hi all,

just for those who might interest,....

I ve updated reports 05.01.00 vbproj to work with Visual Web Developer 2008 express and by changing 3 rows in source added support for tokens in reports

just for sure what is mentioned by 'token':

now U can make sql query like this:

select top 10 '[Tab:TabName]' as currentTab, tabID from tabs

where [Tab:TabName] is one of dnn system tokens ([User:DisplayName], [Portal:PortalName],.....

if anybody is interested I can send sources. Version is same as API remains same and no other changes in source, so anybody can replace dll only ;-)

+ I did report xsl template that can display WMS map with custom table data (structure x,y,someName), like this (jesus I cant upload image to forum uaaah!), ok if anybody interested I will post a link on some other server

Andrew,

could U please explain what exactly do U mean by sql injection?

for me tokens in reports is mandatory function.I need to create specific content of report output based on page and user where is this module attached (I will have thousands of different pages with same Report control)

this control is enabled for edit only by superuser and normal website users can only see reports. It is a part of workflow mgmt and report module shows progress and status of workflow for particular user/page/portal, etc.

Nobody can create user on my site (like user with user name 'truncate tabs' ;-) because I must use private user registration

nobody is allowed to create new tab with suspicious name....

I guess that in this case there is no SQL injection risk ?

What do you think ?

Andrew,

I am not quite sure, how you expect a sql injection based on TokenReplace. TR has been built for use by module developers to enhance their modules with flexibility. It doesn't query the database itself, it just returns the properties of currently loaded objects (current user, tab, module, site, host) with several security levels added (passwords are never retrieved. most user details are returned to the user himself or admin only etc.)