SAP security note 871714, “Optimising dynamic Java Script”. Below are the symptom and SAP recommended solution.
Description
Symptom
Optimising dynamic Java Script
Solution
Remove the BSP-Extension bsp:findAndReplace from the BSP View Main.htm.
Step 1. Start Transaction SE80
Step 2. BSP-Application: CRM_BSP_FRAME, Select view: Main.htm
Step 3. Remove the following 2 parts:
Part 1:
<htmlb:documentHead title="<%= gv_appl_descr %>" >
>>>Start Delete Block<<<
<%
data:
lv_find type string,
lv_replace type string.
lv_find = request->GET_FORM_FIELD( 'jsd-find' ).
lv_replace = request->get_form_field( 'jsd-replace' ).
%>
<bsp:findAndReplace find = "<%= lv_find %>" replace = "<%= lv_replace %>" >
<htmlb:documentHead title="<%= gv_appl_descr %>" >
>>>End Delete Block<<<
<htmlb:headInclude/>
Part 2:
</htmlb:documentBody> >>>Start Delete Block<<< </bsp:findAndReplace> >>>End Delete Block<<< </htmlb:document>
Full note on SAP: SAP Support Launchpad note 871714
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].
