Endevor TRANSFER from Archive/Unload does not have security check for Source location

Products

• Endevor

Issue/Introduction

During a TRANSFER action, the source location does not execute a security call allowing a NON-AUTHORIZED user to access that inventory location from an Unload/Archive file.

User, who has no authority to view a particular inventory in Endevor, can TRANSFER an element from that secured inventory if the data is on an ARCHIVE file without any security call.

Environment

All supported releases 

Resolution

There is no context for an Endevor Security call against the information in the archive file.  This file is just a sequential file, and if a user has access to the file outside of Endevor they could extract data from it without the use of Endevor. 

On a Transfer from Acrhive to Endevor, the security calls are on the "To" location, ensuring that the user has the proper authority to update the target location of the transfer.  

 

**Note that the archive file can be created for an instance of Endevor that is not in the same instance (C1DEFLTS) as the target of the transfer.