topic Security issuer - January May 2019 - Disable Comments in Report Server

Security issuer - January May 2019 - Disable Comments

Anonymous — Tue, 28 May 2019 14:21:29 GMT

Hello Community,

Due to a vulnerability detected in January 2019 version , I n eed to disable comments on the server or at lease deny the buttin "Attach file"

Is it possible to configure this?

Best Regards

Asma

krisztb — Tue, 28 May 2019 19:17:02 GMT

Hi Asma,

By default commenting is permitted for each security role, but it can be disabled for each role separately using Management Studio: https://docs.microsoft.com/en-us/sql/reporting-services/security/role-definitions-create-delete-or-modify

To disable comments simply uncheck "Comment on reports" box.

With the May 2019 version, you can also use configure what files types are allowed for attachments and what mime types are forbidden: https://docs.microsoft.com/en-us/sql/reporting-services/tools/server-properties-advanced-page-reporting-services

Look for AllowedResourceExtensionsForUpload and RestrictedResourceMimeTypeForUpload properties.

Anonymous — Thu, 17 Sep 2020 13:47:47 GMT

Hello,

I'm looking for hours on Report Server how to do this but I can't find anything, could you give me a hint please ?