IC67769: DUI WFC HATS CANNOT HANDLE GET REQUESTS WITH PARMS

Rational Host Access Transformation Services, Version 7.5.1.1
Rational Host Access Transformation Services, Version 7.5.1.2
Rational Host Access Transformation Services, version 7.5.1.3
Rational Host Access Transformation Services Fix Pack 4 (7.5.1.4) for 7.5.1
Rational Host Access Transformation Services Fix Pack 5 (7.5.1.5) for 7.5.1
Rational Host Access Transformation Services Fix Pack 6 (7.5.1.6) for 7.5.1

APAR status

• Closed as program error.

Error description

• The error "Variable &PARM not allowed" occurs only when you
  using
  http://localhost:9081/PMR/WFInvocation.do?inv=INV5&PARM=QINTER
  without saving userid and password first. In this case, users
  always get a prompt to ask them to type userid and password.
  If you save the userid and password in the web.xml, this
  invocation URL would work fine.
  Also, the following URL works fine.
  http://localhost:9081/PMR/WFInvocation.do?inv=INV5&PARM=QINTER&u
  serid=somebody&password=something
  

Local fix

• There are 2 work-around methods they can consider before fixing:
  
  1. Save their userid and password in the web.xml for every
  invocation.
  2. Use the clcmd invocation, such as
  http://localhost:9081/PMR/WFInvocation.do?clcmd=call%20bpmr%20pa
  rm(qinter)
  
  However, they should notice this method will expose the CL
  Command to application users.
  

Problem summary

• ****************************************************************
  * USERS AFFECTED: HATS WebFacing customers using               *
  *                 programmatic invocation with parameter       *
  *                 variables for the CL command.                *
  ****************************************************************
  * PROBLEM DESCRIPTION: The parameter variables of a CL         *
  *                      command will be missed when the HTTP    *
  *                      request passes through the logon page.  *
  ****************************************************************
  * RECOMMENDATION:                                              *
  ****************************************************************
  When using WebFacing, programmatic invocation with parameter
  variables for the CL command will cause an error after user ID
  and password are entered in the logon prompt.  For example, if
  invocation INV1 has CL command "CALL MYCMD PARM(&SBS)", a user
  would receive the error "Variable &SBS not allowed for
  parameter PARM.  Error found on CALL command."
  

Problem conclusion

• The parameter variables of a CL command will be saved in the
  HTTP session when the programmatic invocation occurs.  The
  variables should not have been cleared or overwritten after
  the logon page.
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Modules/Macros

• WEBFACIN
  

Fix information

• Fixed component name

  RATL HATS TOOLK

• Fixed component ID

  5724U6801

Applicable component levels

• R710 PSN

     UP

• R750 PSY

     UP