CVE-2022-2493 (published 2022-07-22T04:15Z)

Data Access from Outside Expected Data Manager Component in GitHub repository openemr/openemr prior to 7.0.0.

CVSS v3 base score: 8.1, HIGH (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N)

Weakness information:
cwe_id: NVD-CWE-Other
cwe_name: Other
description: NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/openemr/openemr
commit_details: repo_url: https://github.com/openemr/openemr
author: Brady Miller
author_date: 2022-05-03 22:09:56-07:00
msg: bug fixes b1 (#5280)
repository: repo_url: https://github.com/openemr/openemr
repo_name: openemr/openemr
description: The most popular open source electronic health records and medical practice management solution.
repo_language: PHP
owner: openemr
file_changes: filename: C_Document.class.php
change_type: ModificationType.MODIFY
diff: @@ -16,6 +16,7 @@ require_once(__DIR__ . "/../library/patient.inc");
 use OpenEMR\Common\Acl\AclMain;
 use OpenEMR\Common\Crypto\CryptoGen;
 use OpenEMR\Common\Csrf\CsrfUtils;
+use OpenEMR\Common\Twig\TwigContainer;
 use OpenEMR\Services\FacilityService;
 use OpenEMR\Services\PatientService;
 
@@ -1063,9 +1064,17 @@ class C_Document extends Controller
         $cur_pid = isset($_GET['patient_id']) ? filter_input(INPUT_GET, 'patient_id') : '';
         $used_msg = xl('Current patient unavailable here. Use Patient Documents');
         if ($cur_pid == '00') {
+            if (!AclMain::aclCheckCore('patients', 'docs', '', ['write', 'addonly'])) {
+                echo (new TwigContainer(null, $GLOBALS['kernel']))->getTwig()->render('core/unauthorized.html.twig', ['pageTitle' => xl("Documents")]);
+                exit;
+            }
             $cur_pid = '0';
             $is_new = 1;
         }
+        if (!AclMain::aclCheckCore('patients', 'docs')) {
+            echo (new TwigContainer(null, $GLOBALS['kernel']))->getTwig()->render('core/unauthorized.html.twig', ['pageTitle' => xl("Documents")]);
+            exit;
+        }
         $this->assign('is_new', $is_new);
         $this->assign('place_hld', $place_hld);
         $this->assign('cur_pid', $cur_pid);

programming_language: PHP
filename: C_PracticeSettings.class.php
change_type: ModificationType.MODIFY
diff: @@ -1,5 +1,8 @@
 <?php
 
+use OpenEMR\Common\Acl\AclMain;
+use OpenEMR\Common\Twig\TwigContainer;
+
 class C_PracticeSettings extends Controller
 {
     var $template_mod;
@@ -14,6 +17,11 @@ class C_PracticeSettings extends Controller
         $this->assign("TOP_ACTION", $GLOBALS['webroot'] . "/controller.php?" . "practice_settings" . "&");
         $this->assign("STYLE", $GLOBALS['style']);
         $this->direction = ($GLOBALS['_SESSION']['language_direction'] == 'rtl') ? 'right' : 'left';
+
+        if (!AclMain::aclCheckCore('admin', 'practice')) {
+            echo (new TwigContainer(null, $GLOBALS['kernel']))->getTwig()->render('core/unauthorized.html.twig', ['pageTitle' => xl("Practice Settings")]);
+            exit;
+        }
     }
 
     function default_action($display = "")

programming_language: PHP
filename: edit_payment.php
change_type: ModificationType.MODIFY
diff: @@ -27,8 +27,15 @@ require_once("$srcdir/patient.inc");
 require_once("$srcdir/options.inc.php");
 require_once("$srcdir/payment.inc.php");
 
+use OpenEMR\Common\Acl\AclMain;
+use OpenEMR\Common\Twig\TwigContainer;
 use OpenEMR\Core\Header;
 
+if (!AclMain::aclCheckCore('acct', 'bill', '', 'write') && !AclMain::aclCheckCore('acct', 'eob', '', 'write')) {
+    echo (new TwigContainer(null, $GLOBALS['kernel']))->getTwig()->render('core/unauthorized.html.twig', ['pageTitle' => xl("Confirm Payment")]);
+    exit;
+}
+
 $screen = 'edit_payment';
 
 // Deletion of payment distribution code

programming_language: PHP
filename: era_payments.php
change_type: ModificationType.MODIFY
diff: @@ -23,10 +23,17 @@ require_once("$srcdir/options.inc.php");
 
 use OpenEMR\Billing\ParseERA;
 use OpenEMR\Billing\SLEOB;
+use OpenEMR\Common\Acl\AclMain;
 use OpenEMR\Common\Csrf\CsrfUtils;
+use OpenEMR\Common\Twig\TwigContainer;
 use OpenEMR\Core\Header;
 use OpenEMR\OeUI\OemrUI;
 
+if (!AclMain::aclCheckCore('acct', 'bill', '', 'write') && !AclMain::aclCheckCore('acct', 'eob', '', 'write')) {
+    echo (new TwigContainer(null, $GLOBALS['kernel']))->getTwig()->render('core/unauthorized.html.twig', ['pageTitle' => xl("ERA Posting")]);
+    exit;
+}
+
 $hidden_type_code = isset($_POST['hidden_type_code']) ? $_POST['hidden_type_code'] : '';
 $check_date = isset($_POST['check_date']) ? $_POST['check_date'] : '';
 $post_to_date = isset($_POST['post_to_date']) ? $_POST['post_to_date'] : '';

programming_language: PHP
filename: indigent_patients_report.php
change_type: ModificationType.MODIFY
diff: @@ -17,9 +17,16 @@
 require_once("../globals.php");
 require_once("$srcdir/patient.inc");
 
+use OpenEMR\Common\Acl\AclMain;
 use OpenEMR\Common\Csrf\CsrfUtils;
+use OpenEMR\Common\Twig\TwigContainer;
 use OpenEMR\Core\Header;
 
+if (!AclMain::aclCheckCore('acct', 'rep_a')) {
+    echo (new TwigContainer(null, $GLOBALS['kernel']))->getTwig()->render('core/unauthorized.html.twig', ['pageTitle' => xl("Indigent Patients Report")]);
+    exit;
+}
+
 $alertmsg = '';
 
 function bucks($amount)

programming_language: PHP
filename: new_payment.php
change_type: ModificationType.MODIFY
diff: @@ -25,9 +25,16 @@ require_once("$srcdir/options.inc.php");
 require_once("$srcdir/payment.inc.php");
 
 use OpenEMR\Billing\ParseERA;
+use OpenEMR\Common\Acl\AclMain;
+use OpenEMR\Common\Twig\TwigContainer;
 use OpenEMR\Core\Header;
 use OpenEMR\OeUI\OemrUI;
 
