Quantcast
Channel: SCN: Message List - Security
Viewing all articles
Browse latest Browse all 5338

Re: Determining Proper Authority Checks for Custom Transactions

$
0
0

Akshay Shah wrote:

 

S_TCODE, S_PROGRAM, S_TABU_NAM seem like the minimum

Actually none of these are good candidates for a report type of custom code.

 

  • S_TCODE will be checked by SAP in the kernel when the tcode which starts the report is executed by the user.
  • S_PROGRAM is automatically checked IF the report is assigned to a program group. But that is much the same as the tcode start authorization and is more of a pain than anything else...
  • S_TABU_NAM should only be checked if the report can browse or change customizing tables. That is unlikely, but even then you should call the API FM VIEW_AUTHORITY_CHECK and not directly check S_TABU_NAM.

 

I have a "little" tool which we built for our own developments and some customer projects. If you past your code here or tell me which application data the report is working with, then I can tell you which objects and APIs to call.

 

Cheers,

Julius


Viewing all articles
Browse latest Browse all 5338

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>