Salesforce user security is an intersection of sharing, and user and object permissions.

learn more… | top users | synonyms

5
votes
0answers
26 views

Disable multiple username hints without disabling “Remember Username”?

In the current release, Salesforce released the multiple username hint "enhancement". This causes two showstopper issues: if a username has an apostrophe in it, the "pick a username" screen where ...
2
votes
1answer
24 views

ApexDevNet in the remote site

Just found a remote site in the Dev Org. I didn't add it before. What is the remote site "ApexDevNet" ? Can we just disable it ?
3
votes
1answer
33 views

VFRemoting escape option

We are currently looking into the best place to handle escaping (html encoding) when using VFRemoting. It had been suggested to us that using always the option {escape: true} was the best approach ...
4
votes
1answer
40 views

Communities root URL redirect issue

I have an instance which has a Sites domain, call it "sites.force.com", and a Communities domain, call it "comm.force.com". The instance has a single Community set up at a sub-folder, call it "/c1", ...
4
votes
1answer
654 views

heartbleed and its impact on salesforce

As an IT professional, I am very concerned at the news that Heartbleed can exploit weaknesses in the OpenSSL architecture. Is there any risk to users logging onto Salesforce via browser or app?
4
votes
1answer
22 views

Security Scanner not finding assertion

I have been using the Salesforce Security Scanner to scan my code: http://security.force.com/security/tools/forcecom/scanner Basically, the scan is telling me that I do not have any assert ...
1
vote
1answer
15 views

How to configure expiry of refresh tokens

I have heard that "Refresh tokens can be configured to expire in their associated Connected App by an org admin." Can anyone direct me to where in the UI this feature is available? Thanks
1
vote
1answer
31 views

Email spoofing issue from salesforce - emails not getting through to recipients

If I send emails from an email-enabled object within Salesforce, e.g., case, the emails do not always get delivered to recipients. I have discovered that one or two of the recipients have these emails ...
0
votes
1answer
32 views

Does OAuth token (from mobile SDK) still work in local browser?

I'm working on the Mobile app development. Here is my issue: We have got a token through the OAuth flow in App using SDK. There is a link in app named "user info", user tap that link and open a ...
4
votes
0answers
51 views

Field not accessible within runAs() method in Test class

I am checking for field accessibility of an User u whose Profile is p in apex Test class.To this profile field level security is set to Hidden for the field team_name__c.When I run as this user using ...
1
vote
1answer
40 views

how to share activity (edit task/event) for other users

I have contacts set to private and use sharing rules to open up access to other sales users. I have a scenario where an account executive would like to have other sales support users below them in ...
3
votes
1answer
52 views

Does CreatedById give record access?

I have a controller that currently does not specify 'with sharing'. I would like to be able to add these keywords but I don't want it to break on existing users. It's basically an aggregate report. ...
3
votes
4answers
172 views

How do 'Modify All Data' and 'View All Data' affect Field-Level Security settings

Does the Modify All Data or View All Data permission allow a user/profile to ignore the FLS settings for an object? The documentation would seem to suggest that this is the case, but I've found ...
1
vote
2answers
42 views

Different currency converter for different object

This due to different currency rates being used to show the converted amounts. If an Opportunity stage is Won / Cancelled / Not Selected any currency conversions uses a dated currency rate, which is ...
2
votes
1answer
37 views

Are CRUD & FLS enforced with usage of Remote Objects?

I am wondering if CRUD & FLS are enforced when we are working with Remote Objects?
1
vote
2answers
23 views

Do other permissions/ functionality require the view setup and configruation privilege?

All of my profiles have the 'view setup and configuration' privilege in production. The extent of my knowledge on the View Setup and Configuration -is it allows users to view complete Setup menu, ...
5
votes
2answers
76 views

Giving users access to a specific custom setting without granting them Customize Application access

I'm working on a VF page to give some users access to certain custom settings without given them the entire Customize Application access. Is there anyway to edit and commit data into the system as an ...
0
votes
1answer
37 views

Check SObjectType FLS for a specific user

I need to be able to check the FLS (Field-Level Security) settings for a specific user. Since the user in question will not be executing the check I cannot use the DescribeFieldResult class for the ...
3
votes
1answer
96 views

Store Salesforce credentials

I'm building an application in PHP and MySql that will allow people to sign in with their Salesforce ID, Password and Token and then they will receive a report based on their contacts and ...
3
votes
1answer
116 views

Which Apex classes & Objects must be enabled in a Permission Set?

I'm still a bit unsure which Apex classes I have to enable in a Permission set. I guess I don't need to enable Test classes I definitely need to enable Controller and Controller extensions for ...
4
votes
1answer
80 views

“inputText_Ignoring_FLS” in force security scanner report

I scan my code, and I received a Serious issue: <apex:inputText value="{!ld.Name}" /> I have applied FLS as the guide here : http://wiki.developerforce.com/page/Enforcing_CRUD_and_FLS ...
3
votes
1answer
36 views

Allow certain users to see records on related list but not be able to view detail?

We want to allow our salesmen to see other salesmen's opportunities, but only on related lists (such as on the account detail page). They should not be able to click on the opportunity to see the ...
0
votes
1answer
22 views

How to use the security settings for person account?

Is there any option to view the sharring setting of the person account?I dont find that option any where..
0
votes
0answers
14 views

Secure Exact Target Microsite [duplicate]

can anyone provide recommendations on how to build a secure microsite in ET? Thanks
1
vote
1answer
22 views

Users with dual roles - can it be done with one user account?

I'm trying to figure out how to set up security for a person that has a dual role that entails two separate hierarchical structures. Hi primary role is to work with the advancement group, which gives ...
1
vote
1answer
26 views

Related List Records access for PortalUser

How do I create the Account sharing rules to customer portal user based on this current setup: Account is "Private" Contact is "Control by Parent". I have created a customerPortal user called ...
2
votes
1answer
29 views

Checking CRUD for Static SobjectType

I am enforcing CRUD permissions for mainly custom objects. Doing it this way Boolean isUpdateable = Schema.sObjectType.Custom_Object__c.isUpdateable(); works, and it seems to avoid a describe ...
3
votes
1answer
92 views

Can an Inline Visualforce page be hidden by security?

I'm working on a requirement which speed up my deployment process. I have 40 page layouts what I have to update in a production environment. Ideally I'd like to add a new inline visual force page to ...
2
votes
1answer
117 views

How to refresh a token retrieved from the Auth.AuthToken class

A Salesforce instance is configured so that users can log in using OpenID Connect and their Google credentials. I am trying to access the token provisioned by the login via google to make callouts to ...
1
vote
1answer
43 views

Testing Security Settings for Server to Server Integration

I am trying to access a web service built by a client that is hosted on their internal servers. They have exposed access to the public internet, but have restricted access to Salesforce's IP range. ...
4
votes
1answer
112 views

Adding new fields to custom objects in managed package

I am a newbie to salesforce and still evaluating the platform for building products. The product needs to be sold as a managed package. The product many need to be customized by the clients to suit ...
2
votes
1answer
137 views

Insufficent Priviliges to access the User related Contact(Lookup) record

If i am having a User as a OverageHighVolumeCustomerPortal profile, it contains the Contact Lookup field. If i clicks the Contact Lookup then it throws the error like this: Insufficient Privileges ...
0
votes
1answer
32 views

The contact of the portal user couldn't be viewed from the user record details

I'm trying to view contact of the portal user from the user object in sandbox, but can't view it and I get the following error: You do not have the level of access necessary to perform the ...
8
votes
2answers
121 views

are Triggers (and their delegated classes) or Batch affected by sharing?

I understand with sharing classes run in User Mode, meaning they respect permissions, field-level security and sharing rules of the current user. I understand without sharing classes run in System ...
8
votes
3answers
411 views

Can web-to-lead be protected from spammers without additional server side processing?

The default web-to-lead functionality that Salesforce provides makes it really easy to drop an HTML form onto any web page and submit leads straight into a Salesforce Org. E.g. <form ...
0
votes
1answer
127 views

checkmarx scanner result shows non related results for stored XSS

Recently I have done checkmarx scan and while analyzing it shows me one soql query in controller method and totally unrelated variables in VF page. For example Note a: [select id, OwnerId, ...
0
votes
0answers
46 views

How to get View all and Modify All permission using apex code

I have a requirement where need to know the logged in user is having viewAll or modyfy all permission on a custom object using apex code. Schema methods gives CRUD permissions on that object but I ...
2
votes
1answer
27 views

Restrict Customer's View of Object Records to Only Those They Create

I need to create a force.com portal site in which customers can submit one or two employment applications which they will fill out online in the site. The challenge for me (as a new force.com ...
2
votes
2answers
173 views

Customer Portal sharing access to existing custom object

We are turning on customer portal and we need new registered portal users to access custom object records already created (aka. the new portal user doesn't own this record). How do we grant access to ...
4
votes
2answers
63 views

Web App Authentication

I'm working on a simple PHP web app to pull some data from our Salesforce to an external database for use in a website. I am a novice with a lot of stuff here but my primary question is regarding ...
4
votes
1answer
71 views

Can't figure out how to manual share contacts from other accounts to portal users

We have portal users who need to be able to search contacts but not just contacts for the account they are under but they also need to see contacts from "related" accounts (think corporate parent user ...
6
votes
2answers
154 views

SOAP webservice connection getting: no access allow to this class

I'm pretty new to salesforce and SOAP but here goes. I've made a connection to my site and then passed in the config to my webservice's object. This goes fine. But then I get this error: ...
1
vote
1answer
42 views

Archive tasks at anytime by any user

I have a requirement where I need to archive tasks at any time by any user. Salesforce archive duration is one year but I should be able set a task as atchived by me at any time. Or is is there any ...
4
votes
1answer
82 views

Force.com security scanner says no Force.com code accessible in your organization- Any one else having this issue?

I have used the force.com security scanner many times before and had no issues with it till now. I got an automated email The requested security scan did not return results because there was no ...
3
votes
1answer
49 views

Sharing settings on Accounts and Opps

Is there a way for users to see all the accounts for a Record type, but not allow them to see the opportunities UNLESS they are the opp owner, or if another condition is met? I think the answer is ...
1
vote
2answers
70 views

Encryption Mechanism in Salesforce

Could anyone describe what sort of encryption mechanism Salesforce uses when encrypting answers to security questions and also the passwords for user accounts? Is this AES256? Any help will be ...
3
votes
1answer
135 views

Sales Force login bypass Add a Time-Based Token

I just created my salesforce account a few weeks ago and now when i try to login it requires me to scan a QR code which my phone, an old nokia model can't possibly do. Is there anyway for me to bypass ...
2
votes
1answer
52 views

any ways to check if current profile is allowed to access a particular page?

I have a couple of static pages( just text no custom object involoved ) need to show to users and links to the pages need to be hidden if the user doesn't have privilege to do so. Is there any way to ...
10
votes
2answers
829 views

security token vs session id vs access token

Are all of these three separate values that are only linked for the same user ? For security token I mean on value that you can take from Setup -> My Personal Information -> Reset security token. As ...
9
votes
3answers
1k views

Field level Security in VisualForce page

I have two custom fields in Account object Test_Field_RO__c and Test_Field_H__c. I have a profile Test Profile, which has following field level security(FLS) - Test_Field_RO__c is Read Only and ...