BEx Web 7.0 Display Support Information in Error Pages, SAP security note 1251121

SAP security note 1251121, "BEx Web 7.0: Display Support Information in Error Pages". Below are the symptom and SAP recommended solution.

Description

Symptom

In the BEx Web Application, when an exception occurs, a full exception page is returned to the client. This page includes the exception description, system deployment information, and other support details useful for SAP support. There is a concern that this information might be misused by unauthorized persons, and you may want to block or hide it from users.

Solution

To prevent the application from displaying support information on exception pages, follow these steps:

• Import the Correction: Import the correction (special development) included in the following patch: Download for SNOTE.
• Set Java Server Parameter: Configure the Java server parameter on all application servers to block the display of support information: com.sap.ip.bi.doNotShowStackTraceInExceptionPage=true. The full notation in the config tool is: -Dcom.sap.ip.bi.doNotShowStackTraceInExceptionPage=true. If this parameter is not set, the default behavior (displaying support information) will be applied.
• Additional Configurations: This note extends the special development described in Note 1122437, which addresses the same issue for external iViews located at pcd:portal_content/com.sap.pct/platform_add_ons/com.sap.ip.bi/iViews/com.sap.ip.bi.bex. To avoid displaying support information on the following URL: com.sap.ip.bi.web.portal.integration.launcher, you should implement this solution as well.

References

• 1272379 – Released – NW7.0 SPS 18 Patch 10 note for BI Java
• 1249907 – SAPBINEWS NW 7.01 BI JAVA SP03
• 1249886 – Released – NW7.0 SPS 17 Patch 20 note for BI Java
• 1160173 – SAPBINEWS NW 7.0 BI JAVA Support Package 19
• 1011241 – Patches for NetWeaver 2004s BI Java Support Package