Further Security-Relevant Information 

Active Code

Various types of active code are used in Knowledge Management (KM). This is executed on the client host in the Web browser.

Active Code	Usage	Comments
ActiveX	Used for the Local Editing function.	If your security policy rules out ActiveX, you can use a Java applet instead. For more information, see Online and Local Editing.
JavaScript	Used by the HTMLB software component (for example, for client-side check of entries and for generating popup menus).	JavaScript is used extensively in the portal.
Java	Java applets are used for Local Editing and for the XML Forms Builder application.	When launching the XML Forms Builder application and the Local Editing function, you must log on if the parameter ume.logon.httponlycookie=true is set in the User Management Engine configuration (see SAP Logon Ticket). Basic authentication is used to log on. If this parameter is set to false, the current logon ticket is used. If you use this method, there is a risk that it could be read by malicious scripts. SAP therefore recommends setting this parameter to true. If your security policy rules out Java applets, you cannot use the XML Forms Builder. The Local Editing function can also be used with ActiveX.

 

Configuration on Secure Sockets Layer (SSL)

SAP recommends that you configure Knowledge Management in a portal that is secured with SSL encryption. Otherwise, communication could be overheard.

 

Anonymous Users and Creating Documents

Users can use Knowledge Management to create documents in the portal. Examples of document creation are uploading and editing document, sending feedback, taking part in discussions, and writing reviews. Users normally create these documents using the HTML Editor. In portals that grant access to anonymous users from the internet, we recommend that you do not give these users permission to create HTML documents, as the privilege could be abused

We therefore recommend that you only give anonymous users read permission for all documents and folders. You should not give them write permission. On the flexible UI, layout sets for anonymous users cannot contain menu items for creating documents.

 

The implementation of KM and Collaboration in scenarios that involve anonymous users accessing the portal is only supported with restrictions. These restrictions are described in SAP note 709354. You should also read SAP note 837898, which explains the required settings. If you are using Release SPS 11 or earlier, read SAP Note 728106.

 

It is also possible to configure discussions, reviews, and feedback so that they can be created using a text editor instead of an HTML editor. We recommend that you make this setting. You can do this by setting a parameter in the services in question. 

For more information on setting this parameter, see Collaboration Services. Use the same procedure for comments and feedback.

You can also configure the XML Forms Builder so that no HTML can appear in the forms created and no JavaScript can be executed. For more information, see Form-Based Publishing and Project Options.

 

Deactivating Repository Services

If you later deactivate the repository services time-dependent publishing (tbp) and status management (statemngt) in the configuration of repository managers, all documents in folders of these repositories become visible for all users. If the services are active, some documents are not visible, because they have a status that restricts visibility to certain user groups or time periods.