Symptom
When working in SAP CRM, you can see clearly and copy the fully-qualified URLs of different object links. In some scenarios, some of the links contain session info. If the system is not proper configured, these URLs can be used by other users to whom they have been sent to log into the sender's session.
Other terms
Visible URLs, Bookmarking full URLs, Sending URLs
Reason and Prerequisites
When HTML anchors are generated with "href='#'", browsers interpret this '#' as being used for relative referencing within the actual page, and as such replace the '#' by the full address of the page. This address is visible to the user and can copied.
Even though there are other security measures that are more appropriate to avoid session reuse, the first step taken in this note is to prevent end-users from seeing fully qualified URLs when this is not required. TML anchor <A> elements should not display any unecessary HTTP information.
This can be done by using href="javascript:void(0);"
Solution
Please implement the enhancement below.
Also, please also apply Note 1136402, as it implements similar fixes to the InputField and Checkbox tags.
When working in SAP CRM, you can see clearly and copy the fully-qualified URLs of different object links. In some scenarios, some of the links contain session info. If the system is not proper configured, these URLs can be used by other users to whom they have been sent to log into the sender's session.
Other terms
Visible URLs, Bookmarking full URLs, Sending URLs
Reason and Prerequisites
When HTML anchors are generated with "href='#'", browsers interpret this '#' as being used for relative referencing within the actual page, and as such replace the '#' by the full address of the page. This address is visible to the user and can copied.
Even though there are other security measures that are more appropriate to avoid session reuse, the first step taken in this note is to prevent end-users from seeing fully qualified URLs when this is not required. TML anchor <A> elements should not display any unecessary HTTP information.
This can be done by using href="javascript:void(0);"
Solution
Please implement the enhancement below.
Also, please also apply Note 1136402, as it implements similar fixes to the InputField and Checkbox tags.
Affected Releases
|
Correction delivered in Support Package
|
Corrections Instructions
|
No comments:
Post a Comment