3

I can't seem to find this configuration in the User Profile settings.

2 Answers 2

4

There is no field-level security for custom settings: access to all custom settings and all the fields in those custom settings is controlled by the "Customize Application" permission.

You can give access to the settings for "Customize Application" users of the installed package via the default "Manage" UI by choosing "public" rather than the default "protected" visibility when you create the settings.

If you do want to introduce field-level security you will have to build that yourself by adding Visualforce/Apex on top of the "protected" custom settings.

2
  • Ok thanks for ur reply. I failed the security review due to an apex class which exposes CRUD to a protected managed package custom setting. Any idea why ? Do we need to check whether a user has Customize Application permission before executing the CRUD operation?
    – ben
    Mar 15, 2016 at 9:12
  • @ben As exactly what the purpose of the setting is is up to you the managed package creator and you can add the page to specific profiles as needed that seems weird. I suggest you ask them for a more detail explanation of what the problem is and what they want you to do to fix it. (Fyi, there is a PermissionsCustomizeApplication field on Profile.)
    – Keith C
    Mar 15, 2016 at 9:46
3

We cannot do field level security or sharing with Custom Settings. Public custom settings can be read by everyone. (and apex code can) and protected custom settings and its a managed package, then no one can read the setting (but Apex code running within the namespace can).

Profiles with Customize Application permission can modify a public custom setting. No one can modify a protected custom setting.

For custom settings, apex code within the same namespace will always be able to access them for both read and write. It doesn't matter if the code is with or without sharing (as sharing has nothing to do with custom settings).

1
  • Hi, @Venkat, that's a very interesting answer. In particular, "haring has nothing to do with custom settings". Do you have a source for this in the SF documentation, please? Thanks
    – mkorman
    Mar 14, 2016 at 12:36

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .