Note 1525695: How to check if it is now working

[Former Member]

Recently, SAP has released a news telling that access to tcode SE37 can lead to an undesired system behavior because "Function Builder" lacks permission checks for an authenticated user's authorization to access its test functionality. We have recently implemented the said note in our Development system. However, how can I know if the note implemented is now working? Also, could someone please inform me what is meant by the statement "authenticated user's authorization"? Does this mean that when user access tcode SE37, there are additional checks on my user if it has enough authorization? I tried accessing SE37 and I expect checks (like pop up window or some message) to verify if I have enough authorization as stated above, but did not experience it.

[Former Member]

Hi Puneeth. We are the security team in this case. How can we classify who should and should not have access to the test functionality of SE37? We don't need access to this, but we need to verify if the applied note is now working and there is already permission checks in place whenever a user accesses SE37.

[AtulKumarJain]

Hi Jonlee,

You can use t-code SU53 and Su56 for authorization check .

http://help.sap.com/saphelp_nw70ehp1/Helpdata/EN/52/6716b3439b11d1896f0000e8322d00/content.htm

Please go throuh the above link.

regards,

Atul

[Former Member]

Thank you for your inputs and clarifications Puneeth. How can we now identify that our development system has now permission checks in place whenever a user accesses SE37? Could you kindly provide some steps and/or proposals on how to do this?