nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

security issues while using BIRT with PHP

jaykv

I am using BIRT 2.5 in a PHP web application (back-end PostgreSQL). birt rptdesign file is put in a sub directory birt-viewer of webapps directory of Tomcat. report is called through my web application and is working fine . I used the following syntax in a php page for calling the report through the browser
"http:// <m/c name> :port/birt-viewer/frameset?__report=filename.rptdesign&my_parametername=my_parameter_value";

Report is working fine. The problem is that I can directly called the report using the above url instead of going through the application. It arises security isuues. i want the report is to be called through my application only. How can I put user credentials ? I have read that it can be done using context object of birt. Can anybody give example pl.

regards

Jayakumar K.V

Find more posts tagged with

Comments

JasonW

Take a look at a couple other threads:

http://www.eclipse.org/forums/index.php/m/261676/#msg_261676

and

http://www.eclipse.org/forums/index.php/m/239716/#msg_239716

You could forward to a jsp page that adds some key to session and then check the session in the report design.

Jason

jaykv

<blockquote class='ipsBlockquote' data-author="'JasonW'" data-cid="83913" data-time="1318271942" data-date="10 October 2011 - 11:39 AM">
Take a look at a couple other threads: 
 
<a class='bbc_url' href='http://www.eclipse.org/forums/index.php/m/261676/#msg_261676'>http://www.eclipse.org/forums/index.php/m/261676/#msg_261676</a> 
 
and 
 
<a class='bbc_url' href='http://www.eclipse.org/forums/index.php/m/239716/#msg_239716'>http://www.eclipse.org/forums/index.php/m/239716/#msg_239716</a> 
 
You could forward to a jsp page that adds some key to session and then check the session in the report design. 
 
Jason </blockquote>
 
Dear Jason, 
 
I have created a session variable- myattrib in my php page that calls the birt report viewer through tomacat. 
 
and in designer, I tried to access it through the script 
var session =reportContext.getHttpServletRequest().getSession(); 
myattrib = session.getAttribute("myattrib"); 
 
But I am not getting the method, getSession() and consequently it returns null. 
how can I get this method? is there any version problem ? I am using birt 2.5 
pl. reply 
 
thanks 
 
Jayakumar K.V

JasonW

You are probably not going to get your session variable in the designer, but it should show up when you deploy the report. Get Session should not be returning null in the designer only your attribute.

Jason

jaykv

Dear Jason, 
 
I am calling the report through browser. (mozilla). My problem is that while writing the script, 
reportContext.getHttpServletRequest() doesn't show the method getSession(). It has the following methods only: 
 
equals() 
getClass() 
hashCode() 
notify() 
notifyAll() 
toString() 
wait(long arg1) 
wait() 
wait(long arg1,int arg2) 
and, as a result the assignmentis not happening and resulting a Null. 
 
 
Why this method is not showing in the popup ? 
pl. go through the scrren shots included in the attached file 
 
regds 
jay 
 
 
<blockquote class='ipsBlockquote' data-author="'JasonW'" data-cid="83973" data-time="1318349481" data-date="11 October 2011 - 09:11 AM">
You are probably not going to get your session variable in the designer, but it should show up when you deploy the report. Get Session should not be returning null in the designer only your attribute. 
 
Jason </blockquote>

jaykv

<blockquote class='ipsBlockquote' data-author="'JasonW'" data-cid="83973" data-time="1318349481" data-date="11 October 2011 - 09:11 AM">
You are probably not going to get your session variable in the designer, but it should show up when you deploy the report. Get Session should not be returning null in the designer only your attribute. 
 
Jason </blockquote>
Dear Jason, 
 
I am calling the report through browser. (mozilla). My problem is that while writing the script, 
reportContext.getHttpServletRequest() doesn't show the method getSession(). It has the following methods only: 
 
equals() 
getClass() 
hashCode() 
notify() 
notifyAll() 
toString() 
wait(long arg1) 
wait() 
wait(long arg1,int arg2) 
and, as a result the assignmentis not happening and resulting a Null. 
 
 
Why this method is not showing in the popup ? 
pl. go through the scrren shots included in the attached file 
 
regds 
jay

JasonW

It will not show up in the code complete, but it should still access it. BTW try it in the beforeFactory event instead of the initialize.

Jason

jaykv

<blockquote class='ipsBlockquote' data-author="'JasonW'" data-cid="84042" data-time="1318440312" data-date="12 October 2011 - 10:25 AM">
It will not show up in the code complete, but it should still access it. BTW try it in the beforeFactory event instead of the initialize. 
 
Jason </blockquote>
 
Dear Jason, 
 
I could open the report through a jsp page. In jsp page I am creating session variables and I am able to get these variables in beforefactory event of BIRT. Now on checking some conditions using this variable, how can I stop the execution of the report? something like Engine.shutdown.... 
 
 
for example : if (myattribute == null) 
{ 
 
// here I want to stop the execution & to give a message 
} 
 
Pl. help 
 
regds 
 
jay

JasonW

Take a look at this thread:
http://www.eclipse.org/forums/index.php/t/163655/

You could also add a client side script in a text element that looks for a value you set at runtime and if it exists the report automatically forwards.

<script type="text/javascript">

function forward() {
var temp = new String(location.href);

location.replace("http://www.google.com");

return false;
}
if( <VALUE-OF>params["forward"].value</VALUE-OF> ){
forward();
}
</script>

Jason

jaykv

Dear Jason,

I could solve the issue through the way you suggested.
Redirected the report call from PHP to a jsp page and there I asked user credentials,
passed it as session variables. in BIRT brforeFactory event I got these session variables and
evaluated, and on unauthorised access, shows a message for login properly and disables the report.
Through this, I could stop calling report directly giving the url of birt-viewer frameset which was a security loophole.

Thanks for your valuable help.

regards

jayakumar K.V
Sr.System Analyst
National Informatics Centre(NIC)
Govt. of India

JasonW

Nicely done!

Jason