Salesforce user security is an intersection of sharing, user, Profiles, roles, roles hierarchy and object permissions.

learn more… | top users | synonyms

1
vote
0answers
10 views

Critical Update “Serve Static Resources from the Visualforce Domain” still serves resources via Salesforce Domain

After activating the Critical Update, I checked a couple of my orgs using Managed Packages which provide resources used on buttons and scripts in the Standard Salesforce domain. It surprised me that ...
2
votes
1answer
33 views

Display unsecured Intranet pages in SF

I have company intranet pages are insecure webpages , and I want to make them accessible by a tab. From what I understand, you can only put secure pages on tabs. Can someone recommend a work around? ...
7
votes
3answers
181 views

Making a public read/write record private

Disclaimer! I have searched for a result to this question on the web with no success therefore I need someone with expertise to review it and provide an answer. I use a public read/write OWD model on ...
3
votes
1answer
147 views
+50

Twilio Integration and SSLv3 POODLE Vulnerability

I have an existing integration with Twilio that works great - Twilio posts a message to a custom SFDC REST endpoint, and we can generate a new SMS message by calling out to the standard Twilio REST ...
1
vote
0answers
16 views

Role based sharing: All Components in Salesforce and what is the best way to make existing changes

Not sure what is the best way to ask this question I am listing down all the places (configuration only) components where force.com platform provides option to share/assign based on Role, Role and ...
2
votes
1answer
30 views

Adding members to Account Team

OWD for Account /Opportunity and cases are private. I have formed a group in the organisation which includes only post sales consultant. The members of the group should have the flexibility to add ...
3
votes
0answers
36 views

How to control custom object through territory management?

I have 2 custom objects and tabs. Accounts and Users are assigned manually in my org. How to I control their visibility/security according to territories? Are there any samples that I refer to? That ...
2
votes
0answers
18 views

Should we give the guest user profile the “view encrypted data” permission?

We've developed native VF/Apex code that allows us to send a link to a customer and have them securely view a PDF of their contract (contract is a VF page generated using data from fields in their ...
3
votes
1answer
69 views

Logout problem after few clicks

The sandbox is on CS18, which has been upgraded to Summer 14 is showing very strange bahaviour. Now, in my sandbox, users are kicked out (redirected to the login page) after a few clicks. Anyone is ...
4
votes
1answer
83 views

Do Salesforce1 Mobile App users on cellular always have to verify their login

This is an admin question rather than coding: I have an SF1 user that has to validate their login virtually every time that they login to SF1. The user has an iPad Air running iOS7 with a cellular ...
2
votes
1answer
33 views

How to Use Custom Setting to Avoid Insecure Credential Storage Vulnerability?

I got a comment from Salesforce team about an insecure credential storage vulnerability saying that we must avoid hardcoding sensitive information and should use the custom settings. My situation ...
4
votes
3answers
182 views

Is there a way to reset a user's secret question if they know neither the answer nor their password?

A user forgot their password. I have admin rights in the org so I reset their password. They then informed me that they have also forgotten the answer to their secret question. I know that you can ...
-1
votes
1answer
31 views

How to display the filed set on a vf page [closed]

I have created a field set on a custom object and I am getting all the fields from the field set to a apex class. Now I need to display the field to a Vf page as inputfield. Is it possible to display ...
0
votes
0answers
36 views

You do not have permission to view this page or an error occured

I have installed a package in my org. But when I try to run a page from this package I am getting an error that Error You do not have permission to view this page or an error occured. Please ...
1
vote
1answer
42 views

How to avoid consequences of sandbox security token refresh - Eclipse IDE projects

Every time after sandbox refresh, security token is expired. So this causes necessity of creation of new security token and sending it to your email. Then you have to update that information in ...
1
vote
0answers
20 views

How to prevent Stored XSS? [closed]

After check marx security scan i'm getting stored xss error. <apex:outputText value="{!wrk.html_description__c}" escape="{!show}"/> Public List<Workspace__c> workSpaceList {get; set;} ...
2
votes
1answer
30 views

