1

I recently had an app fail the security review because I didn't check CRUS/FLS permissions for dynamic SOQL queries.

To "fix", I've created a few functions that check the appropriate permission for the object / fields of these queries and throw an exception when there isn't permission.

I'm running previously working unit tests and have found that some of them are failing with the exception thrown by these checks. I've resolved them by changing the FLS from hidden to visible in my dev org.

Do I need to make sure the same permissions exist in a managed package? I know the user is prompted during install to select which profiles the package should be visible to, but I don't think fls are set when this happens (it looks like they default to hidden). Will this cause permission checks to return false?

If I do change the visibility of fields, would they show up in page layouts automatically (I have a few custom fields in Opportunity for example - I don't want this to happen)?

2

Security reviews and CRUD/FLS permissions can be a bit of a pain.

You mention:

To "fix", I've created a few functions that check the appropriate permission for the object / fields of these queries and throw an exception when there isn't permission.

These are called DML managers, and there are some publicly-available open source ones (like this one). But there's nothing wrong with creating your own.

Permissions to fields can be granted by showing/hiding them in some editions (not quite sure how it works) or via FLS settings in profiles. The thing is, you cannot control what a permissions a SF admin will set up.

You can make their lives easier by creating permissions sets to grant access to the objects and fields your classes need. You can then document those permissions sets and tell your customers' SF admins to apply those permission sets to the users that are going to use your app.

Hope it helps!

  • Is there another way to do this without custom permissions (without user intervention?) I have Nonprofit starter pack installed and I see that it has objects whose custom fields have their field access set, but there aren't any custom permissions on the org. – Dan Bough Jan 21 '16 at 20:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.