I have a simple lightning component that tests that encrypted fields are not checked against for security before returning to the UI. This means that users without the View Encrypted Data permission can view encrypted data if the check is not performed in custom lightning components. I have opened a case with Salesforce regarding this issue.
To reproduce:
Create an encrypted field on the Opportunity object called "Test Encrypted" with a length of 175 characters, mask all characters with "X".
Enter encrypted data in the lightning UI and see that it is encrypted and masked on the opportunity.
Create a custom component with the following code:
Lightning Component - Named "Encrypted field":
<aura:component implements="flexipage:availableForAllPageTypes,force:hasRecordId,force:hasSobjectName" controller="encryptedField">
<aura:handler name="init" value="{!this}" action="{!c.doInit}"/>
<aura:attribute name="Opportunity" type="Opportunity" />
<ui:outputText value="{!v.Opportunity.Test_Encrypted__c}" />
Lightning Component Controller:
({
doInit: function(component, event, helper) {
var action = component.get("c.getEncryptedField");
var recId = component.get("v.recordId");
action.setParams({"recId" : recId});
action.setCallback(this, function(response) {
var state = response.getState();
if (component.isValid() && state === "SUCCESS") {
var retVal = response.getReturnValue();
component.set("v.Opportunity", retVal);
} else {
console.log("Failed with state: " + state);
}
});
$A.enqueueAction(action);
},
})
Apex Controller:
public class encryptedField {
@AuraEnabled
public static Opportunity getEncryptedField(String recId){
return [SELECT Id, Test_Encrypted__c
FROM Opportunity
WHERE Id = :recId];
}
}