Publisher Role
The Publisher role is a built-in role definition that includes tasks that enable users to add content to a report server. This role is predefined for your convenience. It is not used until you create role assignments that include it. This role is intended for users who author reports or models in Report Designer or Model Designer and then publish those items to a report server.
Warning
Permission to publish items to a report server should be granted only to trusted users. The Publisher role grants wide-ranging permissions that allow users to upload any type of file to a report server. If an uploaded report or HTML file contains malicious script, any user who clicks on the report or HTML document will run the script under his or her credentials. If a report is configured to use credentials supplied by report server, then all users who have Publish permissions for the report can access resources that are allowed by the server supplied credentials. The credentials can be supplied by the report server either as Stored Credential of a data source or through the Reporting Services unattended execution account. For example a user that has Publish permissions could create new datasets using an existing data source.
Report definitions can include script and other elements that are vulnerable to HTML injection attacks when the report is rendered in HTML at run time. If a published report contains malicious script, any user who runs that report will accidentally cause the script to run when the report is opened. If the user has elevated permissions, the script will run with those permissions.
To reduce the risk of users accidentally running malicious scripts, limit the number of users who have permission to publish content, and make sure that users only publish documents and reports that come from trusted sources. If you are not sure whether a report definition is safe to publish, you should open the .rdl file in a text editor and search for script tags. Malicious script can be hidden in expressions and URLs (for example, a URL in a navigation action).
Publisher Tasks
The following table lists the tasks that are included in the Publisher role.
Task |
Description |
|---|---|
Create linked reports |
Create linked reports and publish them to a report server folder. |
Manage data sources |
Create and delete shared data source items, view and modify data source properties and content. |
Manage folders |
Create, view, and delete folders; view and modify folder properties. |
Manage reports |
Add and delete reports, modify report parameters, view and modify report properties, view and modify data sources that provide content to the report, view and modify report definitions, and set security policies at the report level. |
Manage models |
Create, view, and delete report models; view and modify report model properties. |
Manage resources |
Create, modify, and delete resources; view and modify resource properties. |
Customizing the Publisher Role
You can modify the Publisher role to suit your needs. For example, you can remove the "Create linked reports" task if you do not want users to be able to create and publish linked reports, or you can add the "View folders" task so that users can navigate through the folder hierarchy when selecting a location for a new item.
At a minimum, users who publish reports from Report Designer need the "Manage reports" task to be able to add a report to the report server. If the user must publish reports that use shared data sources or external files, you should also include "Manage data sources" and "Manage resources." If the user also requires the ability to create a folder as part of the publishing process, you must also include "Manage folders."