The following class inserts Data in a custom object(SAPConfiguration__c),when a user enters data in a Visualforce page.

In order to rectify the Security Scanner issue(Query: FLS Create) I have added isCreateable() method(commented as "Based on Security Scanner Issue" in code).But when we install the managed Package, the code is not working properly?Data's are not getting inserted?What could be the reason?

   public with sharing class customConfig
//public transient String myValueFromPage{get; set;}
public transient String UserName{get; set;}
public transient String password{get; set;}
public transient String Url{get; set;}
public transient String Cert{get;set;}
//public ApexPages.StandardSetController User__c{get; set;}
public Pagereference sample() {
try {
/********************Based on Security Scanner Issue********************/
   /* String [] Subfield = new String [] {'Name','eSyConnector_Endpoint__c','password__c','username__c','SSL_Certificate_Name__c','SetupOwnerId'};
        Map<String,Schema.SObjectField> m = Schema.SObjectType.SAPConfiguration__c.fields.getMap();
           for (String fieldToCheck : Subfield) {
               if (!m.get(fieldToCheck).getDescribe().isCreateable()) {
                        ApexPages.addMessage(new ApexPages.Message(ApexPages.Severity.FATAL,
                                                                            'Insufficient access')); 
               for (String fieldToCheckupdate : Subfield) {
                 if (!m.get(fieldToCheckupdate).getDescribe().isUpdateable()) {
                     ApexPages.addMessage(new ApexPages.Message(ApexPages.Severity.FATAL,
                                                                            'Insufficient access')); 

/********************END Security Scanner********************/
    SAPConfiguration__c sap1=new SAPConfiguration__c();
    sap1.Name='eSy Connector Config';

    upsert sap1 Name;

} catch(Exception e) {
    //system.debug('An unexpected error has occurred: ' + e.getMessage());
 PageReference page = new PageReference('/apex/thankyou');
        return page;
  • It would make some sense to add some logic handler inside catch method. And then you will be able to see what happens
    – kurunve
    Jan 25, 2017 at 13:52
  • Or add debug statements to see what's being returned from your schema query in code.
    – crmprogdev
    Jan 25, 2017 at 14:12
  • Check if you have correct permissions in your permission set or profile to update and create on the object level and fields levels.
    – SL man
    Jan 25, 2017 at 15:46

1 Answer 1


If these fields are part of your managed package:

String[] Subfield = new String [] {'Name','eSyConnector_Endpoint__c','password__c','username__c','SSL_Certificate_Name__c','SetupOwnerId'};

then if you are using API 34.0 or later you will need to include the namespace prefix of the fields in their names.

But if the set of fields is fixed and in your managed package, you can just write the code to use the SObjectField tokens directly and side-step this problem:

SObjectField[] fields = new SObjectField[] {

 for (SObjectField f : fields) {
     if (!f.getDescribe().isCreateable()) {

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .