wiki/Best-Practices/Security-Best-Practices.md
... ...
@@ -0,0 +1,48 @@
1
+#Security Best Practices
2
+
3
+[[_TOC_]]
4
+
5
+##Page Restriction
6
+Though you can hide buttons, it is still possible for a user to access pages such as the designer by directly entering the URL. As a part of tenant and user level security, you can add the code below to intercept the URL request and navigate them to a different page.
7
+
8
+In the examples below, we are checking the URL for the Report Designer. If the user attempted to access it from a report, it will redirect them to the report viewer, otherwise, it will redirect them to the report list page.
9
+
10
+This technique can be used for other pages such as the Dashboard Designer and Settings Page.
11
+
12
+**NOTE** If you are using the MVC kit, remove ".aspx" from the page references below.
13
+
14
+### Code Sample
15
+```csharp
16
+public static void InitializeReporting() {
17
+ //Check to see if we've already initialized.
18
+ if (HttpContext.Current.Session == null || HttpContext.Current.Session["ReportingInitialized"] != null)
19
+ return;
20
+ //Initialize System
21
+ AdHocSettings.LicenseKey = "Insert License Key";
22
+ AdHocSettings.SqlServerConnectionString = @"Insert Connection String";
23
+ AdHocSettings.GenerateThumbnails = true;
24
+ AdHocSettings.DashboardViewer = "Dashboards.aspx";
25
+ AdHocSettings.ShowSimpleModeViewer = true;
26
+ AdHocSettings.IdentifiersRegex = "^.*[iI][Dd]$";
27
+ AdHocSettings.TabsCssUrl = "Resources/css/tabs.css";
28
+ AdHocSettings.ReportCssUrl = "Resources/css/Report.css";
29
+ AdHocSettings.ShowBetweenDateCalendar = true;
30
+ AdHocSettings.AdHocConfig = new CustomAdHocConfig();
31
+ AdHocSettings.PrintMode = PrintMode.Html2PdfAndHtml;
32
+ AdHocSettings.ChartingEngine = ChartingEngine.HtmlChart;
33
+ AdHocSettings.UseBulkCSV = true;
34
+
35
+ //Relevant Code Block
36
+ if(!AdHocSettings.CurrentUserIsAdmin = false) {
37
+ if (HttpContext.Current.Request.Url.ToString().Contains("ReportDesigner.aspx")) {
38
+ if (!string.IsNullOrEmpty(HttpContext.Current.Request.Params["rn"])) {
39
+ HttpContext.Current.Response.Redirect("ReportViewer.aspx?rn=" + HttpContext.Current.Request.Params["rn"]);
40
+ } else {
41
+ HttpContext.Current.Response.Redirect("ReportList.aspx");
42
+ }
43
+ }
44
+ }
45
+
46
+ HttpContext.Current.Session["ReportingInitialized"] = true;
47
+}
48
+```
... ...
\ No newline at end of file