Salesforce user security is an intersection of sharing, user, Profiles, roles, roles hierarchy and object permissions.

learn more… | top users | synonyms

2
votes
2answers
31 views

Provide read to few users and read / write to all users on a new sObject when all users have same profile permissions

We have about 108 users in out application who need to be able to have read / write access on an special sObject and do other lots of things. There are two user who need to do the same other lots of ...
1
vote
0answers
22 views

Salesforce Security Review documentation

I want to know if their is any proper documentation format that I have to follow for security review. I have searched for the document format and got this link ...
2
votes
1answer
36 views

checking FLS in triggers

I've seen loads of code examples of triggers and helper classes. They never check for object or field level permissions. I wonder if this was done for code clarity or is this something one does ...
-1
votes
1answer
22 views

Salesforce Security Review?

i have used the burp tool but i think it doesent suit for my requirements.. can i know what are the different parammeters on which code is being reviewed apart from governor limits and sharing ...
0
votes
0answers
27 views

Issues on a LIST button

I have a list button that on clicking take me to page /apex/abc . In that page I have a input field called account : order__c.account__c that is a master detail child to Accounts and a button. My ...
0
votes
1answer
14 views

salesforce Org and group level security

A company has 2 franchises, both of which are a part of the same Salesforce org. The CEO manages both franchises, and should be able to see and communicate with all users. The CEO further needs to ...
0
votes
2answers
28 views

Visualforcepage security

I have a custom profile named Marketing Team and the assigned user is Sujal. In that profile, i enabled one visualforce page access to him. So accordingly, Sujal can now access that VF page. I have ...
0
votes
1answer
16 views

Show Inactive Product records to user who does not have edit access

Is there a way to show inactive products to user who does not have edit access to same ? I could have given edit access to products on user's profile but then they will also have access to ...
2
votes
2answers
56 views

When do we need to use Apex Class permissions

My colleague and I were reviewing the Apex Class Security Overview. Per our understanding of the page, if a user does not have permission to access VisualForce page's controller, he should not be ...
1
vote
0answers
16 views

Provide limited shared access to objects

I'm working on a system integrating Infor LN and Salesforce using the Inforce app. All SF records sync'd with LN are of an Inforce Account Record Type. The accounts have the usual CRM features plus ...
2
votes
1answer
41 views

Are private fields visible through related list of a related (public) object?

I created two objects ObjectVisible and ObjectHide. ObjectVisible has lookup fields to ObjectHide. I set the OWD as follows: ObjectVisible: Public Read, ObjectHide: Private I used custom code to ...
1
vote
1answer
53 views

How to secure Web Service API integration with external systems

I am given few URLs (web service APIs), which when called would fetch and display data in JSON format and I am using these in my Salesforce Org and use them to update few of Salesforce fields. I have ...
0
votes
1answer
38 views

How can I set field level security for multiple fields in the same custom object?

I have deployed several objects from one sandbox environment to another. I notice that the field level security settings has not been deployed. I used the change sets method to deploy these objects. ...
3
votes
1answer
50 views

VF Page Custom Console Component blocked due to Same Origin Policy

I have a custom Visual Force page and use it as a custom console component in the Service Console. It was working but not it's being blocked due to the same origin policy: Uncaught SecurityError: ...
0
votes
1answer
36 views

Contact's child records transfer

I have few custom child objects (lookup relationship) of Contact. My requirement is if I change the Contact owner from User A to User B, I want the child records of that Contact to be transferred to ...
1
vote
0answers
25 views

Accessing Salesforce session via oAuth maintains session across browsers

I am using oAuth 2.0 Web server flow to connect to Salesforce org and get the Access token and refresh token. I use the following URL to access a visualforce page that resides within the Salesforce ...
0
votes
0answers
23 views

How best to secure client_id + secret using - Rails + Restforce

I've successfully managed to set up an app using my developer account - it is currently making use of Ruby on Rails 4.2.beta2, ejholmes most excellent gem restforce and the very helpful tutorial and ...
2
votes
1answer
85 views

Safest way to see if a user is still “logged in” (REST API)

I'm using the Salesforce REST API along with OAuth 2.0 User-Agent Flow. I have the need to "ping" Salesforce to see if a user is logged on (this is the simplest way to do so in my application). If the ...
1
vote
1answer
47 views

Error : Insert Failed :INSUFFICIENT_ACCESS_ON_CROSS_REFERENCE_ENTITY, Sharing Rule Trigger

I have created one Trigger to give access to particular Accounts of my "Special" custom object records, Here BBB : Is custom object having lookup of both Account and Special E.g. BBBRecord = ( ...
4
votes
1answer
52 views

Is DATABASEDOTCOM Ruby gem affected by SFDC dropping SSL3.0 support?

SFDC recently stated they will not support SSL3.0 any longer. Notification goes on to say currently supported browsers all use TLS by default so the users are safe. My concern is an external ruby ...
6
votes
2answers
207 views

Is encrypting passwords in protected custom settings a security requirement?

Regarding the Salesforce security review process, can anyone confirm (or deny) that storing a connection URL, username and password for a webservice utilized by an appexchange app can be done in plain ...
2
votes
1answer
52 views

I created a custom object, and fellow admins cannot see my data

I'm part of the System Administrator role/profile. I created a custom object and added some data to it. Other system admins created data as well. When creating the object, we assign ourselves as the ...
4
votes
1answer
50 views

Is login history only stored for 6 months?

Is login history only stored for 6 months? I appreciate it's in the security audit controls workbook: Because of the volume of data, login history is automatically removed after six months. If you ...
1
vote
3answers
72 views

Field level security and API access

Could someone please explain how both of the following two statements are correct: A field hidden by field level security is not visible through the API. A user has not been granted field-level ...
2
votes
1answer
28 views

'Workflow' to resubmit package to security review with corrections

I had a technical question and wanted it to review it with you to make sure that I am following the right approach: To submit the package for security review, I do the following steps: I get the ...
2
votes
1answer
200 views

Critical Update “Serve Static Resources from the Visualforce Domain” still serves resources via Salesforce Domain

After activating the Critical Update, I checked a couple of my orgs using Managed Packages which provide resources used on buttons and scripts in the Standard Salesforce domain. It surprised me that ...
3
votes
1answer
51 views

Display unsecured Intranet pages in SF

I have company intranet pages are insecure webpages , and I want to make them accessible by a tab. From what I understand, you can only put secure pages on tabs. Can someone recommend a work around? ...
7
votes
3answers
242 views

Making a public read/write record private

Disclaimer! I have searched for a result to this question on the web with no success therefore I need someone with expertise to review it and provide an answer. I use a public read/write OWD model on ...
11
votes
4answers
711 views

Twilio Integration and SSLv3 POODLE Vulnerability

I have an existing integration with Twilio that works great - Twilio posts a message to a custom SFDC REST endpoint, and we can generate a new SMS message by calling out to the standard Twilio REST ...
1
vote
0answers
33 views

Role based sharing: All Components in Salesforce and what is the best way to make existing changes

Not sure what is the best way to ask this question I am listing down all the places (configuration only) components where force.com platform provides option to share/assign based on Role, Role and ...
2
votes
1answer
34 views

Adding members to Account Team

OWD for Account /Opportunity and cases are private. I have formed a group in the organisation which includes only post sales consultant. The members of the group should have the flexibility to add ...
3
votes
0answers
57 views

How to control custom object through territory management?

I have 2 custom objects and tabs. Accounts and Users are assigned manually in my org. How to I control their visibility/security according to territories? Are there any samples that I refer to? That ...
2
votes
0answers
28 views

Should we give the guest user profile the “view encrypted data” permission?

