Salesforce user security is an intersection of sharing, user, Profiles, roles, roles hierarchy and object permissions.

learn more… | top users | synonyms

1
vote
1answer
17 views

user gets insufficient privileges

I cloned the standard user profile and took away rights to a lot of objects. However I left a few of the standard objects like contacts and accounts. When I give this profile to a user they get '...
2
votes
1answer
39 views

Most optimal way to Enforce CRUD/FLS in Apex

This article shows a common way to check access in Apex with a syntax like: if (!Schema.sObjectType.Contact.fields.Name.isAccessible()){ return ''; } However, it is very time/space-consuming to ...
2
votes
2answers
203 views

TLS version and HTTP supported in production

We have not activated the update 'TLS1.1 for HTTPS' in our production org. So which version of TLS are right now supported by it? I mean does it support only TLS1.0 or it would support TLS 1.1? And ...
0
votes
0answers
25 views

Make the Account object read-only [on hold]

I'm trying to set Account to read-only for a particular Profile. The solution would seem simple enough: go into the Profile object permissions for Account, and uncheck all the boxes except 'Read.' I ...
0
votes
0answers
8 views

Inserting a custom object with an auto number field using the ESAPI library

We are using Force.com ESAPI to secure our DML operations and we cannot insert new records of a custom object that has an auto-incrementing auto number because that field is read-only and ESAPI ...
6
votes
2answers
162 views

Newbie Q: Is “Field Level Security” the same as “Field Accessibility”?

There are two buttons that seem very similar when viewing the detial page for an object: Set Field Level Security and View Field Accessibility. They both seem to allow you to set the field level ...
0
votes
1answer
22 views

relationship between readable, visible and read only'

In a profile I can see: <fieldPermissions> <editable>true</editable> <field>Time_Log__c.Date__c</field> <readable>true</readable> </...
0
votes
1answer
25 views

Control and/or monitor who does data exports from salesforce

besides our Sales department doesn't have the Export Report option they can still ctrl+C -> ctrl+V into an excel sheet if they wanted to take some information for other companies or whatever. I ...
0
votes
1answer
24 views

“Insufficient privileges” error when trying to access visualforce page

We developed a visualforce page and tested it with a System Administrator account and it works fine. Now we created a new "Standard User" account and try to access the same page and get this error: ...
3
votes
1answer
35 views

Lightning security on init page load with server-side call

I was reading through the Lightning Security documentation here and noticed one of the points for Cross Site Forgery. In order to prevent CSRF attacks, do not invoke any server-side controller ...
1
vote
2answers
119 views

“Instances of SELECT vulnerability found across the application” for CRUD/FLS in Security Review

We received a note from the security review team highlighting a CRUD/FLS vulnerability in our package and in the note it says there is a "Instances of SELECT vulnerability found across the application"...
2
votes
1answer
43 views

Running triggers with an admin user or system access [duplicate]

We have several validations that we run on some of our custom objects in triggers (e.g., after update, after insert, etc.). Many of these validations are one time validations from a system perspective ...
0
votes
1answer
12 views

Group as owner of a record

I want a core group of people to have access to create/edit a bunch of records. This group would be a Management Team, anyone in that team can create/edit these records. However I want team members ...
1
vote
2answers
66 views

Security scanner not giving updates

I created some Apex code in a Developer Org and I wanted to try to scan it before my security review so I submitted my username on Friday, here: https://security.secure.force.com/...
1
vote
2answers
37 views

How to submit to the security scanner in a developer org?

I've reached the point where I'd like to scan my Apex code, but up until now it's all been written in a Developer Org. The scanner asks for a username only - how can I specify that the code I want ...
0
votes
1answer
24 views

Call a Secured Web Service from SFMC

I have a task to call a secured web service from a SFMC Microsite. I understand this can be achieved by - Importing the Private Certificate on SFMC (Admin -> Data Management -> Key Management), but ...
0
votes
0answers
33 views

Visualforce security settings in a managed package

I'm developing a package and I just tried to use it with another non-system-administrator user account. When I tried to access the Visualforce page I got a "permissions denied error". So I went into ...
0
votes
2answers
24 views

Can a customer community user create a new detail record?

We have a customer community user and want the user to be able to create a master-detail record for different kinds of objects. However, everytime we try to insert a new record we get the following ...
3
votes
3answers
533 views

How to set TLS Version in Java SOAP API

I am trying to connect to a new org using the Java SOAP API and am getting the following error: [UnexpectedErrorFault [ApiFault exceptionCode='UNSUPPORTED_CLIENT' exceptionMessage='TLS 1.0 has been ...
0
votes
0answers
36 views

Use Strict Transport Security (HSTS) with Salesforce

We are having a third party do security testing for our Salesforce community and one of their suggestions was to "utilize the "Strict-Transport-Security" response header across the entire domain as a ...
0
votes
0answers
13 views

Salesforce Bcc tracking All Activities and viewable/searchable throughout entire company

All of our emails are currently being Bcc'd and are searchable within Salesforce. I would still like to use this functionality because it's helpful to the sales organization if possible. How do I ...
0
votes
0answers
32 views

OAuth1 stopped working

Our SalesForce app is connected to GAE via OAuth1, each time we provision new account we make this connection. Lately we start getting this errors when trying to establish the connection: An ...
0
votes
1answer
48 views

How to give access to a Visualforce Component to a profile

I want to give access to a Visualforce Component to a profile. I know I can give access to Apex Classes and Visualforce Pages under "Users -> Profiles -> [Profile Name]" as explained here. However, I ...
0
votes
0answers
12 views

Secure REST Service published on Sites ( No user license needed)

I developed a REST service with apex and also I published it on Force.com Sites and is accesible to the public. I wonder what would be the best practice in order to secure this service, usually my ...
2
votes
1answer
43 views

NO user can log into the org as a result of profile change

We have a developer org and all of the users (including the admins) in the org have the same profile and the profile was mistakenly updated to have NO rights. (simplified version of the story). Now ...
1
vote
1answer
25 views

Apex Managed Sharing

If I have a scenario where there is a parent object and say 5 child objects, all linked via a master-detail relationship is there a way to use Apex sharing to add additional sharing to a child object ...
3
votes
1answer
23 views

Test against organization data approach

As SF Admin, I am working on a data access project which implement the different access levels (e.g. OWD, Sharing Rules, Roles and Profiles) in Salesforce. I'm ready to refresh the Partial Copy ...
0
votes
0answers
11 views

Generic owasp.SFDCAccessController exception cause in ESAPI library

We are using the ESAPI library to secure our dml operations. It works fine; however, sometimes when an update or insert fails because of an exception, we get a generic exception message like ...
0
votes
1answer
19 views

On with salesforceThe public key certificate used for Single Sign.com (Community) (http://www.salesforce.com) will expire email

I received this email and I understand that we need to install a new public key certificate. However, I'm not sure where to start and how to do this. Can someone please shed some light? Thank you in ...
2
votes
0answers
32 views

OpportunityContactRole security

In a nutshell, how from the REST API (outside the Apex wall here), can I tell I can create/edit/remove an OpportunityContactRole from scratch. Part I of the answer is I believe the ...
2
votes
2answers
36 views

SOQL Query: Stored XSS Error

I have given my code for Security code Scanner but it is given the following error due to Query: Stored XSS My query is like this. loan=Database.query('SELECT Name, fintechLLC__Application__c, '...
1
vote
2answers
50 views

Record sharing using lookup field criteria using apex (similar to controlled by parent)

We have a custom object that has a lookup to account (similar to Contact looking up to Account). We want the user who owns an account to see the records looking up to that account automatically ...
1
vote
1answer
20 views

Updating profiles with Managed Package update

We have several profiles in our managed package that specify access levels to different users. We continuously build new customer fields and objects and want to be able to update the profile with the ...
2
votes
1answer
64 views

Google is making a change to DMARC that affects Salesforce

If you took a looked into Salesforce-Outbound-Emails-Impacted-by-Google-DMARC-Policy I understood we can't use other gmail address to send email from salesforce instance. So as per my understanding ...
1
vote
0answers
30 views

Limited Admin or Delegated Admin profile in Salesforce

So this is the conundrum I am in, we are wanting to store HR sensitive information within salesforce such as salary info and SSN the issue is that we have part of our development team has admin access ...
1
vote
0answers
26 views

Dynamic Security?

