4

I got dinged in a Security Review for not checking the CRUD settings for some code that inserts a record into a Chatter Group. The Group Id is stored in a Custom Setting, but the organization could set up the group to be Private, and not add the user to the group, at which point the code would fail.

But in the response, they suggested something like this:

isCreateable = Schema.sObjectType.FeedItem.isCreateable();

But am I right in thinking that doesn't make sense for a Chatter Group? I believe I have to confirm that that the user is a member of the group, and if they are, they will be able to post to the group? Just want to be sure before I submit it again...

1
  • By "inserts a record into a Chatter Group," do you mean posts to the group feed? In other words inserts a FeedItem with the groupid as that group?
    – pchittum
    Sep 23, 2013 at 21:23

1 Answer 1

2

I think I agree with you about their suggestion; I'm not sure how that's helpful.

There are (at least) two scenarios:

  • The group is public, in which case the user (or Apex running on the user's behalf) need not be a member to post to it.
  • The group is private, in which case a quick query on CollaborationGroupMember can determine the running user's membership:

    CollaborationGroupMember[] membership = [select id 
      from CollaborationGroupMember 
      where collaborationGroupId = :myGroupId and memberid = :myUserId]; 
    
    if( membership.isEmpty() ) {
        // Not a member
    } else {
        // Member! Post as normal.
    }
    

Edit: Security may be referring to the fact that the org in question may not be Chatter-enabled, in which case I still don't think their code is helpful -- instead, what I've done previously is perform a global describe and check for the existence of CollaborationGroup.

2
  • Thanks - your post was the solution I came up with as well. The package requires Chatter...but re your edit, I think I will add in a call to check the user can create a record in FeedItem. Sep 23, 2013 at 23:24
  • Understood, and it's good that your package requires Chatter, but isn't Chatter still all-or-nothing? That is, if the org is Chatter-enabled, there is no scenario in which a given (internal) user would not be able to create a FeedItem? In other words, what (if anything) does checking create permissions on FeedItem tell us? Sep 23, 2013 at 23:27

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .