7

We have a community which has a lightning:fileUpload component for guests to upload anonymous file attachments to their created records. The guest user creates a new record via a global action which then takes them to a modified record detail page containing the file upload component. We accomplish this by enabling the guest user file upload checkbox and providing the record id to the file upload component.

As of this morning, Salesforce have rolled out the 'Assign Records Created by Guest Users to a Default Owner' security update, which, when enabled, blocks guest users from uploading files, even if they have the modify all permission on the custom object.

Is this a Salesforce bug which needs a case raising or intended functionality of this update as there is no mention on the update documentation (https://releasenotes.docs.salesforce.com/en-us/winter20/release-notes/rn_networks_guest_user.htm) and the enable guest file uploads still remains visible and checked. If the update is disabled, the file upload component immediately works again.

Thanks

Improve this question
6
  • 1
    If you have the update applied, then that's the intended behavior. This is what is mentioned in the docs -- [While we strongly encourage you to assign a default owner, changing record ownership can affect your guest users’ ability to access records.].
    – Jayant Das
    Commented Sep 11, 2019 at 13:46
  • @JayantDas Thanks for the reply, If they have 'modify all' permissions, should they not still be able to upload files to all records?
    – J Dubbs
    Commented Sep 11, 2019 at 14:50
  • Does the profile currently have Modify All? I would imagine they can in that case.
    – Jayant Das
    Commented Sep 11, 2019 at 17:45
  • @Javant Das: tried to set up Modify all permission to Guest user profile and sObject that file is being uploaded to, but it still doesn't solve the problem. This is really a show-stopper for us :( If you guys have any ideas, please help. *Can't comment under the main question, since i don't have 50+ reputation yet :(
    – Blaz Begovic
    Commented Oct 8, 2019 at 12:35
  • The workarounds they have suggested in webinars involve executing the DML in a helper class that runs without sharing - is that an option here?
    – BritishBoyinDC
    Commented Oct 8, 2019 at 12:43

4 Answers 4

Reset to default
3

Partner support have replied to me and provided a working solution!

Follow this tutorial https://developer.salesforce.com/blogs/developer-relations/2017/05/build-lightning-file-uploader-component.html but change the file upload apex class to 'without sharing'. Then embed the component within a flow following from the record creation passing through the new record id into the recordId attribute (I did it through a design attribute).

For now this will upload to notes & attachments rather than files but I assume a process builder or other solution could move it over if required.

Partner support does note that: ">>If you want to try this, another thing to keep in mind is the entry point of the Apex without sharing logic should be protected by some secure access code, for ex. an encrypted record id. "

Improve this answer
2
1

I'm glad to announce that this issue is now solved in Spring '20 patch 7.0. Please check it out here: https://success.salesforce.com/issues_view?id=a1p3A000001YnzNQAS

Improve this answer
0

@BritishBoyinDC no, this is not possible because we use lightning:fileUpload component and we have no control over sharing. E.g. when doccument is uploaded, contentVersion before insert and contentDocument before insert triggers are triggered - then it fails.

Improve this answer
0

I have the lwc file-upload working for guest users:

  1. Make sure the Salesforce Files > General Settings > Guest users can upload files - is enabled
  2. Make sure they have at least read access to the object they are attaching the file to
  3. Make sure they have sharing access to the record they are attaching the file to, or its parent (master detail) - guest sharing rule required
  4. Make sure they have read access to the default owner user record as it will try to reassign owner as specified in the community workspace > preferences

Using a without sharing class, I have been able to allow deletion of the files they upload if they make a mistake, however trying to update the file after the upload is successful results in an error?

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .