SQ02 Infoset - security hole

Question

Hi,
I have heard, that SQ02 (creating Infosets) has several security holes (regarding authority). Does anybody know about it and could specify these holes?
Thanks
Markus

Answer 1

Hi
Steps on how to proceed to create a Query:
ADHOC QUERY
A query can be created to extract information from master records  i.e  Infotypes.  For example, by creating a query , the data relating to an employee contained in various Infotypes can be extracted.
Proceedure :  
Decide on  the various Infotypes we  want to make the query.  Decide on the area where we  want to query  i.e  Global area or Standard area.  Standard area is client specific and globel area will include all clients.
Menu : HR – PM – Admn -  Information System -  Adhoc Query
Select area standard and select the  user group already created
Creation of new query  :  
TC SQ03  -  Select Environment – Select Standard Area -  Enter  --  If new user group is to be created, enter name of the user group, click on create and enter necessary information and  exit after saving
TC SQ02  -  Enter name of the Infoset – Create – enter name of Infoset -  Data source -- >  Table join by basis table – give name of table e.g  pa0000 -  Enter -  Click on insert table if we  want to include more tables – give name of table one by one and after finishing,  place cursor on the joining lines and right click to delete unwanted relationships  - check  - and go back  - field groups  -  include all table fields  - click on generate button   -  go out
TC SQ03  -  Select user group  -   eg.  Payroll
Infoset  - Enter name of newly created Infoset 
Assign users and Infosets  -  Assign infosets  -  put tick on payroll  - save and go back
TC  PAAH  -  Expand the nodes and put tick on relevant fields depending upon necessity
Save the query  by giving the same name as infoset for easyness..
Use
The InfoSet Query is designed for reporting on data stored in flat tables. It is particularly useful for reporting on joins for master data and joins for ODS objects.
Prerequisites
You must take the following steps before you can create Infoset queries:
·        Set up Roles for the InfoSet Query
·        Process Classic InfoSets and Assign Roles
Procedure
Define the InfoSet Query
       1.      Call the Query Builder. There are various ways of doing this:
To call the Query Builder from the corresponding role menu or from the BEx Browser, double-click on the InfoSet Query entry in the menu that is created when you set up a role.
Developers and testers of Classic InfoSets are able to call up the Query Builder directly from the Classic InfoSet overview in the Administrator Workbench.
If several Classic InfoSets are assigned to a role, and one of them has been identified as a standard Classic InfoSet, this Classic InfoSet is used as a template when the query is called up. To change the template, choose Create New Query – Classic InfoSet Selection. Any of the Classic InfoSets that are assigned to the role can be the new template.
       2.      Define your query. The procedure is similar to the procedure for defining queries in the BEx Analyzer.
Transfer individual fields from the field groups you have selected in the Classic InfoSet into the preview. To do this, use the drag and drop function, or highlight the relevant fields in the field list.
Use either of these two methods to select any fields you want to use as filters. These fields are displayed in the Selections area of the screen (top right).
When you are preparing the query, only example data is displayed in the Preview. When you choose the Output or Refresh function, the actual results are displayed on the same screen.
       3.      Execute the query.
       4.      Choose from the following options:
Ad hoc reporting
You do not want to save the query for later. Save the Query Builder without saving.
Reusable queries
You want to save the query, because you want to work on it later, or use it as a template. Use either the Save or the Save as function to save the query.
In addition to the Classic InfoSets that you assigned to the role, you are also able to use the query as a template. It is not possible, however, to access the query from other roles.
After you save the query, a second dialog box appears, asking you if you want to save the query as a separate menu entry within the role. If you choose this option, you are able to start the query directly from the user menu or from the BEx Browser. It is also possible to use the Role Maintenance transaction (PFCG) to save this kind of role entry.
Choose Menu ® Refresh to display the query.
If you want to change or delete the saved query, use the Edit function from the context menu in the BEx Browser to call the maintenance tool for InfoSet Queries with this query as a template.
InfoSet Query on the Web
It is possible to publish each InfoSet Query on the Web. There are the following display options:
·        MiniALV for creating MiniApps in the SAP Workplace
·        MidiALV without selection options
·        MidiALV with selection options
Both the MiniALV and the MidiALV allow you to switch between various selection/layout variants. The publishing screen for the data is adjusted individually using URL parameters.
The following prerequisites are necessary for security reasons:
Releasing the query for the Web
Specifying an authorization group for the corresponding Classic InfoSet
Call up transaction RSQ02 InfoSet: Entry, and choose Go to ® Additional Functions ® Web Administration of Queries. Make the corresponding entries.
Reward all helpfull answers
Regards
Pavan