3

Submitted our package security review few days ago and received the following message from Salesforce

Object (CRUD) and Field Level Security (FLS) are configured on profiles and can be used to restrict access on object types and individual fields. Force.com developers should design their applications to enforce the organization's CRUD and FLS settings, and to gracefully degrade if a user's access has been restricted. For more information, please review the documentation for CRUD and FLS on the DeveloperForce Wiki.

ApprovalDecisionCtrl.cls

Scanning File: L:\GovGrants 2.0\04t360000019l18AAA\classes\ApprovalDecisionCtrl.cls
59  approvalDecisionActionConfigList  =  [select ActionLabelOverride__c,Action__c, CommentsFieldsAPIName__c, CommentsRequired__c,HideAction__c, FilterCriteriaforUserReassign__c,SobjectConfig__r.ApprovalReCallEnable__c, SobjectConfig__r.ApprovalReCallFieldAPIName__c,SobjectConfig__r.ApprovalReCallCommentFieldAPIName__c FROM ApprovalDecisionActionConfig__c where SobjectConfig__r.Name =:SFDCEncoder.SFDC_JSENCODE(parentSObject.objectName) and CustomAppConfig__r.Name=:customAppName order by Sequence__c];
204 String query = 'select ' + SFDCEncoder.SFDC_JSENCODE(approvalDecisionActionConfig.SobjectConfig__r. ApprovalReCallFieldAPIName__c) + ' from ' + SFDCEncoder.SFDC_JSENCODE(objectName) + ' where Id=\'' + SFDCEncoder.SFDC_JSENCODE(recordId) + '\''; 
260 taskAction = [SELECT PostDecisionPage__c FROM TaskConfig__c WHERE TaskAction__c=:approvalTaskList.get(0).TaskAction__c AND GroupType__c = 'GroupTasks'];
266 taskActionList = [SELECT PostDecisionPage__c FROM TaskConfig__c WHERE TaskAction__c=:approvalTaskList.get(0).TaskAction__c AND GroupType__c = 'MyTasks'];
489 List<SObjectConfig__c> sobjConfigs = [select ApprovalReCallFieldAPIName__c,ApprovalReCallCommentFieldAPIName__c from SObjectConfig__c where Name=:objectName and ApprovalReCallEnable__c=true];
534 String soql = 'Select Id ' +SFDCEncoder.SFDC_JSENCODE(ownerField+ commentsFieldAPINameQuery)  + ' from ' + SFDCEncoder.SFDC_JSENCODE(AppUtils.removeNamespacePrefix(objectName)) +
547 List<SobjectConfig__c> sobjects = [select ApprovalPDFConditionAPIName__c,ApprovalSnapshotFileName__c,CaptureSnapshotonApproval__c
560 String query = 'select id '+SFDCEncoder.SFDC_JSENCODE(pdfConditionAPIName)+ ' from '+ String.valueOf(recordId.getSobjectType()) + ' where Id =:recordId';

AppUtils.cls

Scanning File: L:\GovGrants 2.0\04t360000019l18AAA\classes\AppUtils.cls
288 String query = 'select ' + AppUtils.concatenate(userFields,',') + ' from User where id =:userId';
377 String query = 'select ' + AppUtils.concatenate(mergeFields, ', ') + ' from ' + objectType + ' where id =:recordId';

AttachmentUtils.cls

Scanning File: L:\GovGrants 2.0\04t360000019l18AAA\classes\AttachmentUtils.cls
82 String query = 'Select AttachmentName__c from SobjectConfig__c where Name =:objectName';

BusinessRuleConfigHelper.cls

Scanning File: L:\GovGrants 2.0\04t360000019l18AAA\classes\BusinessRuleConfigHelper.cls
46 List<LayoutBusinessRuleConfig__c> businessRule =  [select ClassName__c,Expression__c,ErrorMessage__c from LayoutBusinessRuleConfig__c where PageLayoutConfig__c =: holder.layoutId and PageLayoutActionConfig__c = null and active__c = true and RecordTypeId in :recordType];
59 List<LayoutBusinessRuleConfig__c> businessRule =  [select ClassName__c,Expression__c,ErrorMessage__c from LayoutBusinessRuleConfig__c

DynamicLayoutController.cls

Scanning File: L:\GovGrants 2.0\04t360000019l18AAA\classes\DynamicLayoutController.cls
477 List<SObjectConfig__c> sobjConfigList = [Select Name,isAutoCreated__c From SObjectConfig__c Where Name =:objName AND isAutoCreated__c=true];
479 String query = 'Select id,Name,CreatedDate,LastModifiedDate FROM '+objName+' Where id=\''+rcrdId+'\'';
517 PageLayoutConfig__c page = [Select id, ParentLayout__r.OverrideCreateClass__c From PageLayoutConfig__c Where Id = :pgLayoutId];
566 Package__c packageObj  = [select id,name,PageTemplateConfig__r.Name from Package__c where Id=:pkgId];
570 List<PackageFormConfig__c> lytList = [SELECT FormConfig__c FROM PackageFormConfig__c WHERE PackageConfig__c =: pkgId]; 
574 List<Package__c> packages  = [select id,name,PageTemplateConfig__r.Name from Package__c where Name=:pkgName];
604 packageObj = [SELECT Id, Name,PageTemplateConfig__c,ValidateFormFieldAPIName__c, (SELECT FormConfig__r.Name,FormConfig__r.DisplayName__c,FormConfig__r.Id,FormConfig__r.OMBNumber__c,FormConfig__r.Version__c,Order__c FROM PackageFormsConfig__r order By Order__c )  FROM Package__c WHERE Id=: pkgId];
607 packageObj = [SELECT Id, Name,PageTemplateConfig__c,ValidateFormFieldAPIName__c, (SELECT FormConfig__r.Name,FormConfig__r.DisplayName__c,FormConfig__r.Id,FormConfig__r.OMBNumber__c,FormConfig__r.Version__c,Order__c FROM PackageFormsConfig__r where FormConfig__r.FormType__c in:formTypeList order By Order__c )  FROM Package__c WHERE Id=: pkgId];
2
  • 2
    Hi user36368, welcome to SFSE! Please take the time to visit the Help center and read How do I ask a good question. Have you read the WIKI they referred you to? If so, please tell us what your actual question is. Right now, it's unclear what exactly you're having difficulty understanding about the results from the security scanner and your code. All we see is a "code dump".
    – crmprogdev
    Aug 12 '16 at 14:39
  • 1
    @user36368. Thanks for letting us know you got the file. Glad that feature appears to be working. However, this is a question and answer forum and SF does not monitor so no one will receive the notification that you got the file. Cheers. (All in jest) - See Kieth's answer below and crmprogdev's comment above
    – Eric
    Aug 12 '16 at 14:44
7

I assume you are asking what you need to do about this item flagged in the security review.

Apex code - such as a controller - does not automatically respect the CRUD settings of the user's profile. You have to add explicit code that checks attributes such as isAccessible and isCreatable from the DescribeSObjectResult API. The aim is to get your Visualforce page to automatically adapt just as layout-based UI automatically adapts.

Note that field-level access rights are are automatically respected by the apex:inputField Visualforce tag. But if you construct your own editing by some other means (or just update fields in your internal logic), you should also respect the similar flags in the DescribeFieldResult data for each field.

A quick Google gets you this detailed article Enforcing CRUD and FLS.

Not the answer you're looking for? Browse other questions tagged or ask your own question.