I have a fairly complex app I'm building which currently has 24 custom objects, 20 of which fall into a Master-detail relationship at the moment but I think I'm going to have to change that. The ...
1
vote
2answers
43 views

How to solve salesforce security issue (From Zap scanning report)

I am getting " X-Frame-Options Header Not Set" issue in salesforce how I can solve this issue, I have attach a image please take a look on that image.
2
votes
0answers
71 views

invalid security token

Hi we were given an ExactTarget php application to port from an older Magento installation to a new Magento installation. This code is based on the ExactTargetSoapClient, soap-wsse.php and xmlseclibs....
0
votes
0answers
13 views

How could i give a user who tests the application access to login as user but not have access to setup and configuration.

The business users who tests applications today have administration access to login as different users and test as other users, this access is important, but we want to confine them to not have access ...
0
votes
1answer
30 views

Does assigning visualforce page to object buttons override the OWD

I have Opportunity OWD set to Private. Have over ridden the NEW,EDit,View and Clone buttons of Opportunity with VF page. I created opp record with USER1. Logged in as USER2 and still able to see ...
4
votes
0answers
31 views

Enable Apex Classes - Sometimes Only Global, Sometimes Includes Public

I have a managed package that I distribute to clients and I'm running into a curious situation trying to help one install. I have noticed that in the Enable Apex Classes for their System Administrator ...
1
vote
1answer
62 views

How to make pdf rendering non-editable or password protected

Although the question I am asking may sound stupid but i am trying to check the best possible secure solution. Is it possible to make pdf rendering non-editable or password protected
1
vote
0answers
91 views

SSL certificate problem: unable to get local issuer certificate, curl_errno 60

I'm trying to integrate PHP script with Salesforce by following the example on the link: http://developer.force.com/cookbook/recipe/interact-with-the-forcecom-rest-api-from-php But I get the error ...
1
vote
1answer
21 views

List view assigned to roles can't be seen by users with that role

I'm sure I'm overlooking something simple here. We have a list view on case where visibility is extended to a set of roles: However, when I login as a user with one of the defined roles, the UI ...
1
vote
0answers
20 views

Reduce the Permissions of User

I have Lead OWD set to public Read/Write. I m creating new User with new profile..with Lead permissions as CRED(No view All,Modify All). I want this user not to see other lead records. How to ...
1
vote
1answer
28 views

Need to change object permissions of standard profile-URGENT

I have Lead OWD set as Private. I have 5 users in Marketing User(std obj)..I need to give View All & Modify All permissions on lead object of this profile. How to approach.? Cloning marketing ...
1
vote
1answer
46 views

Field Audit Trail

Did anyone used Field Audit Trail to archive data in production? any experience/limitations with it? also is it part of standard licensees agreement or we need to buy something new like shield? https:...
2
votes
1answer
39 views

Profile / Permissions best practices? [closed]

Hello and thank you in advance. I'm curious if anyone has any resources they could point me to for best practices around permissions sets / profiles / etc. The reason for this is because as an ...
1
vote
0answers
44 views

Marketing Cloud SQL Injection?

I had a question come up that seemed a bit ridiculous at first, but has got me wondering. Is it possible to run any sort of script or SQL injection equivalency on forms that are configured to direct ...
0
votes
4answers
160 views

how to skip verification code for a user in salesforce

I want to skip the verification code for a user I want the users not to receive the "''You recently logged in to Salesforce from a device we don't recognize.'' How can I do ? I have defined lists of ...