+if (!AclMain::aclCheckCore('acct', 'bill', '', 'write') && !AclMain::aclCheckCore('acct', 'eob', '', 'write')) {
+    echo (new TwigContainer(null, $GLOBALS['kernel']))->getTwig()->render('core/unauthorized.html.twig', ['pageTitle' => xl("New Payment")]);
+    exit;
+}
+
 //===============================================================================
     $screen = 'new_payment';
 //===============================================================================

programming_language: PHP
filename: search_payments.php
change_type: ModificationType.MODIFY
diff: @@ -23,9 +23,16 @@ require_once("$srcdir/patient.inc");
 require_once("$srcdir/options.inc.php");
 require_once("$srcdir/payment.inc.php");
 
+use OpenEMR\Common\Acl\AclMain;
+use OpenEMR\Common\Twig\TwigContainer;
 use OpenEMR\Core\Header;
 use OpenEMR\OeUI\OemrUI;
 
+if (!AclMain::aclCheckCore('acct', 'bill', '', 'write') && !AclMain::aclCheckCore('acct', 'eob', '', 'write')) {
+    echo (new TwigContainer(null, $GLOBALS['kernel']))->getTwig()->render('core/unauthorized.html.twig', ['pageTitle' => xl("Search Payment")]);
+    exit;
+}
+
 //===============================================================================
 //Deletion of payment and its corresponding distributions.
 //===============================================================================

programming_language: PHP
filename: sl_eob_search.php
change_type: ModificationType.MODIFY
diff: @@ -36,10 +36,17 @@ use Mpdf\Mpdf;
 use OpenEMR\Billing\InvoiceSummary;
 use OpenEMR\Billing\ParseERA;
 use OpenEMR\Billing\SLEOB;
+use OpenEMR\Common\Acl\AclMain;
 use OpenEMR\Common\Csrf\CsrfUtils;
+use OpenEMR\Common\Twig\TwigContainer;
 use OpenEMR\Core\Header;
 use OpenEMR\OeUI\OemrUI;
 
+if (!AclMain::aclCheckCore('acct', 'eob', '', 'write')) {
+    echo (new TwigContainer(null, $GLOBALS['kernel']))->getTwig()->render('core/unauthorized.html.twig', ['pageTitle' => xl("EOB Posting - Search")]);
+    exit;
+}
+
 $DEBUG = 0; // set to 0 for production, 1 to test
 $alertmsg = '';
 $where = '';

programming_language: PHP
filename: sl_receipts_report.php
change_type: ModificationType.MODIFY
diff: @@ -36,8 +36,14 @@ require_once('../forms/fee_sheet/codes.php');
 
 use OpenEMR\Common\Acl\AclMain;
 use OpenEMR\Common\Csrf\CsrfUtils;
+use OpenEMR\Common\Twig\TwigContainer;
 use OpenEMR\Core\Header;
 
+if (!AclMain::aclCheckCore('acct', 'rep') && !AclMain::aclCheckCore('acct', 'rep_a')) {
+    echo (new TwigContainer(null, $GLOBALS['kernel']))->getTwig()->render('core/unauthorized.html.twig', ['pageTitle' => xl("Cash Receipts by Provider")]);
+    exit;
+}
+
 function is_clinic($code)
 {
     global $bcodes;
@@ -60,11 +66,6 @@ function bucks($amount)
     }
 }
 
-if (! AclMain::aclCheckCore('acct', 'rep')) {
-    die(xlt("Unauthorized access."));
-}
-
-
 $form_use_edate  = $_POST['form_use_edate'] ?? null;
 
 $form_proc_codefull = trim($_POST['form_proc_codefull'] ?? '');
@@ -373,6 +374,11 @@ $form_facility   = $_POST['form_facility'] ?? null;
                     <?php
                     if ($_POST['form_refresh']) {
                         $form_doctor = $_POST['form_doctor'];
+                        if (!AclMain::aclCheckCore('acct', 'rep_a')) {
+                            // only allow user to see their encounter information
+                            $form_doctor = $_SESSION['authUserID'];
+                        }
+
                         $arows = array();
 
                         $ids_to_skip = array();

programming_language: PHP
filename: display_documents.php
change_type: ModificationType.MODIFY
diff: @@ -18,8 +18,15 @@
 require_once('../globals.php');
 require_once("$srcdir/patient.inc");
 
+use OpenEMR\Common\Acl\AclMain;
+use OpenEMR\Common\Twig\TwigContainer;
 use OpenEMR\Core\Header;
 
+if (!AclMain::aclCheckCore('patients', 'lab')) {
+    echo (new TwigContainer(null, $GLOBALS['kernel']))->getTwig()->render('core/unauthorized.html.twig', ['pageTitle' => xl("Lab Documents")]);
+    exit;
+}
+
 $curdate = date_create(date("Y-m-d"));
 date_sub($curdate, date_interval_create_from_date_string("7 days"));
 $sub_date = date_format($curdate, 'Y-m-d');

programming_language: PHP
filename: orders_results.php
change_type: ModificationType.MODIFY
diff: @@ -17,6 +17,7 @@ require_once("$srcdir/options.inc.php");
 require_once("$srcdir/lab.inc");
 
 use OpenEMR\Common\Acl\AclMain;
+use OpenEMR\Common\Twig\TwigContainer;
 use OpenEMR\Core\Header;
 
 // Indicates if we are entering in batch mode.
@@ -26,15 +27,17 @@ $form_batch = empty($_GET['batch']) ? 0 : 1;
 $form_review = empty($_GET['review']) ? 0 : 1;
 
 // Check authorization.
-$thisauth = AclMain::aclCheckCore('patients', 'med');
+$thisauth = AclMain::aclCheckCore('patients', 'lab');
 if (!$thisauth) {
-    die(xlt('Not authorized'));
+    echo (new TwigContainer(null, $GLOBALS['kernel']))->getTwig()->render('core/unauthorized.html.twig', ['pageTitle' => xl("Procedure Results")]);
+    exit;
 }
 