Outbound Message Security and Validation

I am investigating the security implications of using Salesforce's Outbound Messages. I have reviewed the documentation about security for Outbound Messages. Does Salesforce have a way of ...
4
votes
1answer
58 views

How to avoid security risks with escape=“False” in output tags

Ok, say for example the output we need on the page must include HTML tags and we want to avoid any security risks..... Scenerio 1: No user input, string is completely generated by apex code and ...
2
votes
2answers
51 views

Securely Storing a static API secret/key in a Salesforce app

I recently submitted an application to the AppExchange, only to have it not pass the security check due to "Insecure Storage of Sensitive Data Vulnerability." The problem is that my app accesses an ...
3
votes
1answer
64 views

Composite App integration and “Lock sessions to the IP address from which they originated”

I have an older Composite App that uses a Web Tab for integration. It is essentially an iframe that passes the current Session ID and Server URL to an external web application in the query string. The ...
8
votes
2answers
60 views

PIN Security for a Force.com Mobile SDK App

There's a feature for PIN protection which works with Mobile SDK applications which provides an extra level of security for users. The PIN configuration is done as part of a connected app as shown ...
3
votes
1answer
108 views

How to modify custom object security

I setup a custom object (called Sensitive Documents) with a child-master relationship to the Contact object. I was hoping to control the security of my custom object independent of the parent object ...
0
votes
1answer
17 views

security scenario by using profile

I have 5 users and I have 5 accounts and related contact to account. Now I want user1 and user2 can only view account1 and account2 not any other accounts. And all other users can view all accounts. ...
1
vote
1answer
75 views

“View All Users” permission for anonymous Sites profile not visible

We see some odd differences (possibly just since the last release) in the "Administrative Permissions" section of the user profile for a Sites anonymous user (Setup > Develop > Sites > [your site] > ...
2
votes
1answer
40 views

Are security policies enforced on returned data from the API?

I'm making an application that interacts with Salesforce Rest API. When logged in as a user, I can execute SOQL on behalf of that user, for example: SELECT subject from event However, this will ...
0
votes
0answers
19 views

What events can a user see in Salesforce

When looking at the Calendar/Events page, I'm curious what events a user can see. From what I can tell, a user will see an event if: The event is assigned to them They are an invitee on the event ...
1
vote
0answers
114 views

Insufficient Privileges as System Administrator on Opportunity

I am the System Administrator (Standard Profile) and receiving Insufficient Privileges error when trying to access Opportunity fields. "Insufficient Privileges You do not have the level of access ...
1
vote
1answer
77 views

Tooling API and Scheduled Batch Apex - How to access

Without storing a users credentials to salesforce how can one access the tooling API during a daily scheduled batch? Currently we are storing the users username and password in encrypted fields but ...
1
vote
1answer
80 views

Contact visible with OWD Private even though user doesn't have access

I got a requirement that I need to soft delete the Accounts and Contacts. So only deleted records should be visible to System Admin. And also all Accounts and Contacts are shared based on role ...
1
vote
1answer
40 views

Manager Field on User object

Does the Manager Field on the User object control Security Access ? For Ex. if I setup User 1 as manager of User 2 then, would User 2 start seeing records owned by User 1 that they could not ...
3
votes
1answer
173 views

Use-Case for Encrypted Custom Fields and why are they rendered as input type=“text” and not as type=“password” on standard UI?

Can't understand why Encrypted Custom Fields are not rendered as type="password" on the standard UI. The first time you input or later if you change the content, it's just plain text. If you come back ...
4
votes
1answer
316 views

SOQL: prevent SOQL injection - best practices

I have a query string that is as follows(no bulkification required)... String qryString = 'SELECT Id FROM Contact WHERE (IsDeleted = false and Name like \'%' + searchText+ '%\')'; searchText is a ...
0
votes
0answers
27 views

How can I create support organization?

