Bug in `apache2/php/curl/i2b2pmcell` ???

In the past, when accessing the i2b2 web client in the browser, some clinics see the following instead of the login view (in plaintext). Reinstalling AKTIN-i2b2 and AKTIN-DWH did NOT solve the problem.

```
tag $startPos = strpos($PostBody,"") + 14; $endPos = strpos($PostBody,"", $startPos); $proxyURL = substr($PostBody, $startPos,
($endPos - $startPos)); $newXML = $PostBody; // Do not allow DOCTYPE declarations $replace_match = '/^.*(?:!DOCTYPE).*$(?:
\r\n|\n)?/m'; if(preg_match($replace_match, $newXML)){ exit('DOCTYPE not allowed to be proxied'); } if ($pmCheckAllRequests) {
error_log("Searhing for Security in " . $PostBody); //Validate that user is valid against known PM preg_match("/(.*)?<\/security>/",
$PostBody, $proxySecurity); error_log("My Security is " . $proxySecurity[1]); preg_match("/(.*)?<\/domain>/", $proxySecurity[0],
$proxyDomain); preg_match("/(.*)?<\/username>/", $proxySecurity[0], $proxyUsername); preg_match("/(.*)?<\/password>/",
$proxySecurity[0], $proxyPassword); $checkPMXML = " 1.1 2.4 i2b2 Project Management 1.1 i2b2 Hive Project Management Cell
1.1 i2b2 Hive 2007-04-09T15:19:18.906-04:00 " . $proxyDomain[0] . $proxyUsername[0] . $proxyPassword[0] . "
0qazI4rX6SDlQlk46wqQ3 0 P I AL AL US undefined 180000 undefined "; // Process the POST for proxy redirection
error_log($checkPMXML,0 ); error_log("My proxy: " . $proxyURL, 0); } // --------------------------------------------------- // white-list
processing on the URL // --------------------------------------------------- $isAllowed = false; $requestedURL = strtoupper($proxyURL);
foreach ($WHITELIST as $entryValue) { $checkValue = strtoupper(substr($requestedURL, 0, strlen($entryValue))); if ($checkValue
== strtoupper($entryValue)) { $isAllowed = true; break; } } if (!$isAllowed) { // security as failed - exit here and don't allow one
more line of execution the opportunity to reverse this die("The proxy has refused to relay your request."); } //
--------------------------------------------------- // black-list processing on the URL // --------------------------------------------------- foreach ($BLACKLIST
as $entryValue) { $checkValue = strtoupper(substr($requestedURL, 0, strlen($entryValue))); if ($checkValue ==
strtoupper($entryValue)) { // security as failed - exit here and don't allow one more line of execution the opportunity to reverse
this die("The proxy has refused to relay your request."); } } if ($pmCheckAllRequests) { // open the URL and forward the new XML
in the POST body $proxyRequest = curl_init($pmURL); // these options are set for hyper-vigilance purposes
curl_setopt($proxyRequest, CURLOPT_COOKIESESSION, 0); curl_setopt($proxyRequest, CURLOPT_FORBID_REUSE, 1);
curl_setopt($proxyRequest, CURLOPT_FRESH_CONNECT, 0); // Specify NIC to use for outgoing connection, fixes firewall+DMZ
headaches // curl_setopt($proxyRequest, CURLOPT_INTERFACE, "XXX.XXX.XXX.XXX"); // other options curl_setopt($proxyRequest,
CURLOPT_RETURNTRANSFER, 1); curl_setopt($proxyRequest, CURLOPT_CONNECTTIMEOUT, 900); // wait 15 minutes // data to
proxy thru curl_setopt($proxyRequest, CURLOPT_POST, 1); curl_setopt($proxyRequest, CURLOPT_POSTFIELDS, $checkPMXML); //
SEND REQUEST!!! curl_setopt($proxyRequest, CURLOPT_HTTPHEADER, array('Expect:', 'Content-Type: text/xml')); $proxyResult =
curl_exec($proxyRequest); // cleanup cURL connection curl_close($proxyRequest); error_log("My PM Result " . $proxyResult);
$pattern = "//i"; //Check if request is valid if (preg_match($pattern, $proxyResult)) { error_log("Local PM denied request");
die("Local PM server could not validate the request."); } } // open the URL and forward the new XML in the POST body
$proxyRequest = curl_init($proxyURL); curl_setopt($proxyRequest, CURLOPT_SSL_VERIFYPEER, FALSE); // these options are set for
hyper-vigilance purposes curl_setopt($proxyRequest, CURLOPT_COOKIESESSION, 0); curl_setopt($proxyRequest,
CURLOPT_FORBID_REUSE, 1); curl_setopt($proxyRequest, CURLOPT_FRESH_CONNECT, 0); // Specify NIC to use for outgoing
connection, fixes firewall+DMZ headaches // curl_setopt($proxyRequest, CURLOPT_INTERFACE, "XXX.XXX.XXX.XXX"); // other
options curl_setopt($proxyRequest, CURLOPT_RETURNTRANSFER, 1); curl_setopt($proxyRequest, CURLOPT_CONNECTTIMEOUT,
900); // wait 15 minutes // data to proxy thru curl_setopt($proxyRequest, CURLOPT_POST, 1); curl_setopt($proxyRequest,
CURLOPT_POSTFIELDS, $newXML); // SEND REQUEST!!! curl_setopt($proxyRequest, CURLOPT_HTTPHEADER, array('Expect:',
'Content-Type: text/xml')); $proxyResult = curl_exec($proxyRequest); // cleanup cURL connection curl_close($proxyRequest); //
perform any analysis or processing on the returned result here header("Content-Type: text/xml", true); print($proxyResult); } ?>
```