Validate URL Filter
I'm embedding reports using a URL filter to only show the data that the user is supposed to see. An iFrame with a url source is easy to manipulate and therefore a vulnerability so i've been testing different combinations of bad filters and querystrings. I've found that if I pass a filter with a trailing whitespace character, or anything really that is not supposed to be in the filter, the filter is not applied and the report will show all the data. Eg. http://localhost/Reports/powerbi/MyReport?filter=tableone/column in ('a', 'b', 'c') &rs:Embed=true Is there any way of changing this behavior so that when a invalid filter is passed with the URL no data will show in the report? At the moment the only solution I can think of is to test the filter with regex. And since I'm using custom security end up returning a 403 (I don't now how to return something else, like in this case a 400 Bad Request)
PowerBI report server scale-out with NLB - bad request when open or upload PowerBI Report
I have setup 2 PowerBI Report Servers in an scale-out deployment with an NLB (https://docs.microsoft.com/en-us/sql/reporting-services/report-server/configure-a-report-server-on-a-network-load-balancing-cluster?view=sql-server-2017) When opening the load balancer URL i can login, create folders, assign permissions. But when i try to open a powerbi report or try to upload a report an error occured. In the RSPortal.log i find the following error: 2019-09-25 17:52:47.1644|ERROR|41|The remote server returned an error: (400) Bad Request.| RequestID = s_c1a68a9f-38c0-4e89-ab27-045f4ca39fbe I'm using Microsoft Power BI Report Server - May 2019. When creating a report with PowerBI Desktop for Reporting Services (also May 2019 version) and try to save that report on the report server the following error message appears: Would be glad if anyone can help. Thanks, JE
