I've created a managed package and I'd like to release on the Salesforce App Exchange. But if failed the security review. Salesforce gave these reasons:
-CRUD/FLS Enforcement
-CSRF
-Insecure Endpoint
-Insecure Storage of Sensitive Data
-JS not in Static Resource
-Sensitive Information in Debug
-Sensitive information in URL
This is one function, with a PageReference redirect:
public PageReference save() {
try {
if (currentSearch.Name == '') {
currentSearch.Name = 'noname';
}
if (currentSearch.Name == null) {
currentSearch.Name = 'noname';
}
if (Schema.sObjectType.PrivateIncInfo__Search__c.isCreateable()) {
insert currentSearch;
} else {
SameDayUserMessageModel.addUserMessage('Error! We were not allowed to create a Search object (track of the details of what you are searching for). Please talk to the Salesforce admin or manager at your organization, and ask for the appropriate permissions.', 'error');
}
} catch(System.DMLException e) {
String message = 'Error: we tried to save your search results, but Salesforce rejected your results: ' + e;
SameDayUserMessageModel.addUserMessage(message, 'error');
}
// After successful Save, navigate to the page that shows SearchResult__c
// objects that are children of this PrivateIncInfo__Search__c.
PageReference redirectSuccess = new PageReference('/apex/SameDaySearchResult?id=' + currentSearch.Id);
return (redirectSuccess);
}
So, are they complaining about this line?
PageReference redirectSuccess = new PageReference('/apex/SameDaySearchResult?id=' + currentSearch.Id);
Am I not allowed to have variables in the url I use with PageReference?