CVE-2023-2950 (PHP, published 2023-05-28T04:15Z)
Description: value: Improper Authorization in GitHub repository openemr/openemr prior to 7.0.1.
Severity: nan (CVSS v3 base score: 8.1)
Weakness: CWE-285 \u2014 Improper Authorization
The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.
Repository: https://github.com/openemr/openemr
Files changed:
portal/patient/libs/Controller/OnsiteDocumentController.php
portal/patient/scripts/app/onsitedocuments.js
Commit message: fix: bug fix (#6354)

* fix: bug fix

* use attr instead

Vulnerable code:
            if (!empty($_SESSION["patient_portal_onsite_two"] ?? null)) {
            }
            if (!empty($_SESSION["patient_portal_onsite_two"] ?? null)) {
            }
    /**
     */
        if (isPortal) {
        }
    encode: function (content, k) {
    }

Fixed code:
            // removing for testing
            /* if (!empty($_SESSION["patient_portal_onsite_two"] ?? null)) {
            } */
                $new_data = $onsitedocument->FullDocument;
                // use a custom diff function to look for changing tags only with html
                if ($new_data != strip_tags($new_data)) {
                    $old_data = $json->fullDocument;
                    $onsitedocument->FullDocument = $this->htmlDiff($old_data, $new_data);
                }
            $old_data = $onsitedocument->FullDocument;
            // removing for testing
            /* if (!empty($_SESSION["patient_portal_onsite_two"] ?? null)) {
            } */
                // use a custom diff function to look for changing tags only with html
                $new_data = $onsitedocument->FullDocument;
                if ($new_data != strip_tags($new_data)) {
                    $onsitedocument->FullDocument = $this->htmlDiff($old_data, $new_data);
                }
    // removing for testing
    /*

    */

    private function diff($old, $new): array
    {
        $matrix = array();
        $maxlen = 0;
        foreach ($old as $oindex => $ovalue) {
            $nkeys = array_keys($new, $ovalue);
            foreach ($nkeys as $nindex) {
                $matrix[$oindex][$nindex] = isset($matrix[$oindex - 1][$nindex - 1]) ?
                    $matrix[$oindex - 1][$nindex - 1] + 1 : 1;
                if ($matrix[$oindex][$nindex] > $maxlen) {
                    $maxlen = $matrix[$oindex][$nindex];
                    $omax = $oindex + 1 - $maxlen;
                    $nmax = $nindex + 1 - $maxlen;
                }
            }
        }
        if ($maxlen == 0) {
            return array(array('d' => $old, 'i' => $new));
        }
        return array_merge(
            $this->diff(array_slice($old, 0, $omax), array_slice($new, 0, $nmax)),
            array_slice($new, $nmax, $maxlen),
            $this->diff(array_slice($old, $omax + $maxlen), array_slice($new, $nmax + $maxlen))
        );
    }

    private function htmlDiff($old, $new): string
    {
        $ret = '';
        $diff = $this->diff(preg_split("/[\s]+/", $old), preg_split("/[\s]+/", $new));
        foreach ($diff as $k) {
            if (is_array($k)) {
                $ret .= (!empty($k['i']) ? attr(implode(' ', $k['i'])) : '');
            } else {
                $ret .= $k . ' ';
            }
        }
        return $ret;
    }
        // removing for testing
        /* if (isPortal) {
        } */
    // removing for testing
    /* encode: function (content, k) {
    } */