bug fix a2

openemr · Apr 27, 2022 · 3c5fbbc · 3c5fbbc
1 parent d68a1e5
commit 3c5fbbc
Show file tree

Hide file tree

Showing 2 changed files with 13 additions and 1 deletion.
diff --git a/interface/reports/cdr_log.php b/interface/reports/cdr_log.php
@@ -15,9 +15,15 @@
 require_once "$srcdir/options.inc.php";
 require_once "$srcdir/clinical_rules.php";
 
+use OpenEMR\Common\Acl\AclMain;
 use OpenEMR\Common\Csrf\CsrfUtils;
 use OpenEMR\Core\Header;
 
+if (!AclMain::aclCheckCore('patients', 'med')) {
+    echo xlt('Not Authorized');
+    exit;
+}
+
 if (!empty($_POST)) {
     if (!CsrfUtils::verifyCsrfToken($_POST["csrf_token_form"])) {
         CsrfUtils::csrfNotVerified();

diff --git a/interface/reports/cqm.php b/interface/reports/cqm.php
@@ -21,10 +21,16 @@
 require_once "$srcdir/clinical_rules.php";
 require_once "$srcdir/report_database.inc";
 
+use OpenEMR\Common\Acl\AclMain;
 use OpenEMR\ClinicialDecisionRules\AMC\CertificationReportTypes;
 use OpenEMR\Common\Csrf\CsrfUtils;
-use OpenEMR\Services\PractitionerService;
 use OpenEMR\Common\Twig\TwigContainer;
+use OpenEMR\Services\PractitionerService;
+
+if (!AclMain::aclCheckCore('patients', 'med')) {
+    echo xlt('Not Authorized');
+    exit;
+}
 
 if (!empty($_POST)) {
     if (!CsrfUtils::verifyCsrfToken($_POST["csrf_token_form"])) {