## 13.5.2.2.5  Data Storage Security
##  Note
When you exchange data between systems, there is a risk that files or file paths are accessed by unauthorized source. To prevent this directory traversal, you have to specify logical file names in the transactions SFILE or SF01 .
For more information, see File System Access Security [page 23] and SAP Note 1497003 .
For importing or exporting data between two SAP systems or an SAP system and an external system, Product Safety and Stewardship for Process Industries uses transfer files.
After generating a transfer file either by exporting data or uploading a transfer file from a PC file system, the transfer file is stored on the application server. If the export is started again or a new file is uploaded form a PC file system, the transfer file that is stored on the application server will be overwritten.
##  Note
The transfer file of imported specification data is stored in file substance.dat on the application server. The transfer file path is configured in logical path EHS\_IMP\_SUBSTANCES\_PATH\_2 .
## Using Logical Path and File Names to Protect Access
When importing or exporting data, Product Safety and Stewardship for Process Industries saves data in files in the file system. Therefore, it is important to explicitly provide access to the corresponding files in the file system without allowing access to other directories or files (also known as directory traversal). This is achieved by specifying logical paths and file names in the system that map to the physical paths and file names. This mapping is validated at runtime and if access is requested to a directory that does not match a stored mapping, then an error occurs.
The following lists show the logical file names and paths used when importing or exporting data, and for which programs these file names and paths apply:
## Logical File Names Used in Export and Import
The following logical file names have been created in order to enable the validation of physical file names:
| Logical File Names       | Programs Using these Logical File Names   |
|--------------------------|-------------------------------------------|
| EHS_EXP_PHRASES_2        | Export of Phrase Libraries                |
| EHS_EXP_ PROPERTY_TREE_2 | Export of Property Tree                   |
| EHS_EXP_SOURCES_2        | Export of Sources                         |
| EHS_EXP_SUBSTANCES_2     | Export of Specification Master Data       |
| EHS_EXP_TEMPLATE_2       | Export of Report Templates                |
| EHS_IMP_PHRASES_2        | Import of Phrase Libraries                |
| EHS_IMP_ PROPERTY_TREE_2 | Import of Property Tree                   |
| EHS_IMP_SOURCES_2        | Import of Sources                         |
| EHS_IMP_SUBSTANCES_2     | Import of Specification Master Data       |
| EHS_IMP_TEMPLATE_2       | Import of Report Templates                |
| EHS_IMP_REPORT_2         | Import of Reports                         |
| EHS_FTAPPL_2             | Uploade File; Downloade File              |
## Logical Path Names Used During Export and Import
These logical file names use the following logical file path:
| Logical File Names      | Logical Path Names           |
|-------------------------|------------------------------|
| EHS_EXP_PHRASES_2       | EHS_EXP_PHRASES_PATH_2       |
| EHS_EXP_PROPERTY_TREE_2 | EHS_EXP_PROPERTY_TREE_PATH_2 |
| EHS_EXP_SOURCES_2       | EHS_EXP_SOURCES_PATH_2       |
| EHS_EXP_SUBSTANCES_2    | EHS_EXP_SUBSTANCES_PATH_2    |
| EHS_EXP_TEMPLATE_2      | EHS_EXP_TEMPLATE_PATH_2      |
|-------------------------|------------------------------|
| EHS_FTAPPL_2            | EHS_FTAPPL_PATH_2            |
| EHS_IMP_PHRASES_2       | EHS_IMP_PHRASES_PATH_2       |
| EHS_IMP_PROPERTY_TREE_2 | EHS_IMP_PROPERTY_TREE_PATH_2 |
| EHS_IMP_REPORT_2        | EHS_IMP_REPORT_PATH_2        |
| EHS_IMP_SOURCES_2       | EHS_IMP_SOURCES_PATH_2       |
| EHS_IMP_SUBSTANCES_2    | EHS_IMP_SUBSTANCES_PATH_2    |
| EHS_IMP_TEMPLATE_2      | EHS_IMP_TEMPLATE_PATH_2      |
## Activating the Validation of Logical Path and File Names
These logical paths and file names are specified in the system for the corresponding programs. For downward compatibility, the validation at runtime is deactivated by default. To activate the validation at runtime, maintain the physical path using the transactions FILE (client-independent) and SF01 (client-specific). T o find out which paths are being used by your system, you can activate the corresponding settings in the Security Audit Log (transaction SM19 ).
Relevant audit log numbers:
- DUA - EHS-SADM: Service &amp;A on client &amp;B created
- DUB - EHS-SADM: Service &amp;A on client &amp;B started
- DUC - EHS-SADM: Service &amp;A on client &amp;B stopped
- DUD - EHS-SADM: Service &amp;A on client &amp;B stopped
- DUE - EHS-SADM: Configuration of service &amp;A on client &amp;B was changed
- DUF - EHS-SADM: File &amp;A from client &amp;B transferred
- DUG - EHS-SADM: File &amp;A transferred to client &amp;B