Best-Practices/Security-Best-Practices.md
... ...
@@ -1 +1,48 @@
1
-This page is currently under construction.
... ...
\ No newline at end of file
0
+#Security Best Practices
1
+
2
+[[_TOC_]]
3
+
4
+##Page Restriction
5
+Though you can hide buttons, it is still possible for a user to access pages such as the designer by directly entering the URL. As a part of tenant and user level security, you can add the code below to intercept the URL request and navigate them to a different page.
6
+
7
+In the examples below, we are checking the URL for the Report Designer. If the user attempted to access it from a report, it will redirect them to the report viewer, otherwise, it will redirect them to the report list page.
8
+
9
+This technique can be used for other pages such as the Dashboard Designer and Settings Page.
10
+
11
+**NOTE** If you are using the MVC kit, remove ".aspx" from the page references below.
12
+
13
+### Code Sample
14
+```csharp
15
+public static void InitializeReporting() {
16
+ //Check to see if we've already initialized.
17
+ if (HttpContext.Current.Session == null || HttpContext.Current.Session["ReportingInitialized"] != null)
18
+ return;
19
+ //Initialize System
20
+ AdHocSettings.LicenseKey = "Insert License Key";
21
+ AdHocSettings.SqlServerConnectionString = @"Insert Connection String";
22
+ AdHocSettings.GenerateThumbnails = true;
23
+ AdHocSettings.DashboardViewer = "Dashboards.aspx";
24
+ AdHocSettings.ShowSimpleModeViewer = true;
25
+ AdHocSettings.IdentifiersRegex = "^.*[iI][Dd]$";
26
+ AdHocSettings.TabsCssUrl = "Resources/css/tabs.css";
27
+ AdHocSettings.ReportCssUrl = "Resources/css/Report.css";
28
+ AdHocSettings.ShowBetweenDateCalendar = true;
29
+ AdHocSettings.AdHocConfig = new CustomAdHocConfig();
30
+ AdHocSettings.PrintMode = PrintMode.Html2PdfAndHtml;
31
+ AdHocSettings.ChartingEngine = ChartingEngine.HtmlChart;
32
+ AdHocSettings.UseBulkCSV = true;
33
+
34
+ //Relevant Code Block
35
+ if(!AdHocSettings.CurrentUserIsAdmin = false) {
36
+ if (HttpContext.Current.Request.Url.ToString().Contains("ReportDesigner.aspx")) {
37
+ if (!string.IsNullOrEmpty(HttpContext.Current.Request.Params["rn"])) {
38
+ HttpContext.Current.Response.Redirect("ReportViewer.aspx?rn=" + HttpContext.Current.Request.Params["rn"]);
39
+ } else {
40
+ HttpContext.Current.Response.Redirect("ReportList.aspx");
41
+ }
42
+ }
43
+ }
44
+
45
+ HttpContext.Current.Session["ReportingInitialized"] = true;
46
+}
47
+```