Topics created by deathgaze

hi!

However, I'm not sure if I applied the directions correctly, or if the key names are correct. I am declaring my config and passing it in as follows. However, I'm not sure if "tasks" as listed in the article should be "scripts" in mine".

you just need to update some properties names in configuration regarding to what is mentioned in the article. about the tasks property, then you should add to values in templatingEngines if you want to increase limits for template rendering + helpers execution, or you should add those values in extensions.scripts if you want to increase limits about jsreport scripts execution.

or what the meaning of "dedicated-process" might be in contrast with "http-server"

the only difference is that with http-server strategy there is pool of workers that will be reused for template rendering and scripts execution tasks. with dedicated-process it means that each of these tasks will be done creating a new child process for each of them.

I think this config is wrong. can anyone help me out?

this is an updated configuration:

{ httpPort: process.env.PORT || 5488, allowLocalFilesAccess: true, templatingEngines: { timeout: 600000, strategy: 'http-server', forkOptions: { execArgv: ['--max-old-space-size=4096'], } }, extensions: { scripts: { timeout: 600000 }, express: { renderTimeout: 600000, } }, store: { provider: 'fs', }, blobStorage: { provider: 'fs', }, chrome: { timeout: 600000, }, phantom: { timeout: 600000, } }

Hi,

I want to create a Dockerfile for launching jsreport as a package in my Node.js package. Currently, it is throwing errors like not able to launch the chrome browser.
Please provide a quick help. I am having jsrepot.config.json file in the project. index.js as the starting file. script to build the application is node index.js

Thanks

hi! jsreport is a dev tool, so it is not practical to put a lot of efforts into disabling every feature just for security reasons, instead the security is handled in your application. you should treat jsreport just like some other dev technology like docker. so in other words you should not expose full features of such dev tool to end users, instead you create a proxy in front (your own app) with just some basic and safe options to send. for example all users of your app should use your app directly to generate reports not jsreport directly, so you can control how many features of jsreport your end users can use in the end, with that in mind is very easy to control that your users should not be able to send scripts, that control should exists in your app depending on how much permissive you want to be.

about the http api/OData api is easy too, just make jsreport a local service, not exposed to the public, so you should not be able to connect to it using some public ip, if you need communication between your app and jsreport just use a VPN or a point to a local ip and port in case jsreport in hosted in the same server.

as you can see the security topics are just the same that you would do with any other dev tool that you want to expose to end users.

hi! i made some comments here why using --inspect in this way will not work for jsreport, in the link you will find two solutions if you want to debug jsreport process. these days i just use ndb which handles the debugging workflow smoothly no matter if there is just single process or multiple processes in app. just FYI, in case it helps you.