topic Re: S_DEVELOP - debug display authorization in Application Development and Automation Discussions

S_DEVELOP - debug display authorization

Former Member — Mon, 26 Jun 2017 08:02:41 GMT

Hi,

And old one but I still have not seen a good answer to this one so I will try again.

Can anyone please elaborate on the risk of having s_develop - debug 03 in production (or any other system for that matter)?

And please only provide concrete examples and not assumptions. Would be good to somewhat put this one to rest :).

br,

/joachim

Re: S_DEVELOP - debug display authorization

jurjen_heeck — Sun, 02 Jul 2017 14:10:35 GMT

Hi Joachim,

In systems with sensitive data this may allow for viewing raw data in the debugger, beyond the reach of the users' normal authorizations.

Data may be collected from the database by a program and checked for authorizations on a line-to-line basis before presenting it to the end user. S_DEVELOP with DEBUG and ACTVT 03 will allow you to monitor the raw data before the authorization check takes place.

Unfortunately I do not have a concrete example for you.

Jurjen

Re: S_DEVELOP - debug display authorization

Colleen — Thu, 13 Jul 2017 11:54:06 GMT

Hi Joachim

This won't give you the explicit examples that you are after but might help consider risks which seems to be system performance (resource availability); access to sensitive data in debug mode prior to authority check and potential data inconsistencies/rollback (See Julius' example).

https://archive.sap.com/discussions/thread/1342811

Unfortunately, I cannot tell you off the top of my head an example where each of those occur. I do recall debugging line by line through investment management and getting access to that data and project system information prior to the authority check (Data was selected from the table prior to the check)

Regards

Colleen

Re: S_DEVELOP - debug display authorization

sjeevan — Fri, 14 Jul 2017 22:36:04 GMT

As someone who wrote numerous ABAP custom programs, I have same thoughts as Jurjen Heeck. In most cases the raw data is pull from database using select statement first and then the authorization is checked and based on the result from authority-check, the result is displayed.

Re: S_DEVELOP - debug display authorization

Former Member — Tue, 01 Aug 2017 10:06:40 GMT

Hi Jurjen,

Very good point indeed.

/joachim