Extended security enhancements in the application isauseradm, SAP security note 1244194

SAP security note 1244194, "Extended Security Enhancements in ISA User Administration", is a note released on October 8, 2009. Below are the symptom and SAP recommended solution.

Description

Symptom

Several additional security enhancements and fixes have been implemented, addressing:

• Security checks for functionalities restricted to the role SAP_ISA_UADM_MANAGER
• Prevention of possible brute force attacks
• Mitigation of Cross-Site Request Forgery (XSRF) attacks

Solution

This security note is applicable to SAP CRM WebChannel and SAP E-Commerce (for SAP ERP).

To implement the new security measures, you need to add the following tags in the respective files:

• SC SAP-SHRWEB
• DC crm/tc/web/appbase
• File: src/packages/WEB-INF/classes/crm~tc~appbase~resources.xlf

Tags to add:

• um.error.sec.partassign = "You are not authorized to assign a user to partner {0}"
• um.error.sec.editusr = "You are not authorized to edit/copy user {0}"
• um.error.sec.unlock = "You are not authorized to unlock the user {0}"
• um.error.sec.lock = "You are not authorized to lock the user {0}"
• um.error.sec.del = "You are not authorized to delete the user {0}"
• um.error.sec.pwreset = "You are not authorized to reset the password of the user {0}"
• um.error.sec.disp = "You are not authorized to display user {0}"
• msg.error.invalidtoken = "The token from your last request was invalid. It is possible that this request has been executed by an unauthorized person. Please check your computer for hacked software."

This document causes side effects with SAP Note 1334897 – Runtime error occurs when changing default address in ISA.

References

• SAP Note 646140 – Security Check of Internet Sales