1

We currently have several communities connected to our site domain, and one of the pages that we make publicly available is supposed to let end users edit a record when given a very specific link. However, I am finding now that our Sandbox environment has been updated to the new Experiences instead of Communities, I'm no longer able to enable "Edit" access on the given object for the Guest User Profile from the Force.com site page settings.

Can anyone shed light on what the solution is to ensure end users are still able to edit records on a public Force.com site page even with the new "Experience" changes?

Improve this question

1 Answer 1

Reset to default
2

This is a recent security enforcement part of the Spring 21 release. You can read more about this here.

Salesforce is removing the View All, Modify All, edit, and delete object permissions on all objects for guest users in new and existing orgs. These permissions are removed for custom objects and standard objects. Guest users can only have read and create object permissions.

So what are your options?

  1. Create a Lighnting Web Component or Visualforce or Aura Component with Apex Controller running apex class in Without sharing mode. You will need a class like below

    public without sharing Controller {

    }

With this approach, you have to be really careful in exposing what you want guest users to edit.

  1. Use a solution like Heroku to build your guest user experience and has an integration using an Open source library like jsforce with Salesforce to sync data in authenticated manner.
Improve this answer
3
  • 4
    Basically - SF does not want you to assign broad permissions to the Guest user profiles anymore because they are not actual identifiable users, they are the entire public. Instead your code should apply the correct business logic to determine when it is OK for code running as a guest to edit org data. That logic will depend totally on your use case.
    – Charles T
    Commented Feb 13, 2021 at 5:39
  • It seems very strange to me that they would be able to Create records but not edit them. I would think if they wanted to lock things down to the public they would only allow View access. This poses a number of problems for our business users, but perhaps the without sharing method is our solution - I will have to dig more into this to see how I can use this to surface fields in a public page.
    – BranHolm
    Commented Feb 13, 2021 at 7:56
  • Being entirely cynical, I would say a big part of the motivation for Salesforce here is to discourage free access to Salesforce resources and to push everyone to license based usage.
    – Phil W
    Commented Feb 13, 2021 at 9:51

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .