CVE-2023-2942 (PHP, published 2023-05-27T22:15Z)
Description: value: Improper Input Validation in GitHub repository openemr/openemr prior to 7.0.1.
Severity: nan (CVSS v3 base score: 8.1)
Weakness: CWE-20 \u2014 Improper Input Validation
The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
Repository: https://github.com/openemr/openemr
Files changed:
library/pnotes.inc.php
portal/add_edit_event_user.php
portal/find_appt_popup_user.php
portal/messaging/secure_chat.php
src/PatientPortal/Chat/ChatController.php
Commit message: bug fix (#6079)

* bug fix

* better fix and remove prefix underscore private visibility

* better fix

* even better fix

* revert

* jsAttr()

* another fix

* another fix

* use |=

* review fixes

* typo

* remove whitespace

Vulnerable code:
        array($datetime, $body, $pid, $user, $_SESSION['authProvider'], $authorized, $activity, $title, $assigned_to, $message_status, $_SESSION['authUserID'])
use OpenEMR\Core\Header;
    if ($_POST['form_allday']) {
    if ($_POST['form_repeat']) {
    if ($_POST['form_repeat_type'] == 5) {
    } elseif ($_POST['form_repeat_type'] == 6) {
    } elseif ($_POST['form_repeat_type'] == 7) {
    } elseif ($_POST['form_repeat_type'] == 8) {
    } elseif ($_POST['form_repeat_type'] == 9) {
                        "'" . add_escape_custom($_POST['form_pid']) . "', " .
                    "pc_pid = '" . add_escape_custom($_POST['form_pid']) . "', " .
                "pc_pid = '" . add_escape_custom($_POST['form_pid']) . "', " .
                "pc_endDate = '" . add_escape_custom(fixDate($_POST['form_enddate'])) . "', " .
                "pc_recurrtype = '" . ($_POST['form_repeat'] ? '1' : '0') . "', " .
                "pc_alldayevent = '" . add_escape_custom($_POST['form_allday']) . "', " .
                "pc_prefcatid = '" . add_escape_custom($_POST['form_prefcat']) . "', " .
                "pc_facility = '" . (int)$_POST['facility'] . "' " . // FF stuff
                    "'" . add_escape_custom($_POST['form_pid']) . "', " .
                "'" . add_escape_custom($_POST['form_pid']) . "', " .
                "'" . add_escape_custom(fixDate($_POST['form_enddate'])) . "', " .
                "'" . ($_POST['form_repeat'] ? '1' : '0') . "', " .
                "'" . add_escape_custom($_POST['form_allday']) . "', " .
                "'" . add_escape_custom($_POST['form_prefcat']) . "', " .
                "1, " . (int)$_POST['facility'] . ")"); // FF stuff
    $rtn = addPnote($_POST['form_pid'], $note, 1, 1, $title, $user['username'], '', 'New');
                <input type='hidden' name='form_title' id='form_title' value='<?php echo $row['pc_catid'] ? attr($row['pc_title']) : xla("Office Visit"); ?>' />
                <input type='hidden' name='form_apptstatus' id='form_apptstatus' value='<?php echo $row['pc_apptstatus'] ? attr($row['pc_apptstatus']) : "^" ?>' />
                        <select class="form-control mb-1" onchange='set_category()' id='form_category' name='form_category' value='<?php echo ($row['pc_catid'] > "") ? attr($row['pc_catid']) : '5'; ?>'>
                            <input class="form-control" type='text' size='1' id='form_duration' name='form_duration' value='<?php echo $row['pc_duration'] ? ($row['pc_duration'] * 1 / 60) : attr($thisduration) ?>' readonly />
                    <?php if ($_GET['eid'] && $row['pc_apptstatus'] !== 'x') { ?>
                if ($prefcatid == $input_catid || !$prefcatid) {
                    $slots[$i] |= 1;
                    $slots[$i] |= 2;
if ($_REQUEST['searchdays']) {
                return html;
        if ($this->_isAdmin($username)) {
            $this->_parseAdminCommand($message);
    private function _isAdmin($username)
    private function _parseAdminCommand($message)
    private function _getMyUniqueHash()
        $hash = $this->_getMyUniqueHash();

