Security issuer - January May 2019 - Disable Comments

[Anonymous]

Hello Community, 

Due to a vulnerability detected in January 2019 version , I n eed to disable comments on the server or at lease deny the buttin "Attach file"

Is it possible to configure this?

Best Regards

Asma

[krisztb]

Hi Asma,

By default commenting is permitted for each security role, but it can be disabled for each role separately using Management Studio: https://docs.microsoft.com/en-us/sql/reporting-services/security/role-definitions-create-delete-or-m...

To disable comments simply uncheck "Comment on reports" box.

With the May 2019 version, you can also use configure what files types are allowed for attachments and what mime types are forbidden: https://docs.microsoft.com/en-us/sql/reporting-services/tools/server-properties-advanced-page-report...

Look for AllowedResourceExtensionsForUpload and RestrictedResourceMimeTypeForUpload properties.

[Anonymous]

Hello,

I'm looking for hours on Report Server how to do this but I can't find anything, could you give me a hint please ?