2

Question

Is it true the field level security of a field used in the criteria for a list view is ignored? Or is this a bug?

Background

I created a new formula field that's true if a user lookup on the a record matches the current user and then used this to create a list view. However when I logged in as a user who didn't have visibility to that field the filter wasn't applied. Making the field visible to their profile fixed the issues.

Have I been drinking crazy juice and this is expected behavior or is this a bug?

Improve this question
3

Your user naturally has access to all of these records (presumably) and you're using the formula field to narrow the scope of the record display a bit more... (correct?)

So, the list view rather than showing zero records (because of the FLS + filter criteria) falls back to showing the user what they can see, which is an unfiltered list.

Improve this answer
6
  • So you're saying it's intended behavior that salesforce just skips any criteria that use fields the running user doesn't have visibility to? – Ralph Callaway Sep 11 '13 at 22:23
  • 1
    Yes. From a security perspective this is the correct approach. Imagine if the filter criteria was instead Employees WHERE Salary > $200,000 - you may not have granted the running user with the ability to see employee salaries but that information could be gleaned from the results. – Mark Pond Sep 11 '13 at 22:27
  • On a related note, the same feature regarding FLS and record filtering applies to reports and dashboards as well. I was surprised the first time I encountered this, but as @MarkPond explained the security model makes sense. – Marty C. Sep 11 '13 at 22:31
  • That's a good point about the salary, but in most of these cases I feel like the sharing model of the person creating the list view/report should apply. From my perspective a lot of fields used for filtering fall into the "system" category and it would be a lot simpler for end users if they never knew they existed. – Ralph Callaway Sep 12 '13 at 15:41
  • Initially it looked weird but now it make sense. However do we have any official documentation or response from SFDC on this? – Bhupendra Yadav Jun 22 '15 at 13:42

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.