 // Check authorization for pending review.
 $reviewauth = AclMain::aclCheckCore('patients', 'sign');
 if ($form_review and !$reviewauth and !$thisauth) {
-    die(xlt('Not authorized'));
+    echo (new TwigContainer(null, $GLOBALS['kernel']))->getTwig()->render('core/unauthorized.html.twig', ['pageTitle' => xl("Procedure Results")]);
+    exit;
 }
 
 // Set pid for pending review.

programming_language: PHP
filename: pending_orders.php
change_type: ModificationType.MODIFY
diff: @@ -18,8 +18,14 @@ require_once "$srcdir/options.inc.php";
 
 use OpenEMR\Common\Acl\AclMain;
 use OpenEMR\Common\Csrf\CsrfUtils;
+use OpenEMR\Common\Twig\TwigContainer;
 use OpenEMR\Core\Header;
 
+if (!AclMain::aclCheckCore('patients', 'lab')) {
+    echo (new TwigContainer(null, $GLOBALS['kernel']))->getTwig()->render('core/unauthorized.html.twig', ['pageTitle' => xl("Pending Orders")]);
+    exit;
+}
+
 function thisLineItem($row)
 {
     $provname = $row['provider_lname'];
@@ -53,10 +59,6 @@ function thisLineItem($row)
     } // End not csv export
 }
 
-if (!AclMain::aclCheckCore('acct', 'rep')) {
-    die(xlt("Unauthorized access."));
-}
-
 $form_from_date = isset($_POST['form_from_date']) ? DateToYYYYMMDD($_POST['form_from_date']) : date('Y-m-d');
 $form_to_date   = isset($_POST['form_to_date']) ? DateToYYYYMMDD($_POST['form_to_date']) : date('Y-m-d');
 $form_facility  = $_POST['form_facility'] ?? null;

programming_language: PHP
filename: procedure_stats.php
change_type: ModificationType.MODIFY
diff: @@ -22,12 +22,12 @@ require_once "$srcdir/options.inc.php";
 
 use OpenEMR\Common\Acl\AclMain;
 use OpenEMR\Common\Csrf\CsrfUtils;
+use OpenEMR\Common\Twig\TwigContainer;
 use OpenEMR\Core\Header;
 
-// Might want something different here.
-//
-if (! AclMain::aclCheckCore('acct', 'rep')) {
-    die(xlt("Unauthorized access."));
+if (!AclMain::aclCheckCore('patients', 'lab')) {
+    echo (new TwigContainer(null, $GLOBALS['kernel']))->getTwig()->render('core/unauthorized.html.twig', ['pageTitle' => xl("Procedure Statistics Report")]);
+    exit;
 }
 
 $from_date     = isset($_POST['form_from_date']) ? DateToYYYYMMDD($_POST['form_from_date']) : '0000-00-00';

programming_language: PHP
filename: types.php
change_type: ModificationType.MODIFY
diff: @@ -15,6 +15,8 @@
 
 require_once("../globals.php");
 
+use OpenEMR\Common\Acl\AclMain;
+use OpenEMR\Common\Twig\TwigContainer;
 use OpenEMR\Core\Header;
 
 // This script can be run either inside the OpenEMR frameset for order catalog
@@ -26,6 +28,15 @@ $popup = empty($_GET['popup']) ? 0 : 1;
 $order = isset($_GET['order']) ? $_GET['order'] + 0 : 0;
 $labid = isset($_GET['labid']) ? $_GET['labid'] + 0 : 0;
 
+if (!$popup && !AclMain::aclCheckCore('admin', 'super')) {
+    echo (new TwigContainer(null, $GLOBALS['kernel']))->getTwig()->render('core/unauthorized.html.twig', ['pageTitle' => xl("Configure Orders and Results")]);
+    exit;
+}
+if ($popup && !AclMain::aclCheckCore('patients', 'lab') && !AclMain::aclCheckCore('admin', 'super')) {
+    echo (new TwigContainer(null, $GLOBALS['kernel']))->getTwig()->render('core/unauthorized.html.twig', ['pageTitle' => xl("Configure Orders and Results")]);
+    exit;
+}
+
 // If Save was clicked, set the result, close the window and exit.
 //
 if ($popup && $_POST['form_save']) {

programming_language: PHP
filename: ccr_import.php
change_type: ModificationType.MODIFY
diff: @@ -17,8 +17,15 @@
 
 require_once(dirname(__FILE__) . "../../globals.php");
 
+use OpenEMR\Common\Acl\AclMain;
+use OpenEMR\Common\Twig\TwigContainer;
 use OpenEMR\Core\Header;
 
+if (!AclMain::aclCheckCore('patients', 'med', '', 'write')) {
+    echo (new TwigContainer(null, $GLOBALS['kernel']))->getTwig()->render('core/unauthorized.html.twig', ['pageTitle' => xl("Import")]);
+    exit;
+}
+
 ?>
 <html>
 <head>

programming_language: PHP
filename: ccr_pending_approval.php
change_type: ModificationType.MODIFY
diff: @@ -18,9 +18,16 @@ require_once(dirname(__FILE__) . "/../../library/options.inc.php");
 require_once(dirname(__FILE__) . "/../../library/patient.inc");
 require_once(dirname(__FILE__) . "/../../library/parse_patient_xml.php");
 
+use OpenEMR\Common\Acl\AclMain;
 use OpenEMR\Common\Csrf\CsrfUtils;
+use OpenEMR\Common\Twig\TwigContainer;
 use OpenEMR\Core\Header;
 
+if (!AclMain::aclCheckCore('patients', 'med', '', 'write')) {
+    echo (new TwigContainer(null, $GLOBALS['kernel']))->getTwig()->render('core/unauthorized.html.twig', ['pageTitle' => xl("CCR Approve")]);
+    exit;
+}
+
 if (isset($_GET['approve']) && $_GET['approve'] == 1) {
     if (!CsrfUtils::verifyCsrfToken($_GET["csrf_token_form"])) {
         CsrfUtils::csrfNotVerified();

programming_language: PHP
filename: load_form.php
change_type: ModificationType.MODIFY
diff: @@ -13,6 +13,11 @@
  */
 
 require_once("../../globals.php");
+require_once("../../../library/registry.inc");
+
+use OpenEMR\Common\Acl\AclMain;
+use OpenEMR\Common\Twig\TwigContainer;
+
 if (substr($_GET["formname"], 0, 3) === 'LBF') {
     // Use the List Based Forms engine for all LBFxxxxx forms.
     include_once("$incdir/forms/LBF/new.php");
@@ -25,6 +30,14 @@ if (substr($_GET["formname"], 0, 3) === 'LBF') {
     // ensure the path variable has no illegal characters
     check_file_dir_name($_GET["formname"]);
 
