Quantcast
Channel: SCN: Message List - Security
Viewing all articles
Browse latest Browse all 5338

Re: P_ABAP not skipping the authorization check

$
0
0

Hi,

 

The P_ABAP object works with programs, in the transaction you mention, the program getting the final result is not the same as the one behing the transaction for the AdHoc query... The programs for the queries are generated because the user has to make selection for input and output.

 

So from there you cannot use this simplifcation object. But if the users starts already saved queries (and not infoset), then you could find and use that specific report.

 

I tried and traced myself:

AUTH        P_ABAP RC=0  REPID=!QZZ/SAPQUERY/H0MUYLAE08141045;COARS=2;type=TR;name=S_PH0_48000509;
AUTH        P_ABAP RC=0  REPID=SAPDBPNP;COARS=2;type=TR;name=S_PH0_48000509;

 

 

The name of the report is generated and always starts with something like AQZZ* or !QZZ*

But this is because they work from the Infoset.

 

If you start from the SQ01 and the queries:

AUTH        P_ABAP RC=0  REPID=AQZZ/SAPQUERY/H0CM_02========= ;COARS=2;type=TR;name=SQ01;
AUTH        P_ABAP RC=0  REPID=SAPDBPNP;COARS=2;type=TR;name=SQ01;

 

There the name of the query is fixed because the structure of the selection, the fileds  are already defined and fixed. You only choose the values to be processed.

The name is no more generic but always the same AQZZ/SAPQUERY/H0CM_02 for:

AQZZ  this is for a query from infoset /SAPQUERY/H0 on query CM_02

 

 

The second line on the trace, is very dangerous to use because this would skip all HR controls in PNP programs, meaning almost all HR programs... So I do not recommand that option.

 

Best regards,

Jonathan


Viewing all articles
Browse latest Browse all 5338

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>