rspec/rules/S5117/abap/rule.adoc

Every ``++AUTHORITY-CHECK++`` statement sets the fields ``++SY-SUBRC++`` (also accessible as ``++SYST-SUBRC++``) to the authorization check result. Thus ``++SY-SUBRC++`` value should be checked just after every ``++AUTHORITY-CHECK++`` statement.


== Noncompliant Code Example

[source,abap]
----
AUTHORITY-CHECK OBJECT 'S_MYOBJ' "Noncompliant
    ID 'ID1' FIELD myvalue.
----


== Compliant Solution

[source,abap]
----
AUTHORITY-CHECK OBJECT 'S_MYOBJ'  "Compliant
    ID 'ID1' FIELD myvalue.

  IF sy-subrc <> 0. 
    MESSAGE 'NOT AUTHORIZED' TYPE 'E'. 
  ENDIF. 
----


== Exceptions

No issue will be raised in the following cases:

* One or more ``++WRITE++`` operation are performed between the ``++AUTHORITY-CHECK++`` statement and ``++SY-SUBRC++`` check. An exception will be however raised if the ``++WRITE++`` operation is a ``++WRITE ... TO++`` statement, as this will set again ``++SY-SUBRC++``.
* ``++SY-SUBRC++``'s value is assigned to a variable. We then assume that it will be checked later.

----
AUTHORITY-CHECK OBJECT 'S_MYOBJ'  "Compliant
    ID 'ID1' FIELD myvalue.
WRITE 'Test' " WRITE is accepted before checking SY-SUBRC
IF SY-SUBRC <> 0. 
    EXIT.
ENDIF.

AUTHORITY-CHECK OBJECT 'S_MYOBJ'  "Compliant
    ID 'ID1' FIELD myvalue.
Tmp = SY-SUBRC " Assigning SY-SUBRC value to a variable. We assume that it will be checked later.
IF Tmp <> 0.
    EXIT.
ENDIF.
----

ifdef::env-github,rspecator-view[]

'''
== Implementation Specification
(visible only on this page)

include::message.adoc[]

include::highlighting.adoc[]

endif::env-github,rspecator-view[]