivityviews');
    $this->display('_FormsHeader.tpl.php');
    echo "<script>var cuser='" . $this->cuser . "';</script>";
                    if ($toprint = $html_strings[$var]) {
if ($data['mode'] === 'fetch_info') {
if (!$row['pid'] && !$row['user']) {
if ($row['status'] == 'filed') {
    if ($data['mode'] === 'fetch_info') {
} elseif ($row['status'] == 'waiting' || $status == 'waiting') {

Fixed code:
                    } elseif (substr($prop, - 7) == "_Equals" && strlen($this->$prop ?? '')) {
                    } elseif (substr($prop, - 10) == "_NotEquals" && strlen($this->$prop ?? '')) {
                    } elseif (substr($prop, - 8) == "_IsEmpty" && $this->$prop ?? '') {
                    } elseif (substr($prop, - 11) == "_IsNotEmpty" && $this->$prop ?? '') {
                    } elseif (substr($prop, - 7) == "_IsLike" && strlen($this->$prop ?? '')) {
                    } elseif (substr($prop, - 10) == "_IsNotLike" && strlen($this->$prop ?? '')) {
                    } elseif (substr($prop, - 11) == "_BeginsWith" && strlen($this->$prop ?? '')) {
                    } elseif (substr($prop, - 9) == "_EndsWith" && strlen($this->$prop ?? '')) {
                    } elseif (substr($prop, - 12) == "_GreaterThan" && strlen($this->$prop ?? '')) {
                    } elseif (substr($prop, - 19) == "_GreaterThanOrEqual" && strlen($this->$prop ?? '')) {
                    } elseif (substr($prop, - 9) == "_LessThan" && strlen($this->$prop ?? '')) {
                    } elseif (substr($prop, - 16) == "_LessThanOrEqual" && strlen($this->$prop ?? '')) {
                    } elseif (substr($prop, - 10) == "_BitwiseOr" && strlen($this->$prop ?? '')) {
                    } elseif (substr($prop, - 11) == "_BitwiseAnd" && strlen($this->$prop ?? '')) {
                    } elseif (substr($prop, - 16) == "_LiteralFunction" && strlen($this->$prop ?? '')) {
    #[\ReturnTypeWillChange]
    #[\ReturnTypeWillChange]
    #[\ReturnTypeWillChange]
    #[\ReturnTypeWillChange]
    #[\ReturnTypeWillChange]
    #[\ReturnTypeWillChange]
    #[\ReturnTypeWillChange]
    #[\ReturnTypeWillChange]
    #[\ReturnTypeWillChange]
    #[\ReturnTypeWillChange]
                            if (strtotime(($this->$prop ?? '')) === '') {

    function __serialize()
    {}

    function __unserialize($data)
    {}

    function __serialize()
    {}

    function __unserialize($data)
    {}
            if (!empty($patient->Regdate)) {
                $patient->Regdate = date('Y-m-d', strtotime($this->SafeGetVal($json, 'regdate', $patient->Regdate)));
            }
$this->assign('title', xlt('Portal') . ' | ' . xlt('Activity'));
$this->assign('nav', 'onsiteactivityviews');
use OpenEMR\Common\Acl\AclMain;

if (!AclMain::aclCheckCore('patientportal', 'portal')) {
    die(xlt("Unauthorized"));
    exit;
}

$this->display('_FormsHeader.tpl.php');
echo "<script>var cuser='" . $this->cuser . "';</script>";
use OpenEMR\Common\Acl\AclMain;
if (!AclMain::aclCheckCore('patientportal', 'portal')) {
    die(xlt("Unauthorized"));
    exit;
}

                    if ($toprint = ($html_strings[$var] ?? '')) {
if (!$isPortal) {
    $userManipulatedFlag = false;
    if ($user != $_SESSION['authUserID']) {
        $userManipulatedFlag = true;
    }

    if ($userManipulatedFlag) {
        echo js_escape("error");
        exit();
    }
}

if (!$isPortal) {
    $userManipulatedFlag = false;
    if ($user != $_SESSION['authUserID']) {
        $userManipulatedFlag = true;
    }

    if ($userManipulatedFlag) {
        echo js_escape("error");
        exit();
    }
}

if (($data['mode'] ?? null) === 'fetch_info') {
if (!($row['pid'] ?? null) && !($row['user'] ?? null)) {
if (($row['status'] ?? null) == 'filed') {
    if (($data['mode'] ?? null) === 'fetch_info') {
} elseif (($row['status'] ?? null) == 'waiting' || $status == 'waiting') {
                            if(!is_array($retarr)) {
                                $retarr = [];
                            }