Forum Discussion

Regular Visitor

7 years ago

Prevent end-user from uploading malicious file types

We recently performed penetration testing and found several vulnerabilities including the issue with unrestricted file upload that pose significant risk. Is there a configuration in Power BI Repo...

Jon-Heide

Microsoft Employee

7 years ago

Yes, this is whitelisted under the TrustedFileFormat property, editable through SQL Management Studio when you connect to the PBIRS instance.

Jon-Heide

Microsoft Employee

7 years ago

You can also use server permissions to disallow users from uploading content in general.

ynt
Regular Visitor
7 years ago
Jon-Heide
Jon-Heide wrote:
You can also use server permissions to disallow users from uploading content in general.

Can you please point me to this particular setting?
- Jon-Heide
  Microsoft Employee
  7 years ago
  https://docs.microsoft.com/en-us/sql/reporting-services/security/granting-permissions-on-a-native-mode-report-server?view=sql-server-2017
  - ynt
    Regular Visitor
    7 years ago
    Jon-Heide wrote:
    https://docs.microsoft.com/en-us/sql/reporting-services/security/granting-permissions-on-a-native-mode-report-server?view=sql-server-2017
    For our use case, we can't disable the upload feature. We need to be able to whitelist certain file types that can be uploaded to PBI Report Server.

Forum Discussion

Prevent end-user from uploading malicious file types

Related content

Copilot End users

Data Upload

Image upload fail

Data Upload Issue

Lakehouse End User Usage