Photo/ID card widget and security bug fix

tmccormi wrote on Sunday, December 26, 2010:

See: https://github.com/tmccormi/openemr/commits/photo-idcard-widget

This corrects and improves on the Patient ID Card Viewing widget, making it a true expandable widget and incorporating the ability to show thumbnails of an array for photos contained and a user named  “photos” category.  

Clicking in the thumbnail opens a full size modal for viewable file types and offers the file to the browser for others (like PDF). 

It fixes the security issue from Bug Report: 3138113, now uses the controller.php for all image access.  

Database.sql adds a default Photo category, but I did not add the to 3_2_0-to-4_0_0-upgrade.sql as people may have created their own and adding that category is easy after the fact if desired.  As a result I did not change the version.php file.

Note: this deprecates the need for interface/patient_file/summary/patient_picture.php  as that code is included as a modified function in demographics.php.  I did not remove that script as yet, however.

Will commit after some review/comments if any.
-Tony

bradymiller wrote on Sunday, December 26, 2010:

Tony,

Code looks nice overall (I haven’t tested it), but some things that should be considered:
1. The previous mechanism used the ‘Patient Photograph’ label in documents to hold the patient ID photos. If your mechanism is meant for patient photgraphs, then I’d suggest using this name, so it will work for automatically for previous users.
2. When you add a document category, also need to do it for upgraders. It’s a complicated mechanism, but will be very easy for you, because it’s already been done for the Advanced Directives; so simply mimick the code at the top of the sql upgrade script, which does this for the Advanced Directive Categories.

-brady

bradymiller wrote on Monday, December 27, 2010:

Tony,

The thing that makes this very difficult is that It’s basically not possible to add a subcategory within a current category (in the upgrade script). My suggestion is to compromise a bit on the upgrade script by not putting the Patient Photograph category in the Patient Information category. But still recommend organizing it that way in the install database; there will be no incompatibilities in your code that grabs the docs since it’s just the title of the category that matters.

So for a new install, place the Patient Photograph within the Patient Information category, and then update all the categories and categories_seq rows that are affected by this change in database.sql .

Then for the upgrade script, try something like:

#IfNotRow categories name Patient Photograph
  INSERT INTO categories select (select MAX(id) from categories) + 1, 'Patient Photograph', '', 1, rght, rght + 1 from categories where name = 'Categories';
  UPDATE categories SET rght = rght + 2 WHERE name = 'Categories';
  UPDATE categories_seq SET id = (select MAX(id) from categories);
#EndIf

Definitely test this out (as discussed in github) to ensure get the correct pattern. I’m gonna post this in the forum also in case you rebase again.

-brady

bradymiller wrote on Monday, December 27, 2010:

Tony,
Meant to paste this link earlier when discussing the Patient Photograph category:
http://sourceforge.net/projects/openemr/forums/forum/202506/topic/1798245
-brady

tmccormi wrote on Wednesday, December 29, 2010:

Fixed, enhanced and committed.
   https://sourceforge.net/tracker/index.php?func=detail&aid=3138113&group_id=60081&atid=493001

commit ede515225b2266cdaa02a7e095b0667ab78cdb55
Author: tmccormi <tony@mi-squared.com>
Date:   Wed Dec 29 00:41:33 2010 -0800

    Enhance Photo and Patient ID card handling with a widget that supports thumnails that can be clicked to show full size, u

interface/patient_file/summary/demographics.php
library/globals.inc.php
sql/3_2_0-to-4_0_0_upgrade.sql
sql/database.sql
version.php

tmccormi wrote on Wednesday, December 29, 2010:

Full Description which got truncated.

Enhance Photo and Patient ID card handling with a widget that supports thumnails that can be clicked to show full size, uses controller.php for secure access.  Adds a Patient Photograph document category