Salesforce user security is an intersection of sharing, user, Profiles, roles, roles hierarchy and object permissions.

learn more… | top users | synonyms

0
votes
1answer
13 views

security scenario by using profile

I have 5 users and I have 5 accounts and related contact to account. Now I want user1 and user2 can only view account1 and account2 not any other accounts. And all other users can view all accounts. ...
1
vote
1answer
22 views

“View All Users” permission for anonymous Sites profile not visible

We see some odd differences (possibly just since the last release) in the "Administrative Permissions" section of the user profile for a Sites anonymous user (Setup > Develop > Sites > [your site] > ...
2
votes
1answer
37 views

Are security policies enforced on returned data from the API?

I'm making an application that interacts with Salesforce Rest API. When logged in as a user, I can execute SOQL on behalf of that user, for example: SELECT subject from event However, this will ...
0
votes
0answers
17 views

What events can a user see in Salesforce

When looking at the Calendar/Events page, I'm curious what events a user can see. From what I can tell, a user will see an event if: The event is assigned to them They are an invitee on the event ...
1
vote
0answers
32 views

Insufficient Privileges as System Administrator on Opportunity

I am the System Administrator (Standard Profile) and receiving Insufficient Privileges error when trying to access Opportunity fields. "Insufficient Privileges You do not have the level of access ...
1
vote
1answer
57 views

Tooling API and Scheduled Batch Apex - How to access

Without storing a users credentials to salesforce how can one access the tooling API during a daily scheduled batch? Currently we are storing the users username and password in encrypted fields but ...
1
vote
1answer
40 views

Contact visible with OWD Private even though user doesn't have access

I got a requirement that I need to soft delete the Accounts and Contacts. So only deleted records should be visible to System Admin. And also all Accounts and Contacts are shared based on role ...
1
vote
1answer
16 views

Manager Field on User object

Does the Manager Field on the User object control Security Access ? For Ex. if I setup User 1 as manager of User 2 then, would User 2 start seeing records owned by User 1 that they could not ...
3
votes
1answer
90 views

Use-Case for Encrypted Custom Fields and why are they rendered as input type=“text” and not as type=“password” on standard UI?

Can't understand why Encrypted Custom Fields are not rendered as type="password" on the standard UI. The first time you input or later if you change the content, it's just plain text. If you come back ...
2
votes
1answer
261 views

SOQL best practices-prevent SOQL injection

I have a query string that is as follows(no bulkification required)... String qryString = 'SELECT Id FROM Contact WHERE (IsDeleted = false and Name like \'%' + searchText+ '%\')'; searchText is a ...
0
votes
0answers
24 views

How can I create support organization?

How can I create support organization? I would like to create a new organization so that the regular users can grant access to the user with delegated administration.
3
votes
1answer
20 views

Schedule removal of activated login IP & activated client browsers

I want to force users to regularly go through the SMS login activation process by clearing down the activations list in Salesforce. In the Salesforce configuration menu Setup>Security ...
5
votes
1answer
22 views

Insufficient Privileges for Public Group Memberships Page

A user is a part of multiple public groups in Salesforce and has a custom profile. When the user navigates to the personal information page and clicks on the 'Go To List' link available under the ...
1
vote
1answer
12 views

Enabling edit access to fields en mass

Is there a quick and easy way of enabling edit access to all or a selection of fields for an object for a particular profile?
2
votes
1answer
37 views

Why is Transfer Record a system permission? Is there any other way to accomplish the same thing on a per-object basis?

I have a requirement to grant a set of Users the ability to transfer ownership of all records of a certain object type, regardless of current ownership. I know I can accomplish this by granting this ...
8
votes
2answers
111 views

How do I find out if a user has access to a visualforce page through apex?

So I have a VF page that calls some other VF pages based on a button click. The button will reroute to a different VF page depending on a value within a dropdown. Sometimes the logged in user will ...
4
votes
1answer
36 views

“MyClass object = (MyClass) t.newInstance()” considered harmful

I hope this turns out to be a still unknow security flaw that will be soon fixed by Salesforce.com. From code in my managed package I was able to call the constructor of a packaged class of another ...
2
votes
2answers
105 views

How to get machine id or physical machine address in Visualforce page or in Apex?

I have been consuming SAP webservices from salesforce using callout mechanism. Currently, i am sending userid in the argument to the webservice to ensure that the call is from a valid salesforce user. ...
3
votes
1answer
92 views

Ajax call on custom component: insufficient privileges

I wrote a VisualForce page that has two drop-down lists. When the user selects an item from the first list, it makes an Ajax call to populate the second list. Everything worked great. I split the ...
8
votes
1answer
105 views

Transferring ownership of triggers, workflows, etc

My org has an account that was used by a consultant to create various apex triggers and classes, workflows, visual force and other custom development. The higher ups want to disable this now unused ...
4
votes
1answer
108 views

Authenticated Website licenses obsolete?

I have a customer who has a large volume of Authenticated Website licenses, which are used to do custom Sites logins to a fully custom website. They have been told by their sales rep that Salesforce ...
0
votes
2answers
43 views

How do I secure the Nonprofit Starter Pack from the Salesforce Foundation?

So, it appears that I did not lock-down the Nonprofit Starter Pack (NPSP) from the Salesforce Foundation (SFF) as well as I should, and attempting to avoid issues like this in the future. Looking for ...
6
votes
2answers
118 views

How to set public inline images in Knowledge Base Article

Background I'm developing an standard FAQ using Knowledge Base Articles. I've defined an Article Type FAQ which contains a Rich Text field called "Answer". The FAQ articles are exposed to an ...
4
votes
2answers
53 views

Contact visibility - what controls this

I have two users who are identical in roles, profiles, and group memberships. One can see a particular contact; the other cannot. We are set up so that Accounts have default access of "Private" and ...
3
votes
1answer
52 views

Allow User's Manager to see Private records?

I currently have a custom object which is set to private in organization-wide default sharing settings. I have created an approval process to allow managers to approve private records. When the ...
0
votes
0answers
34 views

Salesforce oauth “integration user” security

I will need to make api calls to salesforce from my external java application for which I plan to use oauth. I was going through some posts which state that one could use "integration user" like Post ...
2
votes
1answer
58 views

OAuth callback through HTTP (not SSL) is possible?

In short: I need to set a Connected App to later use OAuth Web server Flow. The callback URL should be HTTP. My web server does not have a SSL certificate and I not able to get one. But SF give me ...
2
votes
1answer
74 views

Salesforce security review process

I am planning to submit my salesforce app for security review. The app also fetches some data from an external java spring based application. The external application does not make any api call back ...
5
votes
1answer
69 views

Bug in UserRecordAccess and system.RunAs in test methods

Trying to develop some test classes around security and noticed this issue and was curious if anyone else has found this, is it a bug, and have you been able to work around it within the system.runAs ...
0
votes
1answer
31 views

Sharing cases with subset of Account contacts for Community Users

Use Case Account Contacts have a Field For Department Case OWD set to Private No Sharing Set ** Need to be able to provide access to a case created by a contact ONLY with other contacts on the ...
1
vote
0answers
29 views

Denied Persons List

Recently we were audited and our Legal findings found that we need to begin supporting the US Govt DPL List, and I was wondering if anyone here has had to deal with this list and if so what steps do I ...
1
vote
2answers
50 views

Salesforce security review

I am new to salesforce development and have a question regarding the application security review process. After the installation of my application in salesforce I want to invoke a service in my java ...
13
votes
1answer
138 views

Disable multiple username hints without disabling “Remember Username”?

In the current release, Salesforce released the multiple username hint "enhancement". This causes two showstopper issues: if a username has an apostrophe in it, the "pick a username" screen where ...
2
votes
1answer
86 views

ApexDevNet in the remote site

Just found a remote site in the Dev Org. I didn't add it before. What is the remote site "ApexDevNet" ? Can we just disable it ?
3
votes
1answer
80 views

VFRemoting escape option

We are currently looking into the best place to handle escaping (html encoding) when using VFRemoting. It had been suggested to us that using always the option {escape: true} was the best approach ...
4
votes
1answer
69 views

Communities root URL redirect issue

I have an instance which has a Sites domain, call it "sites.force.com", and a Communities domain, call it "comm.force.com". The instance has a single Community set up at a sub-folder, call it "/c1", ...
4
votes
1answer
746 views

heartbleed and its impact on salesforce

As an IT professional, I am very concerned at the news that Heartbleed can exploit weaknesses in the OpenSSL architecture. Is there any risk to users logging onto Salesforce via browser or app?
7
votes
2answers
42 views

Security Scanner not finding assertion

I have been using the Salesforce Security Scanner to scan my code: http://security.force.com/security/tools/forcecom/scanner Basically, the scan is telling me that I do not have any assert ...
2
votes
1answer
42 views

How to configure expiry of refresh tokens

I have heard that "Refresh tokens can be configured to expire in their associated Connected App by an org admin." Can anyone direct me to where in the UI this feature is available? Thanks
1
vote
1answer
78 views

Email spoofing issue from salesforce - emails not getting through to recipients

If I send emails from an email-enabled object within Salesforce, e.g., case, the emails do not always get delivered to recipients. I have discovered that one or two of the recipients have these emails ...
2
votes
1answer
77 views

Does OAuth token (from mobile SDK) still work in local browser?

I'm working on the Mobile app development. Here is my issue: We have got a token through the OAuth flow in App using SDK. There is a link in app named "user info", user tap that link and open a ...
7
votes
1answer
176 views

Field not accessible within runAs() method in Test class

I am checking for field accessibility of an User u whose Profile is p in apex Test class.To this profile field level security is set to Hidden for the field team_name__c.When I run as this user using ...
1
vote
1answer
221 views

how to share activity (edit task/event) for other users

I have contacts set to private and use sharing rules to open up access to other sales users. I have a scenario where an account executive would like to have other sales support users below them in ...
3
votes
1answer
69 views

Does CreatedById give record access?

I have a controller that currently does not specify 'with sharing'. I would like to be able to add these keywords but I don't want it to break on existing users. It's basically an aggregate report. ...
3
votes
4answers
644 views

How do 'Modify All Data' and 'View All Data' affect Field-Level Security settings

Does the Modify All Data or View All Data permission allow a user/profile to ignore the FLS settings for an object? The documentation would seem to suggest that this is the case, but I've found ...
2
votes
2answers
90 views

Different currency converter for different object

This due to different currency rates being used to show the converted amounts. If an Opportunity stage is Won / Cancelled / Not Selected any currency conversions uses a dated currency rate, which is ...
2
votes
1answer
57 views

Are CRUD & FLS enforced with usage of Remote Objects?

I am wondering if CRUD & FLS are enforced when we are working with Remote Objects?
1
vote
2answers
42 views

Do other permissions/ functionality require the view setup and configruation privilege?

All of my profiles have the 'view setup and configuration' privilege in production. The extent of my knowledge on the View Setup and Configuration -is it allows users to view complete Setup menu, ...
9
votes
3answers
155 views

Giving users access to a specific custom setting without granting them Customize Application access

I'm working on a VF page to give some users access to certain custom settings without given them the entire Customize Application access. Is there anyway to edit and commit data into the system as an ...
0
votes
1answer
48 views

Check SObjectType FLS for a specific user

I need to be able to check the FLS (Field-Level Security) settings for a specific user. Since the user in question will not be executing the check I cannot use the DescribeFieldResult class for the ...