Merge pull request openemr#7555 from stephenwaite/rel-702-bugs

Rel 702 bugs
sjpadgett · Jul 10, 2024 · e9f7961 · e9f7961
2 parents 2871a98 + c8a36ac
commit e9f7961
Show file tree

Hide file tree

Showing 2 changed files with 6 additions and 5 deletions.
diff --git a/interface/main/calendar/modules/PostCalendar/pnuser.php b/interface/main/calendar/modules/PostCalendar/pnuser.php
@@ -368,7 +368,7 @@ function postcalendar_user_search()
         // build our search query
         foreach ($keywords as $word) {
             if (!empty($sqlKeywords)) {
-                $sqlKeywords .= " $k_andor ";
+                $sqlKeywords .= " " . escape_identifier($k_andor, ['AND', 'OR'], true) . " ";
             }
 
             $sqlKeywords .= '(';

diff --git a/src/Gacl/GaclApi.php b/src/Gacl/GaclApi.php
@@ -799,7 +799,7 @@ function is_conflicting_acl($aco_array, $aro_array, $aro_group_ids=NULL, $axo_ar
 		//ACO
 		foreach ($aco_array as $aco_section_value => $aco_value_array) {
 			$this->debug_text("is_conflicting_acl(): ACO Section Value: $aco_section_value ACO VALUE: " . implode(',', $aco_value_array));
-			//showarray($aco_array);
+			//$this->showarray($aco_array);
 
 			if (!is_array($aco_value_array)) {
 				$this->debug_text('is_conflicting_acl(): Invalid Format for ACO Array item. Skipping...');
@@ -809,7 +809,7 @@ function is_conflicting_acl($aco_array, $aro_array, $aro_group_ids=NULL, $axo_ar
 			//Move the below line in to the LEFT JOIN above for PostgreSQL sake.
 			//'ac1' => 'ac.acl_id=a.id',
 			$where_query = array(
-				'ac2' => '(ac.section_value='. $this->db->quote($aco_section_value) .' AND ac.value IN (\''. implode ('\',\'', $aco_value_array) .'\'))'
+				'ac2' => '(ac.section_value=' . $this->db->quote($aco_section_value) . ' AND ac.value IN (\'' . implode('\',\'', array_map('add_escape_custom', $aco_value_array)) . '\'))'
 			);
 
 			//ARO
@@ -827,7 +827,8 @@ function is_conflicting_acl($aco_array, $aro_array, $aro_group_ids=NULL, $axo_ar
 
 				//Move the below line in to the LEFT JOIN above for PostgreSQL sake.
 				//$where_query['ar1'] = 'ar.acl_id=a.id';
-				$where_query['ar2'] = '(ar.section_value='. $this->db->quote($aro_section_value) .' AND ar.value IN (\''. implode ('\',\'', $aro_value_array) .'\'))';
+
+                $where_query['ar2'] = '(ar.section_value=' . $this->db->quote($aro_section_value) . ' AND ar.value IN (' . implode('\',\'', array_map('add_escape_custom', $aro_value_array)) . '\'))';
 
 				if (is_array($axo_array) AND count($axo_array) > 0) {
 					foreach ($axo_array as $axo_section_value => $axo_value_array) {
@@ -843,7 +844,7 @@ function is_conflicting_acl($aco_array, $aro_array, $aro_group_ids=NULL, $axo_ar
 
 						//$where_query['ax1'] = 'ax.acl_id=x.id';
 						$where_query['ax1'] = 'ax.acl_id=a.id';
-						$where_query['ax2'] = '(ax.section_value='. $this->db->quote($axo_section_value) .' AND ax.value IN (\''. implode ('\',\'', $axo_value_array) .'\'))';
+						$where_query['ax2'] = '(ax.section_value='. $this->db->quote($axo_section_value) .' AND ax.value IN (' . implode('\',\'', array_map('add_escape_custom', $axo_value_array)) . '\'))';
 
 						$where  = 'WHERE ' . implode(' AND ', $where_query);