We've developed native VF/Apex code that allows us to send a link to a customer and have them securely view a PDF of their contract (contract is a VF page generated using data from fields in their ...
3
votes
1answer
78 views

Logout problem after few clicks

The sandbox is on CS18, which has been upgraded to Summer 14 is showing very strange bahaviour. Now, in my sandbox, users are kicked out (redirected to the login page) after a few clicks. Anyone is ...
4
votes
1answer
118 views

Do Salesforce1 Mobile App users on cellular always have to verify their login

This is an admin question rather than coding: I have an SF1 user that has to validate their login virtually every time that they login to SF1. The user has an iPad Air running iOS7 with a cellular ...
2
votes
1answer
39 views

How to Use Custom Setting to Avoid Insecure Credential Storage Vulnerability?

I got a comment from Salesforce team about an insecure credential storage vulnerability saying that we must avoid hardcoding sensitive information and should use the custom settings. My situation ...
4
votes
3answers
230 views

Is there a way to reset a user's secret question if they know neither the answer nor their password?

A user forgot their password. I have admin rights in the org so I reset their password. They then informed me that they have also forgotten the answer to their secret question. I know that you can ...
-1
votes
1answer
33 views

How to display the filed set on a vf page [closed]

I have created a field set on a custom object and I am getting all the fields from the field set to a apex class. Now I need to display the field to a Vf page as inputfield. Is it possible to display ...
0
votes
0answers
45 views

You do not have permission to view this page or an error occured

I have installed a package in my org. But when I try to run a page from this package I am getting an error that Error You do not have permission to view this page or an error occured. Please ...
1
vote
1answer
69 views

How to avoid consequences of sandbox security token refresh - Eclipse IDE projects

Every time after sandbox refresh, security token is expired. So this causes necessity of creation of new security token and sending it to your email. Then you have to update that information in ...
1
vote
0answers
28 views

How to prevent Stored XSS? [closed]

After check marx security scan i'm getting stored xss error. <apex:outputText value="{!wrk.html_description__c}" escape="{!show}"/> Public List<Workspace__c> workSpaceList {get; set;} ...
2
votes
1answer
55 views

Outbound Message Security and Validation

I am investigating the security implications of using Salesforce's Outbound Messages. I have reviewed the documentation about security for Outbound Messages. Does Salesforce have a way of ...
4
votes
1answer
103 views

How to avoid security risks with escape=“False” in output tags

Ok, say for example the output we need on the page must include HTML tags and we want to avoid any security risks..... Scenerio 1: No user input, string is completely generated by apex code and ...
2
votes
2answers
99 views

Securely Storing a static API secret/key in a Salesforce app

I recently submitted an application to the AppExchange, only to have it not pass the security check due to "Insecure Storage of Sensitive Data Vulnerability." The problem is that my app accesses an ...
3
votes
1answer
138 views

Composite App integration and “Lock sessions to the IP address from which they originated”

I have an older Composite App that uses a Web Tab for integration. It is essentially an iframe that passes the current Session ID and Server URL to an external web application in the query string. The ...
8
votes
2answers
86 views

PIN Security for a Force.com Mobile SDK App

There's a feature for PIN protection which works with Mobile SDK applications which provides an extra level of security for users. The PIN configuration is done as part of a connected app as shown ...
3
votes
1answer
191 views

How to modify custom object security

I setup a custom object (called Sensitive Documents) with a child-master relationship to the Contact object. I was hoping to control the security of my custom object independent of the parent object ...
0
votes
1answer
19 views

security scenario by using profile

I have 5 users and I have 5 accounts and related contact to account. Now I want user1 and user2 can only view account1 and account2 not any other accounts. And all other users can view all accounts. ...
1
vote
1answer
148 views

“View All Users” permission for anonymous Sites profile not visible

We see some odd differences (possibly just since the last release) in the "Administrative Permissions" section of the user profile for a Sites anonymous user (Setup > Develop > Sites > [your site] > ...
2
votes
1answer
50 views

Are security policies enforced on returned data from the API?

I'm making an application that interacts with Salesforce Rest API. When logged in as a user, I can execute SOQL on behalf of that user, for example: SELECT subject from event However, this will ...