dc
20dbf00fb0
mpe_execute reports a child that did not complete by aborting the caller with "&program did not complete: state=&state &msg". The message was passed through %str, which masks the literal text before resolution - so the commas in a child's own abort message (mp_abort writes them as part of the reason) were still delimiters when the call was parsed. The call split into extra positional parameters and SAS raised ERROR: All positional parameters must precede keyword parameters. replacing the real failure with a parse error at the call site. The caller then lost the child's message entirely. %bquote masks the resolved value, so the message arrives as one argument and the abort reports what the child actually said. The same shape in mpe_security_postedit, where the submitted ACCESS_LEVEL value is interpolated into the abort message, is fixed the same way.
41 lines
1.4 KiB
SAS
41 lines
1.4 KiB
SAS
/**
|
|
@file
|
|
@brief Post Edit Hook script for the MPE_SECURITY table
|
|
@details Post edit hooks provide additional backend validation against
|
|
user-sourced data. The incoming dataset is always `work.staging_ds` and this
|
|
file is included from the mpe_loader.sas macro.
|
|
|
|
Available (at runtime) macro variables:
|
|
@li DC_LIBREF - The DC control library for your site
|
|
@li LIBREF - The library of the dataset being edited (is assigned)
|
|
@li DS - The dataset being edited
|
|
|
|
|
|
**/
|
|
|
|
/* ensure upcase and check access level values*/
|
|
%let errval=0;
|
|
%let errmsg=;
|
|
data work.staging_ds;
|
|
set work.staging_ds;
|
|
LIBREF=upcase(LIBREF);
|
|
if LIBREF in ('WORK','CASUSER','SASUSER') then do;
|
|
putlog "ERR" +(-1) "OR: invalid LIBREF - " LIBREF;
|
|
call symputx('errval',1);
|
|
call symputx('errmsg',"Invalid LIBREF: "!!LIBREF);
|
|
end;
|
|
DSN=upcase(DSN);
|
|
ACCESS_LEVEL=upcase(ACCESS_LEVEL);
|
|
if ACCESS_LEVEL not in ('EDIT','APPROVE','VIEW','SIGNOFF','AUDIT') then do;
|
|
putlog "ERR" +(-1) "OR: invalid ACCESS_LEVEL - " access_level;
|
|
call symputx('errval',1);
|
|
call symputx('errmsg',"Invalid ACCESS_LEVEL: "!!access_level);
|
|
end;
|
|
run;
|
|
|
|
%mp_abort(iftrue=(&errval=1)
|
|
,mac=mpe_security_postedit.sas
|
|
/* %bquote: the submitted value is interpolated into this message, and a
|
|
comma in it would split this call into extra positional parameters */
|
|
,msg=%bquote(&errmsg)
|
|
) |