Any File format can be uploaded on the Patient ID Card

[Gicheha]

A) Your outreachy username : gicheha

B) Issue title : Patient ID card can be updated using executable files and scripts

C) Site affected: The patient site, on the documents section

D) Bug report date : March 10, 2019

E) OS/ browser used: Windows/Chrome

F) Which workflow module in LHEHR : “Documents” under “Patient”.

G) Steps to reproduce the bug : ●Select the Patient/Client menu item and select the finder option. ● Select a patient or search for one using the search fields. ● Once a patient is selected, select the summary option on the patients menu. ● On the summary screen, select the documents tab. ● Select patient information ● Select Patient ID card ● Choose the file to upload then click on the upload button

H) At point of bug, the expected behavior : Files of undesired format should be rejected and a prompt shown to advise the user on the appropriate file format.

I) Details of what actually happened : There was no prompt or alert box for the invalid information, whereas the PHP errors and warnings were displayed on the screen.

J) Provide relevant screenshots : Patient ID card file upload

k) Estimated bug Severity : The bug is critical as it is a security flaw

[muarachmann]

Yes we would not want any kind of file be uploaded imagine some freaking .bat file up there and running a cron job. U can validate by size and extensions

On Sun, Mar 10, 2019, 16:45 Gicheha [email protected] wrote:

A) Your outreachy username : gicheha

**B) Issue title : ** Patient ID card can be updated using executable files and scripts

C) Site affected: The patient site, on the documents section

D) Bug report date : March 10, 2019

E) OS/ browser used: Windows/Chrome

F) Which workflow module in LHEHR : “Documents” under “Patient”.

G) Steps to reproduce the bug : ●Select the Patient/Client menu item and select the finder option. ● Select a patient or search for one using the search fields. ● Once a patient is selected, select the summary option on the patients menu. ● On the summary screen, select the documents tab. ● Select patient information ● Select Patient ID card ● Choose the file to upload then click on the upload button

H) At point of bug, the expected behavior : Files of undesired format should be rejected and a prompt shown to advise the user on the appropriate file format.

I) Details of what actually happened : There was no prompt or alert box for the invalid information, whereas the PHP errors and warnings were displayed on the screen.

J) Provide relevant screenshots : Patient ID card file upload [image: excecutable_file] https://user-images.githubusercontent.com/9331796/54087407-a45ea480-4363-11e9-9e23-ebd2a684aeaa.PNG

k) Estimated bug Severity : The bug is critical as it is a security flaw

— You are receiving this because you are subscribed to this thread. Reply to this email directly, view it on GitHub https://github.com/LibreHealthIO/lh-ehr/issues/1428, or mute the thread https://github.com/notifications/unsubscribe-auth/APl-XlOXB8yBeJ2m5_ct2uiQCM0wq3UCks5vVSirgaJpZM4bnVa7 .

[Gicheha]

Thanks...I am on it

[Gicheha]

@muarachmann Kindly assist with the location of the affected files, I have only managed to find the PHP script for uploading the Profile photo...the file explorer page is Javascript generated making it a bit tricky to trace the files...Thanks in advance

[muarachmann]

@Gicheha what files have you found?

[Gicheha]

@muarachmann I think we are not getting each other...I mean the files containing the code that uploads the patient docs, those are the files I cannot get

[muarachmann]

@aethelwulffe could you please help here thanks

[aethelwulffe]

I will try to hunt them down. A good little project would be to gather up all the functions and put them in a monolithic feature directory under /modules. I think that this still uses the old document tree asset.

[aethelwulffe]

LibreEHR\controllers\C_Document.class.php:

[aethelwulffe]

LibreEHR\interface\patient_file\upload_dialog.php LibreEHR\library\classes\Document.class.php:

[Gicheha]

@aethelwulffe @muarachmann thanks a lot checking it out

[aethelwulffe]

I think under interface/patient_file/summary and other places, but these file names will get you everywhere you need to get to.

[GH-aditya]

I want to contribute

[muarachmann]

hI @GH-aditya we are actually porting to Laravel here https://github.com/LibreHealthIO/lh-ehr-laravel. Please go through this and ping me if you have any issues https://github.com/LibreHealthIO/lh-ehr-laravel/issues/27