Add permit_subreports config option

Author: manisandro

schemas/qwc-document-service.json

@@ -32,6 +32,11 @@
           "type": "string",
           "default": "/reports"
         },
+        "permit_subreports": {
+          "description": "Whether to automatically permit subreports included from a permitted parent report",
+          "type": "boolean",
+          "default": false
+        },
         "max_memory": {
           "description": "Maximum Java heap size for compiling like 1024M or 2G.",
           "type": "string",

src/report_compiler.py

@@ -260,7 +260,7 @@ def compile_report(self, report_filename, fill_params, tmpdir, resources, permit
             self.logger.info("Subreport filename %s" % subreport_filename)
             self.logger.info("Subreport template %s" % subreport_template)
             if os.path.exists(subreport_filename):
-                if subreport_template in permitted_resources:
+                if self.permit_subreports or subreport_template in permitted_resources:
                     subreport_result = self.compile_report(subreport_filename, fill_params, tmpdir, resources, permitted_resources, single_report, True)
                     if not subreport_result:
                         self.logger.info("Failed to compile subreport %s" % subreport_filename)
@@ -274,7 +274,7 @@ def compile_report(self, report_filename, fill_params, tmpdir, resources, permit
                             if m:
                                 fill_params[m.group(1)] = self.resolve_datasource(subreport_datasource, subreport_filename, opened_connections)
                 else:
-                    self.logger.info("Filtering out unpermitted report %s" % subreport_filename)
+                    self.logger.info("Filtering out unpermitted subreport %s" % subreport_filename)
                     subreportExpression.text = ""
 
         # Write modified jrxml
@@ -377,6 +377,7 @@ def get_document(self, config, permitted_resources, tenant, template, fill_param
         resources = (config.resources() or {}).get('document_templates', [])
 
         self.report_dir = config.get('report_dir', '/reports').rstrip('/')
+        self.permit_subreports = config.get('permit_subreports', False)
         self.logger.info("Report dir is '%s'", self.report_dir)
 
         if template not in permitted_resources: