base_report_to_printer: missing security

Users are not able to print or to generate a pdf
Because it already was a XML, I didn't want to change that (and the fact that it has a noupdate section, changing that to a CSV may surprise users).

For boolean fields, I always use `eval` (or in this case I kept `eval`). This is what the docs says: 
> This will evaluate to the string 'False' and not the boolean False. This is especially tricky because Python's conversion rules consider any non-empty string to be True, so the above code will end up storing the opposite of what is desired.
If you want to evaluate the value to a float, a boolean or another type, except string, you need to use the eval attribute:

Ref: https://doc.odoo.com/trunk/server/03_module_dev_03/