[154] in SAPr3-news
Re: Security "hole" when copying ABAP's w/INCLUDEs
daemon@ATHENA.MIT.EDU (Sanjay Mazumdar)
Thu May 11 05:17:13 1995
To: sapr3-news@MIT.EDU
Date: Thu, 11 May 1995 03:21:58 GMT
From: mazumdar@netcom.com (Sanjay Mazumdar)
Michael Nelson (menelson@ix.netcom.com) wrote:
: I've just run across what seems to be a rather significant security
: issue:
When you copy an ABAP copy everything but not the includes. If you
need to modify an included file. I assume that you want to modify it
which is why you are copying it. The copy the include file separately
to a different name and just replace the included filename in the
original. Also don't usae it as a local private object. It creates
all kinds of problems later on give it a class. If necessary
just create your own class.
: Using SE38 to copy an ABAP with INCLUDES (example: SAPMF05A).
: After you've indicated the target name, you're prompted for which
: component objects you wish to copy. Select INCLUDES, then CONTINUE.
: You'll get a popup with a list of includes, giving you an opportunity
: to change the target names of all the INCLUDES. Do not change the
: target names. Next you're prompted to assign transport attributes for
: your target ABAP ... select $TMP. Result: The "parent" ABAP is copied
: correctly; however, the INCLUDES now have TADIR entries indicating SAP
^^^^^^^^^^^^^^^^^^^^^^^^
I had the same problem when I first started. Hope this helps.
This creates problems during transport.
: as the original system, YOU AS THE OWNER, and $TMP as the development
: class. So, the delivered INCLUDES of SAPMF05A can now be modified
: without having been marked for repair.
: Has anyone else run across this? Has it been resolved, how?
: Thanks.
: Mike Nelson
: menelson@ix.netcom.com
--
Sanjay Mazumdar
mazumdar@netcom.com
Disclaimer:
The views expressed are mine and mine alone.
