# Dead Files

**URL:** <https://community.open-emr.org/t/dead-files/6924>\
**Category:** OpenEMR Development\
**Created:** [December 6, 2012, 3:57am UTC](https://community.open-emr.org/t/dead-files/6924 "2012-12-06T03:57:23Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![system](https://discourse-uploads-openemr.s3.dualstack.us-east-1.amazonaws.com/original/2X/b/bb9e4e8ae2ea7faac2e952fd9e38a3ce03aac403.png) [@system](https://community.open-emr.org/u/system)\
**Post date:** [December 6, 2012, 3:57am UTC](https://community.open-emr.org/t/dead-files/6924/1 "2012-12-06T03:57:23Z")

</div>

**[julialongtin](https://sourceforge.net/u/julialongtin/)** wrote on [Thursday, December 06, 2012](https://sourceforge.net/p/openemr/discussion/202506/thread/b2e27e9c/#d956):

As part of an API cleanup surrounding the ‘Notes’ API, I have been finding ‘dead’ files in OpenEMR. these files are not reachable from the user interface, but still present information in violation of ACL checking. Its possible for users to get access to information for which they are not authorized by pasting a ‘deep URL’ into another tab of their web browser.

How should this be handled? I’m making a list (and checking it twice) here locally…

---

<div class="post-metadata">

**Author:** ![system](https://discourse-uploads-openemr.s3.dualstack.us-east-1.amazonaws.com/original/2X/b/bb9e4e8ae2ea7faac2e952fd9e38a3ce03aac403.png) [@system](https://community.open-emr.org/u/system)\
**Post date:** [December 6, 2012, 4:02am UTC](https://community.open-emr.org/t/dead-files/6924/2 "2012-12-06T04:02:26Z")

</div>

**[sunsetsystems](https://sourceforge.net/u/sunsetsystems/)** wrote on [Thursday, December 06, 2012](https://sourceforge.net/p/openemr/discussion/202506/thread/b2e27e9c/#fabf):

Hi Julia, you can post up the list here and we’ll remove them for the next release.

Rod  
[www.sunsetsystems.com](http://www.sunsetsystems.com)

---

<div class="post-metadata">

**Author:** ![system](https://discourse-uploads-openemr.s3.dualstack.us-east-1.amazonaws.com/original/2X/b/bb9e4e8ae2ea7faac2e952fd9e38a3ce03aac403.png) [@system](https://community.open-emr.org/u/system)\
**Post date:** [December 7, 2012, 4:09am UTC](https://community.open-emr.org/t/dead-files/6924/3 "2012-12-07T04:09:55Z")

</div>

**[julialongtin](https://sourceforge.net/u/julialongtin/)** wrote on [Friday, December 07, 2012](https://sourceforge.net/p/openemr/discussion/202506/thread/b2e27e9c/#2f43):

To start with, I recomend the removal of /interface/patient\_file/report/full\_report.php immediately. It doesn’t respect ACLs, is made redundant by other functionality, and isn’t reachable from the interface.

---

<div class="post-metadata">

**Author:** ![system](https://discourse-uploads-openemr.s3.dualstack.us-east-1.amazonaws.com/original/2X/b/bb9e4e8ae2ea7faac2e952fd9e38a3ce03aac403.png) [@system](https://community.open-emr.org/u/system)\
**Post date:** [December 7, 2012, 3:00pm UTC](https://community.open-emr.org/t/dead-files/6924/4 "2012-12-07T15:00:11Z")

</div>

**[yehster](https://sourceforge.net/u/yehster/)** wrote on [Friday, December 07, 2012](https://sourceforge.net/p/openemr/discussion/202506/thread/b2e27e9c/#7b8d):

The link to full\_report.php was commented out in March of 2009.&nbsp; It should be pretty safe to remove the file.

[https://github.com/yehster/openemr/commit/40f1b0c69f9ec654fef2c7fd840e2e4308f18686](https://github.com/yehster/openemr/commit/40f1b0c69f9ec654fef2c7fd840e2e4308f18686)