By default, any report in any location (local file system, external web server etc.) can be executed on your i-net Clear Reports server. That can make things easy for your employees and customers, but it can be a security issue as well.

To solve this problem and reduce security risks, you can grant access for certain report locations only. The report locations consist of a list of folders and URL's so only reports from those trusted sources will be executed.

If this option is activated, only reports (*.rpt files) from specified sources and subfolders are accepted to execute by the report server. When this option is deactivated all reports from any location will be executed.

Note: This options also restricts access to files that are referenced in reports using the functions BytesFromFile, TextFromeFile and Image URLs.

Warning: The deactivation of the report location feature can be a security threat if you have reports not meant for public viewing, therefore it should only be deactivated in a safe area like an intranet.

• Default value: activated

With this option, all reports on file system locations can be executed. File system locations are, e.g. local hard drives, removable media or shared directories.

• Default value: activated

With this option, all reports accessed using the JNDI protocol can be executed.

• Default value: activated

With this option, all reports accessed using the Repository protocol (repo:) can be executed.

• Default value: activated

With this option, all reports on localhost locations can be executed. Localhost locations are, e.g. LOCALHOST, 127.0.0.1 and the local IP address.

• Default value: activated

This list contains sources which are allowed additionally to the locations set with previous options. All other locations are prohibited. Locations in this list are URLs to the filesystem (e.g. file:/C:/reports), to the repository (e.g. repo:/public/templates) or other external webservers (e.g. http://www.webserver.com/reports).

To add a new location, click on "Add a Report Location" and enter the URL into the input field.

Note: The source must exist and be valid, otherwise it cannot be added to the report location list. The URL must start with a protocol, meaning "www.inetsoftware.de" is not valid, but http://www.inetsoftware.de is. The same applies for paths to a folder on the filesystem, it must start with file:/.