Risk
Scripts can automate unwanted actions in the user’s security context.
ABAP
Settings and priorities
| Technology / priority | Parameter or mechanism | Setting and purpose |
|---|---|---|
| ABAP Extended | sapgui/user_scripting ; sapgui/nwbc_scripting | FALSE Disable scripting by default. |
| ABAP Extended | sapgui/user_scripting_per_user | TRUE when scripting is permitted Grant S_SCR with ACTVT=16 only to users who need it. |
| ABAP Extended | sapgui/user_scripting_disable_recording | TRUE Playback may remain possible while recording is blocked. |
| ABAP Extended | sapgui/user_scripting_set_readonly | TRUE after reviewing setting interactions Restricts scripts to read-only interface elements. |
| ABAP Extended | sapgui/user_scripting_force_notification | TRUE Forces a frontend notification. |
How to verify
- Confirm whether scripting is required for business operations.
- For an exception, restrict users through S_SCR.
- Test readonly behavior together with per_user.
- Verify frontend notifications.