The recall of the B2C application does not work, SAP security note 1501922

SAP security note 1501922, "The recall of the B2C application does not work", is a program error note released on 06.05.2011. Below are the symptom, SAP recommended solution and the affected software components.

Description

Symptom

If you configure the Java application server with the SessionIDRegeneration settings or follow the Web application configurations as per Note 1503236 and use the back function or the Web site favorites function of the B2C application, session problems may occur.

Solution

The correction is included in the standard system starting from CRM Release 7.01 Support Package 2. This note provides Java corrections for E-Commerce and CRM Web Channel.

Software Components:

• SAP-SHRJAV
• SAP-SHRWEB

Development Components:

• crm/isa/isacore
• crm/tc/web/core
• crm/isa/web/b2c

Changed Files:

• SalesDocumentDB.java
• RequestProcessor.java
• isa-xcmadmin-config.xml
• config-data.xml

Apply the specified Support Package patch level detailed in this note.

Reason and prerequisites

A program error exists that affects session handling in the B2C application.

References

• 1503236 – Application configuration due to J2EE security settings
• 1501919 – Start.jsp enhancements
• 1492234 – No SessionIDRegeneration in CRM Web Channel B2C/B2B Scenario
• 1310561 – SAP J2EE Engine Session Fixation Protection

Affected components

• SAP-CRMJAV: 5.0, 5.2, 6.0, 700
• SAP-CRMWEB: 5.0, 5.2, 6.0, 700
• SAP-SHRWEB: 5.0, 5.2, 6.0, 700
• SAP-SHRJAV: 5.0, 5.2, 6.0, 700
• SAP-CRMAPP: 5.0, 5.2, 6.0, 700
• SAP-SHRAPP: 5.0, 5.2, 6.0, 700