Quantcast
Channel: SCN: Message List - Security
Viewing all articles
Browse latest Browse all 5338

Re: NW74 authority check on call transaction

$
0
0

There are 2 checks in the kernel when you call a transaction -> the S_TCODE and the additional check in SE93 (table TSTCA). Sometimes this contains the S_TCODE as well (from days before the start check in the menu was there) and at other times a plausibility check as it makes no more sense to continue (it would seem).

 

CALL TRANSACTION sets sy-subrc = 0 for the transaction call on S_TCODE check. But TSTCA settings still set sy-subrc based on your authorizations.

 

The new syntax WITHOUT also bypasses this additional check. CALL TRANSACTION also commits the screens explicitly.

 

So yes, it forces the developer to show explicit intention and the checks MUST be performed beforehand.

 

Else, WITH will check S_TCODE and TSTCA etc and the calling program developer can leave the checks up to the target transaction. Eg, a list report with basic header data in ALV, with on-click navigation via CALL TRANSACTION to a document display with details and back again. But even here, you might not want to give users direct access to the target transaction, so the CALL TRANSACTION is still perfectly OK to use in several contexts.

 

Cheers,

Julius


Viewing all articles
Browse latest Browse all 5338

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>