## 13.8.2  Data Storage Security
## Using Logical Path and File Names to Protect Access to the File System
Materials Management saves data in files in the file system. Therefore, it is important to explicitly provide access to the corresponding files in the file system without allowing access to other directories or files (also known as directory traversal). This is achieved by specifying logical paths and file names in the system that map to the physical paths and file names. This mapping is validated at runtime and if access is requested to a directory that does not match a stored mapping, then an error occurs.
The following lists show the logical file names and paths used by Materials Management and for which programs these file names and paths apply:
## Logical File Names Used
The following logical file names have been created in order to enable the validation of physical file names:
- MM\_PURCHASING\_INFORECORDS\_NEW
- Programs using this logical file name and parameters used in this context:
- RM06IBIS
- RM06IBIE
- MM\_PURCHASING\_REQUISITIONS\_NEW
- Programs using this logical file name:
- RM06BBIS
- RM06BBIE
- SAP\_SOURCING\_CUSTOMIZING\_DOWNLOAD\_FILE
- Programs using this logical file name:
- BBP\_ES\_CUST\_DOWNLOAD
## Logical Path Names Used
The logical file names MM\_PURCHASING\_INFORECORDS\_NEW and MM\_PURCHASING\_REQUISITIONS\_NEW use the logical file path MM\_PUR\_ROOT. The logical file name
SAP\_SOURCING\_CUSTOMIZING\_DOWNLOAD\_FILE uses the logical file path
SAP\_SOURCING\_CUSTOMIZING\_DOWNLOAD.
## Activating the Validation of Logical Path and File Names
These logical paths and file names are specified in the system for the corresponding programs. For downward compatibility, the validation at runtime is deactivated by default. To activate the validation at runtime, maintain the physical path using the transactions FILE (client-independent) and SF01 (client-specific). To add the aliases for the view V\_FILEALIA, use transaction SM31.
For more information, see about data storage security, see the respective chapter in the ABAP Platform Security Guide.
## Using Data Storage Security
Check whether the conditions are classified as sensitive data. You can protect conditions with the following authorization objects:
| Authorization Object   | Description                                  |
|------------------------|----------------------------------------------|
| V_KONH_EKO             | Purchasing Organization in Master Condition  |
| V_KONH_VKS             | Condition: Authorization for Condition Types |
Prices are also potential sensitive data. You can protect the display authority for prices with the value 09 of the authorization field ACTVT (Activity) of the purchasing document-specific authorization objects listed below:
| Authorization Object   | Description                                                  |
|------------------------|--------------------------------------------------------------|
| M_ANFR_BSA             | Document Type in RFQ                                         |
| M_ANFR_EKG             | Purchasing Group in RFQ                                      |
| M_ANFR_EKO             | Purchasing Organization in RFQ                               |
| M_ANGB_BSA             | Document Type in Quotation                                   |
| M_ANGB_EKG             | Purchasing Group in Quotation                                |
| M_ANGB_EKO             | Purchasing Organization in Quotation                         |
| M_BEST_BSA             | Document Type in Order                                       |
| M_BEST_EKG             | Purchasing Group in Purchase Order                           |
| M_BEST_EKO             | Purchasing Organization in Purchase Order                    |
| M_BEST_WRK             | Plant in Purchase Order                                      |
| M_BEST_LGO             | Storage Location in Purchase Order                           |
| M_LPET_BSA             | Document Type in Scheduling Agreement Delivery Schedule      |
| M_LPET_EKG             | Purchasing Group in Scheduling Agreement Delivery Sched- ule |
| M_LPET_EKO             | Purchasing Org. in Scheduling Agreement Delivery Schedule    |
| M_RAHM_BSA             | Document Type in Outline Agreement                           |
| M_RAHM_EKG             | Purchasing Group in Outline Agreement                        |
| M_RAHM_EKO             | Purchasing Organization in Outline Agreement                 |
| Authorization Object   | Description                           |
|------------------------|---------------------------------------|
| M_RAHM_WRK             | Plant in Outline Agreement            |
| M_RAHM_LGO             | Storage Location in Outline Agreement |