Access to CV03N via xD03 tcode

[Former Member]

Hi,

I was recently dealing with users that were able to access documents (t-code CV03N) via tcodes for viewing customer (FD, VD, XD03). They got there clicking Extras --> Documents in the upper bar of Display Customer screen. There is object C_DRAW_TCD which is primarily checked to access CV03N (visible in SU24) so after I removed this one, the access got restricted for these users. However they are still able to get to the first screen of CV03N, which is not a problem but leaves question for me, how is it possible. I though that the concept is:

1) t-code check if it exists

2) t-code check if it´s not blocked

3) t-code check if it´s in the user authorizations (object S_TCODE and field TCD)

In the tracing I found out this:

S_TCODE    RC=0  reason=C;TCD=CV03N;type=TR;name=VD03;

When I was searching what reason C means I got into the SE97 t-code (unknown so far for me). Could someone please enlighten me how this t-code works? Do I have to add xD03 t-codes to the CV03N table (via SE97) in order to perform check nr. 3 as mentioned above?

And is there any table where I can found similar t-codes that are accessible "indirectly" via other transactions and where the S_TCODE is not needed in

user´s authorizations?

Hope my question is clear.

Thank you.

[martin_voros]

Hi,

It's all about CALL TRANSACTION statement in ABAP. It allows you to call a transaction from an ABAP program. Unfortunately, by default it does not perform standard auhtorization checks. This behavior is obsolete and now developer should explicitely say if authorization check should be performed or not. More info about statement in ABAP doco. SE97 was introduced to enforce checks. So you can add pairs calling transction and called transaction to enforce checks.

Cheers