2

Question

Is it true the field level security of a field used in the criteria for a list view is ignored? Or is this a bug?

Background

I created a new formula field that's true if a user lookup on the a record matches the current user and then used this to create a list view. However when I logged in as a user who didn't have visibility to that field the filter wasn't applied. Making the field visible to their profile fixed the issues.

Have I been drinking crazy juice and this is expected behavior or is this a bug?

1 Answer 1

3

Your user naturally has access to all of these records (presumably) and you're using the formula field to narrow the scope of the record display a bit more... (correct?)

So, the list view rather than showing zero records (because of the FLS + filter criteria) falls back to showing the user what they can see, which is an unfiltered list.

6
  • So you're saying it's intended behavior that salesforce just skips any criteria that use fields the running user doesn't have visibility to? Sep 11, 2013 at 22:23
  • 1
    Yes. From a security perspective this is the correct approach. Imagine if the filter criteria was instead Employees WHERE Salary > $200,000 - you may not have granted the running user with the ability to see employee salaries but that information could be gleaned from the results.
    – Mark Pond
    Sep 11, 2013 at 22:27
  • On a related note, the same feature regarding FLS and record filtering applies to reports and dashboards as well. I was surprised the first time I encountered this, but as @MarkPond explained the security model makes sense.
    – Marty C.
    Sep 11, 2013 at 22:31
  • That's a good point about the salary, but in most of these cases I feel like the sharing model of the person creating the list view/report should apply. From my perspective a lot of fields used for filtering fall into the "system" category and it would be a lot simpler for end users if they never knew they existed. Sep 12, 2013 at 15:41
  • Initially it looked weird but now it make sense. However do we have any official documentation or response from SFDC on this?
    – byadav
    Jun 22, 2015 at 13:42

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .