Adding calendar categories

OpenEMR Development
1

Version Number: v5.0.1-dev

I was trying to add calendar categories and when I checked the drop down for the calendar. None of the ones that I entered were there. Is the feature broken? I looked in the database and none of the entries made it to the database although there were no error messages on the screen.

2

whoa,

That is a weird bug. When I clicked ok to confirm the new category, it all of sudden went to the calendar display (this is not normal behavior). And also confirmed the new category was not made.

Bug confirmed.

-brady

3

Just added the following issue for this:

4

yep and I know why. but I’m keeping it a secret

5

me too (ok, I’m bluffing :smile: )

6

Kidding but have found bugs in postnuke api’s that may tie many of these issue with calendar together. First is a security fix where trying to escape a url with attr()… probably a nono. Another with depreciated functions and php7.

7

What version php? Because it’s really broke in version7…

8

My testing was on version php 7.0 . Note this works on php version 7.0 in OpenEMR 5.0.0 .
-brady

9

Looks like it’s going to be an overzealous escaping issue.

10

You know me, I usually don’t have any opinions on escaping:)

11

Just committed the fix on this. Lesson learned here is can not htmlescape paths (it breaks the & characters) like was done there. There are several more places where matrix escaped paths so will plan to revert those after analyze them a bit. Note these were real security vulnerabilities they were addressing, so they’ll likely need to attack them further upstream/downstream before the url is prepared or when it is used.
-brady

12

btw,
Here’s the commit with issues (and potentially several more issues):


-brady

13

Yep, need to escape the uri part separate from the query part…
I have some refactoring in pnMod.php and pnApi.php in postnuke for the server issue, should I wait?

14

Actually, looks like it just got double escaped :slight_smile: (single escaping a & to html should be fine, which seemed odd why it broke things):

http://one.openemr.io/openemr/interface/main/calendar/index.php?module=PostCalendar&type=admin&func=categoriesUpdate

Regarding your refactoring, definitely fine to bring in now.

-brady