+    // ensure authorized to see the form
+    if (!AclMain::aclCheckForm($_GET["formname"])) {
+        $formLabel = xl_form_title(getRegistryEntryByDirectory($_GET["formname"], 'name')['name'] ?? '');
+        $formLabel = (!empty($formLabel)) ? $formLabel : $_GET["formname"];
+        echo (new TwigContainer(null, $GLOBALS['kernel']))->getTwig()->render('core/unauthorized.html.twig', ['pageTitle' => $formLabel]);
+        exit;
+    }
+
     include_once("$incdir/forms/" . $_GET["formname"] . "/new.php");
 }
 

programming_language: PHP
filename: front_payment.php
change_type: ModificationType.MODIFY
diff: @@ -23,11 +23,29 @@ require_once("$srcdir/encounter_events.inc.php");
 use OpenEMR\Billing\BillingUtilities;
 use OpenEMR\Common\Acl\AclMain;
 use OpenEMR\Common\Csrf\CsrfUtils;
+use OpenEMR\Common\Twig\TwigContainer;
 use OpenEMR\Core\Header;
 use OpenEMR\OeUI\OemrUI;
 use OpenEMR\PaymentProcessing\Sphere\SpherePayment;
 use OpenEMR\Services\FacilityService;
 
+if (!empty($_REQUEST['receipt']) && empty($_POST['form_save'])) {
+    if (!AclMain::aclCheckCore('acct', 'bill') && !AclMain::aclCheckCore('acct', 'rep_a') && !AclMain::aclCheckCore('patients', 'rx')) {
+        echo (new TwigContainer(null, $GLOBALS['kernel']))->getTwig()->render('core/unauthorized.html.twig', ['pageTitle' => xl("Receipt for Payment")]);
+        exit;
+    }
+} else {
+    if (!AclMain::aclCheckCore('acct', 'bill', '', 'write')) {
+        if (!empty($_POST['form_save'])) {
+            $pageTitle = xl("Receipt for Payment");
+        } else {
+            $pageTitle = xl("Record Payment");
+        }
+        echo (new TwigContainer(null, $GLOBALS['kernel']))->getTwig()->render('core/unauthorized.html.twig', ['pageTitle' => $pageTitle]);
+        exit;
+    }
+}
+
 $pid = (!empty($_REQUEST['hidden_patient_code']) && ($_REQUEST['hidden_patient_code'] > 0)) ? $_REQUEST['hidden_patient_code'] : $pid;
 
 $facilityService = new FacilityService();

programming_language: PHP
filename: pos_checkout_normal.php
change_type: ModificationType.MODIFY
diff: @@ -55,10 +55,16 @@ require_once("../../custom/code_types.inc.php");
 use OpenEMR\Billing\BillingUtilities;
 use OpenEMR\Common\Acl\AclMain;
 use OpenEMR\Common\Csrf\CsrfUtils;
+use OpenEMR\Common\Twig\TwigContainer;
 use OpenEMR\Core\Header;
 use OpenEMR\OeUI\OemrUI;
 use OpenEMR\Services\FacilityService;
 
+if (!AclMain::aclCheckCore('acct', 'bill', '', 'write')) {
+    echo (new TwigContainer(null, $GLOBALS['kernel']))->getTwig()->render('core/unauthorized.html.twig', ['pageTitle' => xl("Patient Checkout")]);
+    exit;
+}
+
 $facilityService = new FacilityService();
 
 $currdecimals = $GLOBALS['currency_decimals'];

programming_language: PHP
filename: demographics.php
change_type: ModificationType.MODIFY
diff: @@ -908,7 +908,7 @@ $oemr_ui = new OemrUI($arrOeUiSettings);
     $thisauth = AclMain::aclCheckCore('patients', 'demo');
 
     if (!$thisauth || !$viewEvent->authorized()) {
-        echo $twig->getTwig()->render('core/unauthorized.html.twig', ['pageTitle' => xl("Medical Dashboard")]);
+        echo $twig->getTwig()->render('core/unauthorized-partial.html.twig', ['pageTitle' => xl("Medical Dashboard")]);
         exit();
     }
     ?>

programming_language: PHP
filename: labdata.php
change_type: ModificationType.MODIFY
diff: @@ -37,9 +37,16 @@ require_once("../../globals.php");
 require_once("../../../library/options.inc.php");
 require_once($GLOBALS["srcdir"] . "/api.inc");
 
+use OpenEMR\Common\Acl\AclMain;
 use OpenEMR\Common\Csrf\CsrfUtils;
+use OpenEMR\Common\Twig\TwigContainer;
 use OpenEMR\Core\Header;
 
+if (!AclMain::aclCheckCore('patients', 'lab')) {
+    echo (new TwigContainer(null, $GLOBALS['kernel']))->getTwig()->render('core/unauthorized.html.twig', ['pageTitle' => xl("Labs")]);
+    exit;
+}
+
 // Set the path to this script
 $path_to_this_script = $rootdir . "/patient_file/summary/labdata.php";
 

programming_language: PHP
filename: record_request.php
change_type: ModificationType.MODIFY
diff: @@ -12,9 +12,16 @@
 
 require_once("../../globals.php");
 
+use OpenEMR\Common\Acl\AclMain;
 use OpenEMR\Common\Csrf\CsrfUtils;
+use OpenEMR\Common\Twig\TwigContainer;
 use OpenEMR\Core\Header;
 
+if (!AclMain::aclCheckCore('patients', 'med')) {
+    echo (new TwigContainer(null, $GLOBALS['kernel']))->getTwig()->render('core/unauthorized.html.twig', ['pageTitle' => xl("Patient Records Request")]);
+    exit;
+}
+
 ?>
 <html>
 <head>

programming_language: PHP
filename: amc_tracking.php
change_type: ModificationType.MODIFY
diff: @@ -15,9 +15,16 @@ require_once("../../library/patient.inc");
 require_once "$srcdir/options.inc.php";
 require_once "$srcdir/amc.php";
 
+use OpenEMR\Common\Acl\AclMain;
 use OpenEMR\Common\Csrf\CsrfUtils;
+use OpenEMR\Common\Twig\TwigContainer;
 use OpenEMR\Core\Header;
 
+if (!AclMain::aclCheckCore('patients', 'med')) {
+    echo (new TwigContainer(null, $GLOBALS['kernel']))->getTwig()->render('core/unauthorized.html.twig', ['pageTitle' => xl("Automated Measure Calculations (AMC) Tracking")]);
+    exit;
+}
+
 if (!empty($_POST)) {
     if (!CsrfUtils::verifyCsrfToken($_POST["csrf_token_form"])) {
         CsrfUtils::csrfNotVerified();

programming_language: PHP
filename: appt_encounter_report.php
change_type: ModificationType.MODIFY
diff: @@ -33,10 +33,16 @@ require_once("$srcdir/patient.inc");
 require_once("../../custom/code_types.inc.php");
 
 use OpenEMR\Billing\BillingUtilities;
+use OpenEMR\Common\Acl\AclMain;
 use OpenEMR\Common\Csrf\CsrfUtils;
+use OpenEMR\Common\Twig\TwigContainer;
 use OpenEMR\Core\Header;
 use OpenEMR\Services\FacilityService;
-use OpenEMR\Common\Acl\AclMain;
+
+if (!AclMain::aclCheckCore('acct', 'rep_a')) {
+    echo (new TwigContainer(null, $GLOBALS['kernel']))->getTwig()->render('core/unauthorized.html.twig', ['pageTitle' => xl("Appointments and Encounters")]);
+    exit;
+}
 
 if (!empty($_POST)) {
     if (!CsrfUtils::verifyCsrfToken($_POST["csrf_token_form"])) {
@@ -44,10 +50,6 @@ if (!empty($_POST)) {
     }
 }
 
-if (!AclMain::aclCheckCore('patients', 'appt') || !AclMain::aclCheckCore('acct', 'rep_a')) {
-    die(xlt("Unauthorized access."));
-}
-
 $facilityService = new FacilityService();
 
 $errmsg  = "";

programming_language: PHP
filename: clinical_reports.php
change_type: ModificationType.MODIFY
diff: @@ -17,9 +17,16 @@ require_once("$srcdir/options.inc.php");
 require_once("../drugs/drugs.inc.php");
 require_once("../../custom/code_types.inc.php");
 
+use OpenEMR\Common\Acl\AclMain;
 use OpenEMR\Common\Csrf\CsrfUtils;
+use OpenEMR\Common\Twig\TwigContainer;
 use OpenEMR\Core\Header;
 
+if (!AclMain::aclCheckCore('patients', 'med')) {
+    echo (new TwigContainer(null, $GLOBALS['kernel']))->getTwig()->render('core/unauthorized.html.twig', ['pageTitle' => xl("Clinical Reports")]);
+    exit;
+}
+
 if (!empty($_POST)) {
     if (!CsrfUtils::verifyCsrfToken($_POST["csrf_token_form"])) {
         CsrfUtils::csrfNotVerified();

programming_language: PHP
filename: custom_report_range.php
change_type: ModificationType.MODIFY
diff: @@ -15,11 +15,18 @@ require_once("$srcdir/forms.inc");
 require_once("$srcdir/patient.inc");
 require_once("$srcdir/report.inc");
 
+use OpenEMR\Common\Acl\AclMain;
 use OpenEMR\Billing\BillingUtilities;
 use OpenEMR\Common\Csrf\CsrfUtils;
+use OpenEMR\Common\Twig\TwigContainer;
 use OpenEMR\Core\Header;
 use OpenEMR\Services\FacilityService;
 
+if (!AclMain::aclCheckCore('encounters', 'coding_a')) {
+    echo (new TwigContainer(null, $GLOBALS['kernel']))->getTwig()->render('core/unauthorized.html.twig', ['pageTitle' => xl("Superbill")]);
+    exit;
+}
+
 if (!empty($_POST)) {
     if (!CsrfUtils::verifyCsrfToken($_POST["csrf_token_form"])) {
         CsrfUtils::csrfNotVerified();

programming_language: PHP
filename: daily_summary_report.php
change_type: ModificationType.MODIFY
diff: @@ -19,10 +19,17 @@ require_once("../globals.php");
 require_once "$srcdir/options.inc.php";
 require_once "$srcdir/appointments.inc.php";
 
+use OpenEMR\Common\Acl\AclMain;
 use OpenEMR\Common\Csrf\CsrfUtils;
+use OpenEMR\Common\Twig\TwigContainer;
 use OpenEMR\Core\Header;
 use OpenEMR\Services\FacilityService;
 
+if (!AclMain::aclCheckCore('acct', 'rep_a')) {
+    echo (new TwigContainer(null, $GLOBALS['kernel']))->getTwig()->render('core/unauthorized.html.twig', ['pageTitle' => xl("Daily Summary Report")]);
+    exit;
+}
+
 if (!empty($_POST)) {
     if (!CsrfUtils::verifyCsrfToken($_POST["csrf_token_form"])) {
         CsrfUtils::csrfNotVerified();

programming_language: PHP
filename: encounters_report.php
change_type: ModificationType.MODIFY
diff: @@ -22,10 +22,17 @@ require_once("$srcdir/forms.inc");
 require_once("$srcdir/patient.inc");
 require_once "$srcdir/options.inc.php";
 
+use OpenEMR\Common\Acl\AclMain;
 use OpenEMR\Billing\BillingUtilities;
 use OpenEMR\Common\Csrf\CsrfUtils;
+use OpenEMR\Common\Twig\TwigContainer;
 use OpenEMR\Core\Header;
 
+if (!AclMain::aclCheckCore('encounters', 'coding_a')) {
+    echo (new TwigContainer(null, $GLOBALS['kernel']))->getTwig()->render('core/unauthorized.html.twig', ['pageTitle' => xl("Encounters Report")]);
+    exit;
+}
+
 if (!empty($_POST)) {
     if (!CsrfUtils::verifyCsrfToken($_POST["csrf_token_form"])) {
         CsrfUtils::csrfNotVerified();

programming_language: PHP
filename: front_receipts_report.php
change_type: ModificationType.MODIFY
diff: @@ -16,9 +16,16 @@ require_once("../globals.php");
 require_once("$srcdir/patient.inc");
 require_once "$srcdir/options.inc.php";
 
+use OpenEMR\Common\Acl\AclMain;
 use OpenEMR\Common\Csrf\CsrfUtils;
+use OpenEMR\Common\Twig\TwigContainer;
 use OpenEMR\Core\Header;
 
+if (!AclMain::aclCheckCore('acct', 'rep_a')) {
+    echo (new TwigContainer(null, $GLOBALS['kernel']))->getTwig()->render('core/unauthorized.html.twig', ['pageTitle' => xl("Front Office Receipts")]);
+    exit;
+}
+
 if (!empty($_POST)) {
     if (!CsrfUtils::verifyCsrfToken($_POST["csrf_token_form"])) {
         CsrfUtils::csrfNotVerified();

programming_language: PHP
filename: immunization_report.php
change_type: ModificationType.MODIFY
diff: @@ -14,9 +14,16 @@
 require_once("../globals.php");
 require_once("$srcdir/patient.inc");
 
+use OpenEMR\Common\Acl\AclMain;
 use OpenEMR\Common\Csrf\CsrfUtils;
+use OpenEMR\Common\Twig\TwigContainer;
 use OpenEMR\Core\Header;
 
+if (!AclMain::aclCheckCore('patients', 'med')) {
+    echo (new TwigContainer(null, $GLOBALS['kernel']))->getTwig()->render('core/unauthorized.html.twig', ['pageTitle' => xl("Immunization Registry")]);
+    exit;
+}
+
 if (!empty($_POST)) {
     if (!CsrfUtils::verifyCsrfToken($_POST["csrf_token_form"])) {
         CsrfUtils::csrfNotVerified();

programming_language: PHP
filename: insurance_allocation_report.php
change_type: ModificationType.MODIFY
diff: @@ -15,9 +15,16 @@
 require_once("../globals.php");
 require_once("../../library/patient.inc");
 
+use OpenEMR\Common\Acl\AclMain;
 use OpenEMR\Common\Csrf\CsrfUtils;
+use OpenEMR\Common\Twig\TwigContainer;
 use OpenEMR\Core\Header;
 
+if (!AclMain::aclCheckCore('acct', 'rep_a')) {
+    echo (new TwigContainer(null, $GLOBALS['kernel']))->getTwig()->render('core/unauthorized.html.twig', ['pageTitle' => xl("Patient Insurance Distribution")]);
+    exit;
+}
+
 if (!empty($_POST)) {
     if (!CsrfUtils::verifyCsrfToken($_POST["csrf_token_form"])) {
         CsrfUtils::csrfNotVerified();

programming_language: PHP
filename: non_reported.php
change_type: ModificationType.MODIFY
diff: @@ -22,9 +22,16 @@ require_once("../globals.php");
 require_once("$srcdir/patient.inc");
 require_once("../../custom/code_types.inc.php");
 
+use OpenEMR\Common\Acl\AclMain;
 use OpenEMR\Common\Csrf\CsrfUtils;
+use OpenEMR\Common\Twig\TwigContainer;
 use OpenEMR\Core\Header;
 
+if (!AclMain::aclCheckCore('patients', 'med')) {
+    echo (new TwigContainer(null, $GLOBALS['kernel']))->getTwig()->render('core/unauthorized.html.twig', ['pageTitle' => xl("Syndromic Surveillance - Non Reported Issues")]);
+    exit;
+}
+
 if (!empty($_POST)) {
     if (!CsrfUtils::verifyCsrfToken($_POST["csrf_token_form"])) {
         CsrfUtils::csrfNotVerified();

programming_language: PHP
filename: patient_list_creation.php
change_type: ModificationType.MODIFY
diff: @@ -19,9 +19,16 @@ require_once("$srcdir/options.inc.php");
 require_once("../drugs/drugs.inc.php");
 require_once("$srcdir/payment_jav.inc.php");
 
+use OpenEMR\Common\Acl\AclMain;
 use OpenEMR\Common\Csrf\CsrfUtils;
+use OpenEMR\Common\Twig\TwigContainer;
 use OpenEMR\Core\Header;
 
+if (!AclMain::aclCheckCore('patients', 'med')) {
+    echo (new TwigContainer(null, $GLOBALS['kernel']))->getTwig()->render('core/unauthorized.html.twig', ['pageTitle' => xl("Patient List Creation")]);
+    exit;
+}
+
 if (!empty($_POST)) {
     if (!CsrfUtils::verifyCsrfToken($_POST["csrf_token_form"])) {
         CsrfUtils::csrfNotVerified();
@@ -198,18 +205,18 @@ $insurance_company = trim($_POST["insurance_companies"] ?? '');
                 $('#sortby').val('');
                 $('#sortorder').val('');
 
-                if(elem.value == 'Communication') { 
+                if(elem.value == 'Communication') {
                     $('#communication').val('');
                     $('#com_pref').show();
-                } else { 
+                } else {
                     $('#communication').val('');
                     $('#com_pref').hide();
                 }
-                
-                if(elem.value == 'Insurance Companies') { 
+
+                if(elem.value == 'Insurance Companies') {
                     $('#insurance_companies').val('');
                     $('#ins_co').show();
-                } else { 
+                } else {
                     $('#insurance_companies').val('');
                     $('#ins_co').hide();
                     }
@@ -268,10 +275,10 @@ $insurance_company = trim($_POST["insurance_companies"] ?? '');
                                 </td>
                                 <td class='col-form-label'><?php echo xlt('Option'); ?>: </td>
                                 <td class='col-form-label'>
-                                    <select class="form-control" name="srch_option" id="srch_option" 
+                                    <select class="form-control" name="srch_option" id="srch_option"
                                         onchange="srch_option_change(this)">
                                         <?php foreach ($search_options as $skey => $svalue) { ?>
-                                            <option <?php echo (!empty($_POST['srch_option']) && ($_POST['srch_option'] == $skey)) ? 'selected' : ''; ?> 
+                                            <option <?php echo (!empty($_POST['srch_option']) && ($_POST['srch_option'] == $skey)) ? 'selected' : ''; ?>
                                             value="<?php echo attr($skey); ?>"><?php echo text($svalue); ?></option>
                                         <?php } ?>
                                     </select>

programming_language: PHP
filename: prescriptions_report.php
change_type: ModificationType.MODIFY
diff: @@ -18,9 +18,16 @@ require_once("$srcdir/patient.inc");
 require_once("$srcdir/options.inc.php");
 require_once("../drugs/drugs.inc.php");
 
+use OpenEMR\Common\Acl\AclMain;
 use OpenEMR\Common\Csrf\CsrfUtils;
+use OpenEMR\Common\Twig\TwigContainer;
 use OpenEMR\Core\Header;
 
+if (!AclMain::aclCheckCore('patients', 'rx')) {
+    echo (new TwigContainer(null, $GLOBALS['kernel']))->getTwig()->render('core/unauthorized.html.twig', ['pageTitle' => xl("Prescriptions and Dispensations")]);
+    exit;
+}
+
 if (!empty($_POST)) {
     if (!CsrfUtils::verifyCsrfToken($_POST["csrf_token_form"])) {
         CsrfUtils::csrfNotVerified();

programming_language: PHP
filename: receipts_by_method_report.php
change_type: ModificationType.MODIFY
diff: @@ -28,10 +28,16 @@ require_once("../../custom/code_types.inc.php");
 
 use OpenEMR\Common\Acl\AclMain;
 use OpenEMR\Common\Csrf\CsrfUtils;
+use OpenEMR\Common\Twig\TwigContainer;
 use OpenEMR\Core\Header;
 use OpenEMR\Services\InsuranceCompanyService;
 use OpenEMR\Services\InsuranceService;
 
+if (!AclMain::aclCheckCore('acct', 'rep_a')) {
+    echo (new TwigContainer(null, $GLOBALS['kernel']))->getTwig()->render('core/unauthorized.html.twig', ['pageTitle' => xl("Receipts Summary")]);
+    exit;
+}
+
 if (!empty($_POST)) {
     if (!CsrfUtils::verifyCsrfToken($_POST["csrf_token_form"])) {
         CsrfUtils::csrfNotVerified();
@@ -228,10 +234,6 @@ function payerCmp($a, $b)
     return 0;
 }
 
-if (! AclMain::aclCheckCore('acct', 'rep')) {
-    die(xlt("Unauthorized access."));
-}
-
 $form_from_date = (isset($_POST['form_from_date'])) ? DateToYYYYMMDD($_POST['form_from_date']) : date('Y-m-d');
 $form_to_date   = (isset($_POST['form_to_date'])) ? DateToYYYYMMDD($_POST['form_to_date']) : date('Y-m-d');
 $form_use_edate = $_POST['form_use_edate'] ?? null;

programming_language: PHP
filename: referrals_report.php
change_type: ModificationType.MODIFY
diff: @@ -18,9 +18,16 @@ require_once("../globals.php");
 require_once("$srcdir/patient.inc");
 require_once "$srcdir/options.inc.php";
 
+use OpenEMR\Common\Acl\AclMain;
 use OpenEMR\Common\Csrf\CsrfUtils;
+use OpenEMR\Common\Twig\TwigContainer;
 use OpenEMR\Core\Header;
 
+if (!AclMain::aclCheckCore('patients', 'med')) {
+    echo (new TwigContainer(null, $GLOBALS['kernel']))->getTwig()->render('core/unauthorized.html.twig', ['pageTitle' => xl("Referrals")]);
+    exit;
+}
+
 if (!empty($_POST)) {
     if (!CsrfUtils::verifyCsrfToken($_POST["csrf_token_form"])) {
         CsrfUtils::csrfNotVerified();

programming_language: PHP
filename: report_results.php
change_type: ModificationType.MODIFY
diff: @@ -18,9 +18,16 @@ require_once "$srcdir/clinical_rules.php";
 require_once "$srcdir/report_database.inc";
 
 use OpenEMR\ClinicialDecisionRules\AMC\CertificationReportTypes;
+use OpenEMR\Common\Acl\AclMain;
 use OpenEMR\Common\Csrf\CsrfUtils;
+use OpenEMR\Common\Twig\TwigContainer;
 use OpenEMR\Core\Header;
 
+if (!AclMain::aclCheckCore('patients', 'med')) {
+    echo (new TwigContainer(null, $GLOBALS['kernel']))->getTwig()->render('core/unauthorized.html.twig', ['pageTitle' => xl("Report Results/History")]);
+    exit;
+}
+
 if (!empty($_POST)) {
     if (!CsrfUtils::verifyCsrfToken($_POST["csrf_token_form"])) {
         CsrfUtils::csrfNotVerified();

programming_language: PHP
filename: sales_by_item.php
change_type: ModificationType.MODIFY
diff: @@ -20,8 +20,14 @@ require_once "$srcdir/options.inc.php";
 
 use OpenEMR\Common\Acl\AclMain;
 use OpenEMR\Common\Csrf\CsrfUtils;
+use OpenEMR\Common\Twig\TwigContainer;
 use OpenEMR\Core\Header;
 
+if (!AclMain::aclCheckCore('acct', 'rep') && !AclMain::aclCheckCore('acct', 'rep_a')) {
+    echo (new TwigContainer(null, $GLOBALS['kernel']))->getTwig()->render('core/unauthorized.html.twig', ['pageTitle' => xl("Sales by Item")]);
+    exit;
+}
+
 if (!empty($_POST)) {
     if (!CsrfUtils::verifyCsrfToken($_POST["csrf_token_form"])) {
         CsrfUtils::csrfNotVerified();
@@ -29,6 +35,11 @@ if (!empty($_POST)) {
 }
 
 $form_provider  = $_POST['form_provider'] ?? null;
+if (!AclMain::aclCheckCore('acct', 'rep_a')) {
+    // only allow user to see their encounter information
+    $form_provider = $_SESSION['authUserID'];
+}
+
 if (!empty($_POST['form_refresh']) || !empty($_POST['form_csvexport'])) {
     $form_details = (!empty($_POST['form_details'])) ? true : false;
 } else {
@@ -248,10 +259,6 @@ function thisLineItem($patient_id, $encounter_id, $rowcat, $description, $transd
     $grandqty     += $qty;
 } // end function
 
-if (! AclMain::aclCheckCore('acct', 'rep')) {
-    die(xlt("Unauthorized access."));
-}
-
 $form_from_date = (isset($_POST['form_from_date'])) ? DateToYYYYMMDD($_POST['form_from_date']) : date('Y-m-d');
 $form_to_date   = (isset($_POST['form_to_date'])) ? DateToYYYYMMDD($_POST['form_to_date']) : date('Y-m-d');
 $form_facility  = $_POST['form_facility'] ?? null;

programming_language: PHP
filename: svc_code_financial_report.php
change_type: ModificationType.MODIFY
diff: @@ -26,8 +26,14 @@ require_once "$srcdir/appointments.inc.php";
 
 use OpenEMR\Common\Acl\AclMain;
 use OpenEMR\Common\Csrf\CsrfUtils;
+use OpenEMR\Common\Twig\TwigContainer;
 use OpenEMR\Core\Header;
 
+if (!AclMain::aclCheckCore('acct', 'rep_a')) {
+    echo (new TwigContainer(null, $GLOBALS['kernel']))->getTwig()->render('core/unauthorized.html.twig', ['pageTitle' => xl("Financial Summary by Service Code")]);
+    exit;
+}
+
 if (!empty($_POST)) {
     if (!CsrfUtils::verifyCsrfToken($_POST["csrf_token_form"])) {
         CsrfUtils::csrfNotVerified();
@@ -40,11 +46,6 @@ $grand_total_amt_paid  = 0;
 $grand_total_amt_adjustment  = 0;
 $grand_total_amt_balance  = 0;
 
-
-if (!AclMain::aclCheckCore('acct', 'rep')) {
-    die(xlt("Unauthorized access."));
-}
-
 $form_from_date = (isset($_POST['form_from_date'])) ? DateToYYYYMMDD($_POST['form_from_date']) : date('Y-m-d');
 $form_to_date   = (isset($_POST['form_to_date'])) ? DateToYYYYMMDD($_POST['form_to_date']) : date('Y-m-d');
 $form_facility  = $_POST['form_facility'] ?? null;

programming_language: PHP
filename: header.php
change_type: ModificationType.MODIFY
diff: @@ -8,11 +8,18 @@
  // of the License, or (at your option) any later version.
 
 
-require("../../globals.php");
-
+require_once("../../globals.php");
 require_once("ui.php");
 require_once("common.php");
 
+use OpenEMR\Common\Acl\AclMain;
+use OpenEMR\Common\Twig\TwigContainer;
+
+if (!AclMain::aclCheckCore('admin', 'super')) {
+    echo (new TwigContainer(null, $GLOBALS['kernel']))->getTwig()->render('core/unauthorized.html.twig', ['pageTitle' => xl("Rules")]);
+    exit;
+}
+
 // recursively require all .php files in the base library folder
 foreach (glob(base_dir() . "base/library/*.php") as $filename) {
     require_once($filename);

programming_language: PHP
filename: addrbook_list.php
change_type: ModificationType.MODIFY
diff: @@ -20,8 +20,14 @@ require_once("$srcdir/options.inc.php");
 
 use OpenEMR\Common\Acl\AclMain;
 use OpenEMR\Common\Csrf\CsrfUtils;
+use OpenEMR\Common\Twig\TwigContainer;
 use OpenEMR\Core\Header;
 
+if (!AclMain::aclCheckCore('admin', 'practice')) {
+    echo (new TwigContainer(null, $GLOBALS['kernel']))->getTwig()->render('core/unauthorized.html.twig', ['pageTitle' => xl("Address Book")]);
+    exit;
+}
+
 if (!empty($_POST)) {
     if (!CsrfUtils::verifyCsrfToken($_POST["csrf_token_form"])) {
         CsrfUtils::csrfNotVerified();

programming_language: PHP
filename: facilities.php
change_type: ModificationType.MODIFY
diff: @@ -16,10 +16,17 @@
 
 require_once("../globals.php");
 
+use OpenEMR\Common\Acl\AclMain;
 use OpenEMR\Common\Csrf\CsrfUtils;
+use OpenEMR\Common\Twig\TwigContainer;
 use OpenEMR\Core\Header;
 use OpenEMR\Services\FacilityService;
 
+if (!AclMain::aclCheckCore('admin', 'users')) {
+    echo (new TwigContainer(null, $GLOBALS['kernel']))->getTwig()->render('core/unauthorized.html.twig', ['pageTitle' => xl("Facilities")]);
+    exit;
+}
+
 if (!empty($_POST)) {
     if (!CsrfUtils::verifyCsrfToken($_POST["csrf_token_form"])) {
         CsrfUtils::csrfNotVerified();

programming_language: PHP
filename: dicom_frame.php
change_type: ModificationType.MODIFY
diff: @@ -18,8 +18,15 @@
 
 require_once('../interface/globals.php');
 
-use OpenEMR\Core\Header;
+use OpenEMR\Common\Acl\AclMain;
 use OpenEMR\Common\Csrf\CsrfUtils;
+use OpenEMR\Common\Twig\TwigContainer;
+use OpenEMR\Core\Header;
+
+if (!AclMain::aclCheckCore('patients', 'docs')) {
+    echo (new TwigContainer(null, $GLOBALS['kernel']))->getTwig()->render('core/unauthorized.html.twig', ['pageTitle' => xl("Dicom Viewer")]);
+    exit;
+}
 
 $web_path = $_REQUEST['web_path'] ?? null;
 if ($web_path) {

programming_language: PHP
filename: AclMain.php
change_type: ModificationType.MODIFY
diff: @@ -157,12 +157,9 @@ class AclMain
      * @param string       $value        Subcategory of ACO
      * @param string       $user         Optional user being checked for access.
      * @param string|array $return_value Type or types of access being requested.
-     * @return bool|array  FALSE if access is denied, TRUE if allowed. An
-     *                     array() of bools is returned if $return_value is an
-     *             array, representing results for each type of access
-     *             requested.
+     * @return bool  FALSE if access is denied, TRUE if allowed.
      */
-    public static function aclCheckCore($section, $value, $user = '', $return_value = '')
+    public static function aclCheckCore($section, $value, $user = '', $return_value = ''): bool
     {
         if (! $user) {
             $user = $_SESSION['authUser'];

programming_language: PHP
filename: unauthorized-partial.html.twig
change_type: ModificationType.ADD
diff: @@ -0,0 +1,7 @@
+<div class="d-flex w-100 h-75 align-items-center justify-content-center">
+    <h3>
+        {{ pageTitle|text }} {{ "Not Authorized"|xlt }}
+    </h3>
+</div>
+</body>
+</html>

programming_language: HTML
filename: unauthorized.html.twig
change_type: ModificationType.MODIFY
diff: @@ -1,7 +1,13 @@
-<div class="d-flex w-100 h-75 align-items-center justify-content-center">
-    <h3>
-        {{ pageTitle|text }} {{ "Not Authorized"|xlt }}
-    </h3>
-</div>
-</body>
+<html>
+    <head>
+        <title>{{ pageTitle|text }}</title>
+        {{ setupHeader() }}
+    </head>
+    <body>
+        <div class="d-flex w-100 h-75 align-items-center justify-content-center">
+            <h3>
+                {{ pageTitle|text }} {{ "Not Authorized"|xlt }}
+            </h3>
+        </div>
+    </body>
 </html>

programming_language: HTML