How can I create support organization? I would like to create a new organization so that the regular users can grant access to the user with delegated administration.
3
votes
1answer
30 views

Schedule removal of activated login IP & activated client browsers

I want to force users to regularly go through the SMS login activation process by clearing down the activations list in Salesforce. In the Salesforce configuration menu Setup>Security ...
5
votes
1answer
30 views

Insufficient Privileges for Public Group Memberships Page

A user is a part of multiple public groups in Salesforce and has a custom profile. When the user navigates to the personal information page and clicks on the 'Go To List' link available under the ...
1
vote
1answer
25 views

Enabling edit access to fields en mass

Is there a quick and easy way of enabling edit access to all or a selection of fields for an object for a particular profile?
2
votes
1answer
97 views

Why is Transfer Record a system permission? Is there any other way to accomplish the same thing on a per-object basis?

I have a requirement to grant a set of Users the ability to transfer ownership of all records of a certain object type, regardless of current ownership. I know I can accomplish this by granting this ...
8
votes
2answers
247 views

How do I find out if a user has access to a visualforce page through apex?

So I have a VF page that calls some other VF pages based on a button click. The button will reroute to a different VF page depending on a value within a dropdown. Sometimes the logged in user will ...
4
votes
1answer
37 views

“MyClass object = (MyClass) t.newInstance()” considered harmful

I hope this turns out to be a still unknow security flaw that will be soon fixed by Salesforce.com. From code in my managed package I was able to call the constructor of a packaged class of another ...
2
votes
2answers
157 views

How to get machine id or physical machine address in Visualforce page or in Apex?

I have been consuming SAP webservices from salesforce using callout mechanism. Currently, i am sending userid in the argument to the webservice to ensure that the call is from a valid salesforce user. ...
3
votes
1answer
165 views

Ajax call on custom component: insufficient privileges

I wrote a VisualForce page that has two drop-down lists. When the user selects an item from the first list, it makes an Ajax call to populate the second list. Everything worked great. I split the ...
8
votes
1answer
116 views

Transferring ownership of triggers, workflows, etc

My org has an account that was used by a consultant to create various apex triggers and classes, workflows, visual force and other custom development. The higher ups want to disable this now unused ...
4
votes
1answer
206 views

Authenticated Website licenses obsolete?

I have a customer who has a large volume of Authenticated Website licenses, which are used to do custom Sites logins to a fully custom website. They have been told by their sales rep that Salesforce ...
0
votes
2answers
50 views

How do I secure the Nonprofit Starter Pack from the Salesforce Foundation?

So, it appears that I did not lock-down the Nonprofit Starter Pack (NPSP) from the Salesforce Foundation (SFF) as well as I should, and attempting to avoid issues like this in the future. Looking for ...
7
votes
2answers
276 views

How to set public inline images in Knowledge Base Article

Background I'm developing an standard FAQ using Knowledge Base Articles. I've defined an Article Type FAQ which contains a Rich Text field called "Answer". The FAQ articles are exposed to an ...
4
votes
2answers
73 views

Contact visibility - what controls this

I have two users who are identical in roles, profiles, and group memberships. One can see a particular contact; the other cannot. We are set up so that Accounts have default access of "Private" and ...
3
votes
1answer
84 views

Allow User's Manager to see Private records?

I currently have a custom object which is set to private in organization-wide default sharing settings. I have created an approval process to allow managers to approve private records. When the ...
0
votes
0answers
49 views

Salesforce oauth “integration user” security

I will need to make api calls to salesforce from my external java application for which I plan to use oauth. I was going through some posts which state that one could use "integration user" like Post ...
2
votes
1answer
113 views

OAuth callback through HTTP (not SSL) is possible?

In short: I need to set a Connected App to later use OAuth Web server Flow. The callback URL should be HTTP. My web server does not have a SSL certificate and I not able to get one. But SF give me ...
2
votes
2answers
107 views

Salesforce security review process

I am planning to submit my salesforce app for security review. The app also fetches some data from an external java spring based application. The external application does not make any api call back ...