Fixed code:
        array($datetime, $body, $pid, $user, ($_SESSION['authProvider'] ?? null), $authorized, $activity, $title, $assigned_to, $message_status, ($_SESSION['authUserID'] ?? null))
use OpenEMR\Services\AppointmentService;
if (!empty($_POST['form_pid'])) {
    if ($_POST['form_pid'] != $_SESSION['pid']) {
        echo js_escape("error");
        exit();
    }

    if (! getAvailableSlots($_POST['form_date'], date('Y-m-d', strtotime("+1 year " . $_POST['form_date'])), $_POST['form_provider_ae'])) {
        echo js_escape("error");
        exit();
    }

    $appointment_service = (new AppointmentService())->getOneCalendarCategory($_POST['form_category']);
    if (($_POST['form_duration'] * 60) != ($appointment_service[0]['pc_duration'])) {
        echo js_escape("error");
        exit();
    }
}

    if ($_POST['form_allday'] ?? null) {
    if ($_POST['form_repeat'] ?? null) {
    if (($_POST['form_repeat_type'] ?? null) == 5) {
    } elseif (($_POST['form_repeat_type'] ?? null) == 6) {
    } elseif (($_POST['form_repeat_type'] ?? null) == 7) {
    } elseif (($_POST['form_repeat_type'] ?? null) == 8) {
    } elseif (($_POST['form_repeat_type'] ?? null) == 9) {
                        "'" . add_escape_custom($_SESSION['pid']) . "', " .
                    "pc_pid = '" . add_escape_custom($_SESSION['pid']) . "', " .
                "pc_pid = '" . add_escape_custom($_SESSION['pid']) . "', " .
                "pc_endDate = '" . add_escape_custom(fixDate($_POST['form_enddate'] ?? '')) . "', " .
                "pc_recurrtype = '" . (($_POST['form_repeat'] ?? null) ? '1' : '0') . "', " .
                "pc_alldayevent = '" . add_escape_custom(($_POST['form_allday'] ?? '')) . "', " .
                "pc_prefcatid = '" . add_escape_custom(($_POST['form_prefcat'] ?? '')) . "', " .
                "pc_facility = '" . (int)($_POST['facility'] ?? null) . "' " . // FF stuff
                    "'" . add_escape_custom($_SESSION['pid']) . "', " .
                "'" . add_escape_custom($_SESSION['pid']) . "', " .
                "'" . add_escape_custom(fixDate(($_POST['form_enddate'] ?? ''))) . "', " .
                "'" . (($_POST['form_repeat'] ?? null) ? '1' : '0') . "', " .
                "'" . add_escape_custom(($_POST['form_allday'] ?? '')) . "', " .
                "'" . add_escape_custom(($_POST['form_prefcat'] ?? null)) . "', " .
                "1, " . (int)($_POST['facility'] ?? null) . ")"); // FF stuff
    $rtn = addPnote($_SESSION['pid'], $note, 1, 1, $title, $user['username'], '', 'New');
                <input type='hidden' name='form_title' id='form_title' value='<?php echo ($row['pc_catid'] ?? '') ? attr($row['pc_title']) : xla("Office Visit"); ?>' />
                <input type='hidden' name='form_apptstatus' id='form_apptstatus' value='<?php echo ($row['pc_apptstatus'] ?? '') ? attr($row['pc_apptstatus'] ?? '') : "^" ?>' />
                        <select class="form-control mb-1" onchange='set_category()' id='form_category' name='form_category' value='<?php echo (($row['pc_catid'] ?? '') > "") ? attr($row['pc_catid']) : '5'; ?>'>
                            <input class="form-control" type='text' size='1' id='form_duration' name='form_duration' value='<?php echo ($row['pc_duration'] ?? '') ? ($row['pc_duration'] * 1 / 60) : attr($thisduration) ?>' readonly />
                    <?php if (($_GET['eid'] ?? null) && $row['pc_apptstatus'] !== 'x') { ?>
                if (!empty($slots[$i])) {
                    if ($prefcatid == $input_catid || !$prefcatid) {
                        $slots[$i] |= 1;
                    } else {
                        $slots[$i] |= 2;
                    }
                    $slots[$i] |= 1;
if ($_REQUEST['searchdays'] ?? null) {
                return jsAttr(html);
        if ($this->isAdmin($username)) {
            $this->parseAdminCommand($message);
    private function isAdmin($username)
    private function parseAdminCommand($message)
    private function getMyUniqueHash()
        $hash = $this->getMyUniqueHash();