Question

How to secure XLSReport functionality

0

Hi there, my requirement is: Users should only be allowed to export data they have regular access to. Problem: By default, reports are generated in system context and all existing data is included. Any ideas that don't require maintaining intermediate data entities? regards, Fabian

asked 2022-01-05

Fabian Recktenwald

1 answers

Volker Schlecht · Answer 1 · 2022-01-05

As far as I can tell, XLSReport uses OQL behind the scenes, so having entity access monitored looks impossible.

What worked for us was using the client API to retrieve data either via XPath or an access-protected Datasource Microflow, and then rendering the Excel on the client side with ExcelJS.