Reporting Services and URL security

We have an SSRS server running in a SharePoint portal that has a problem with it's URL.

From the https://server/ReportServer url

you can manipulate the url to https://server/ReportServer?https%2a%sf%2fserver%2fdsrc_db.rsds&rs:Command=GetDatasourceContents

which then gives you access to the datasource files which you can view and see internal usernames and go further into downloading the ASPX code of the reports.

I'm not sure where I need to look to correct this, is it an SSRS issue, a Sharepoint issue or an IIS one.

Could someone please point me in the right direction?

Thanks,

CJ