16f6c0aecf
Inline adoc files when they are included exactly once. Also fix language tags because this inlining gives us better information on what language the code is written in.
69 lines
1.7 KiB
Plaintext
69 lines
1.7 KiB
Plaintext
== Why is this an issue?
|
|
|
|
Every ``++AUTHORITY-CHECK++`` statement sets the fields ``++SY-SUBRC++`` (also accessible as ``++SYST-SUBRC++``) to the authorization check result. Thus ``++SY-SUBRC++`` value should be checked just after every ``++AUTHORITY-CHECK++`` statement.
|
|
|
|
|
|
=== Noncompliant code example
|
|
|
|
[source,abap]
|
|
----
|
|
AUTHORITY-CHECK OBJECT 'S_MYOBJ' "Noncompliant
|
|
ID 'ID1' FIELD myvalue.
|
|
----
|
|
|
|
|
|
=== Compliant solution
|
|
|
|
[source,abap]
|
|
----
|
|
AUTHORITY-CHECK OBJECT 'S_MYOBJ' "Compliant
|
|
ID 'ID1' FIELD myvalue.
|
|
|
|
IF sy-subrc <> 0.
|
|
MESSAGE 'NOT AUTHORIZED' TYPE 'E'.
|
|
ENDIF.
|
|
----
|
|
|
|
|
|
=== Exceptions
|
|
|
|
No issue will be raised in the following cases:
|
|
|
|
* One or more ``++WRITE++`` operation are performed between the ``++AUTHORITY-CHECK++`` statement and ``++SY-SUBRC++`` check. An exception will be however raised if the ``++WRITE++`` operation is a ``++WRITE ... TO++`` statement, as this will set again ``++SY-SUBRC++``.
|
|
* ``++SY-SUBRC++``'s value is assigned to a variable. We then assume that it will be checked later.
|
|
|
|
[source,abap]
|
|
----
|
|
AUTHORITY-CHECK OBJECT 'S_MYOBJ' "Compliant
|
|
ID 'ID1' FIELD myvalue.
|
|
WRITE 'Test' " WRITE is accepted before checking SY-SUBRC
|
|
IF SY-SUBRC <> 0.
|
|
EXIT.
|
|
ENDIF.
|
|
|
|
AUTHORITY-CHECK OBJECT 'S_MYOBJ' "Compliant
|
|
ID 'ID1' FIELD myvalue.
|
|
Tmp = SY-SUBRC " Assigning SY-SUBRC value to a variable. We assume that it will be checked later.
|
|
IF Tmp <> 0.
|
|
EXIT.
|
|
ENDIF.
|
|
----
|
|
|
|
ifdef::env-github,rspecator-view[]
|
|
|
|
'''
|
|
== Implementation Specification
|
|
(visible only on this page)
|
|
|
|
=== Message
|
|
|
|
Check "SY-SUBRC" value after this "AUTHORITY-CHECK" statement.
|
|
|
|
|
|
=== Highlighting
|
|
|
|
The ``++AUTHORITY-CHECK OBJECT 'XXX'++`` statement.
|
|
|
|
|
|
endif::env-github,rspecator-view[]
|