Every AUTHORITY-CHECK statement sets the fields SY-SUBRC (also accessible as SYST-SUBRC) to the
authorization check result. Thus SY-SUBRC value should be checked just after every AUTHORITY-CHECK statement.
Noncompliant code example
AUTHORITY-CHECK OBJECT 'S_MYOBJ' "Noncompliant
ID 'ID1' FIELD myvalue.
Compliant solution
AUTHORITY-CHECK OBJECT 'S_MYOBJ' "Compliant
ID 'ID1' FIELD myvalue.
IF sy-subrc <> 0.
MESSAGE 'NOT AUTHORIZED' TYPE 'E'.
ENDIF.
Exceptions
No issue will be raised in the following cases:
- One or more
WRITE operation are performed between the AUTHORITY-CHECK statement and SY-SUBRC check. An
exception will be however raised if the WRITE operation is a WRITE ... TO statement, as this will set again
SY-SUBRC.
-
SY-SUBRC's value is assigned to a variable. We then assume that it will be checked later.
AUTHORITY-CHECK OBJECT 'S_MYOBJ' "Compliant
ID 'ID1' FIELD myvalue.
WRITE 'Test' " WRITE is accepted before checking SY-SUBRC
IF SY-SUBRC <> 0.
EXIT.
ENDIF.
AUTHORITY-CHECK OBJECT 'S_MYOBJ' "Compliant
ID 'ID1' FIELD myvalue.
Tmp = SY-SUBRC " Assigning SY-SUBRC value to a variable. We assume that it will be checked later.
IF Tmp <> 0.
EXIT.
ENDIF.
