Replace dynamic code execution with dynamic import in reports (senaite#2078)

* Replace dynamic code execution with dynamic import in reports

* Use importlib instead of __import__

* Add changelog entry

* Add missing line break in senaitesetup.py

Author: winniehell

CHANGES.rst

@@ -5,6 +5,7 @@ Changelog
 2.3.0 (unreleased)
 ------------------
 
+- #2078 Replace dynamic code execution with dynamic import in reports
 - #2083 Lookup workflow action redirect URL from request first
 - #2082 Include sample ID in form ID for lab, field and qc analyses listings
 - #2075 Allow to override logo and styles in new SENAITE Setup

src/bika/lims/browser/reports/__init__.py

@@ -18,6 +18,7 @@
 # Copyright 2018-2021 by it's authors.
 # Some rights reserved, see README and LICENSE.
 
+import importlib
 import os
 
 from bika.lims import bikaMessageFactory as _
@@ -257,11 +258,11 @@ def __call__(self):
         else:
             module = "bika.lims.browser.reports.%s" % report_id
         try:
-            exec ("from %s import Report" % module)
+            Report = getattr(importlib.import_module(module), "Report")
             # required during error redirect: the report must have a copy of
             # additional_reports, because it is used as a surrogate view.
             Report.additional_reports = self.additional_reports
-        except ImportError:
+        except (ImportError, AttributeError):
             message = "Report %s.Report not found (shouldn't happen)" % module
             self.logger.error(message)
             self.context.plone_utils.addPortalMessage(message, 'error')

src/senaite/core/content/senaitesetup.py

@@ -171,4 +171,5 @@ def setSiteLogoCSS(self, value):
         """Set the site logo
         """
         mutator = self.mutator("site_logo_css")
-        return mutator(self, value)
+        return mutator(self, value)
+