fix: bug (openemr#7435)

* fix: bug * else die
sjpadgett · May 21, 2024 · fbfa180 · fbfa180
1 parent 31fdc36
commit fbfa180
Showing 1 changed file with 6 additions and 2 deletions.
diff --git a/interface/main/messages/messages.php b/interface/main/messages/messages.php
@@ -300,8 +300,12 @@
                             $datetime = isset($_POST['form_datetime']) ? DateTimeToYYYYMMDDHHMMSS($_POST['form_datetime']) : '';
                             foreach ($assigned_to_list as $assigned_to) {
                                 if ($noteid && $assigned_to != '-patient-') {
-                                    updatePnote($noteid, $note, $form_note_type, $assigned_to, $form_message_status, $datetime);
-                                    $noteid = '';
+                                    if (checkPnotesNoteId($note_id, $_SESSION['authUser'])) {
+                                        updatePnote($noteid, $note, $form_note_type, $assigned_to, $form_message_status, $datetime);
+                                        $noteid = '';
+                                    } else {
+                                        die("Message is not assigned to you. Adding is disallowed.");
+                                    }
                                 } else {
                                     if ($noteid && $assigned_to == '-patient-') {
                                         // When $assigned_to == '-patient-' we don't update the current note, but