I have a web booking form that was working on Friday and today it isn't. It stopped displaying the fields from the Product object.
There aren't any errors in the VF or the Console. Does this sound like there has been an update to the org? How can I find out what has changed?
Thank you.
There was a critical update on October 5th, 2018 to address a security vulnerability related to unauthenticated guest users. This critical update proactively limited the default permissions given to unauthenticated guest users, so if you have functionality in a Salesforce Site or Community that relied on the previously broader permissions, you will be impacted. Further detail here: https://help.salesforce.com/articleView?id=000273124&language=en_US&type=1
On September 22, 2018, the Salesforce Security team began assisting customers in investigating issues they were having with guest user access. (Guest users are unauthenticated users. Authenticated portal and community users are not guest users and were not affected by this issue.)
On October 1, 2018, the Security team determined that the issues were related to default guest user permissions in Salesforce Sites and Communities that could have potentially allowed unauthenticated guest users to retrieve information in Salesforce records including, but not limited to, the Account and Contact objects.
No other Salesforce services have been impacted by this vulnerability.
On October 3, 2018, the Salesforce Technology team took the following actions to remediate the vulnerability:
Implemented a software fix to block guest user access to Salesforce object list views on Sites and Communities. Because of that update, a guest user will now be directed to an authorized login page or receive an “insufficient access” error message.
For Sites or Communities created after October 3, the Salesforce Technology team updated the process for site and community creation to ensure new guest user profiles default to more limited permissions.
For Sites or Communities created before October 3, 2018, the Salesforce Technology team proactively revoked the standard guest user permissions that were granted by default when the Sites or Communities were created. Those permissions were revoked on October 5, 2018 when the critical update “Restrict Record Access for Guest Users” was pushed to all customers.
Because we revoked those permissions, some customers may experience some functional issues within their Sites or Communities. We recommend you review and acknowledge the critical update “Restrict Record Access for Guest Users,” then review your guest users’ access rights via the Public Access Settings on the Site Detail Page or the Guest User Profile settings on the Community Builder of each site in your org. In particular, we recommend reviewing each guest user profile’s “Standard Object Permissions” to ensure access is not granted in error. While some admins may have set these permissions on purpose, we want them to understand the risk associated with using these settings.
We also advise that you read the Public Access settings for Salesforce Sites article regarding the use of private external user sharing for the objects you are granting at least read access to. To improve visibility into object permissions for guest users, we added guest user information to Portal Health Check reports.
Our investigation is ongoing, and we will continue to monitor the issue and provide updates as appropriate.
We apologize for any inconvenience you have experienced as a result of this issue.
