Custom setting Enforcing Object and Field Permissions for custom profile

Question

I have custom Setting (Hierarchy) Type with api name Test__c. in my custom setting I have one boolean field "View__c" I am using it in my custom apex controller and visual force page.

In my visual force page I allow user to choose true or false and call the apex method to upsert the setting for the current login user. its work fine with system administrator profile but when I try to login with custom profile It doesn't work because of salesforce code scanner I ensure the "Enforcing Object and Field Permissions".

is there any permission or point I need to do for custom profile?

Note: if I remove the condition if(objDesc.isUpdateable()) its work fine for custom profile but i have to use it because of sale force scanner report.

Code:

public with sharing class customController{

// custom setting to keep user Can View value

    public Test__c testSetting {
        get;
        set;
    } 

    public boolean userCanView{get;set;}

    public  customController(){
     testSetting = Test__c.getInstance(); 

      if(NULL != testSetting.View__c ){                     
            userCanView= testSetting.View__c; 
        }else {        
            userCanView =false;
        }
    }

    public void changeUserSetting(){
        Schema.sObjectType objType = Schema.getGlobalDescribe().get('Test__c');
        Schema.DescribeSObjectResult objDesc = objType.getDescribe();
         //check the permission user can update the custom setting   
        if(objDesc.isUpdateable())   {            
             testSetting.View__c = userCanView; 
        }
        upsert  testSetting;

    }       
}

Answer 1

As @MarkPond has commented Custom settings require "Customize application" permission to perform operations in them.

You can perform below query to check if current user has customize application permission or not.

Select Id from PermissionSetAssignment where AssigneeId = :userinfo.getuserid()
    and PermissionSet.PermissionsCustomizeApplication = true

After applying this check there is no need to apply CRUD checks for custom settings.

Also for issue shown in salesforce code scanner you can submit a false-positive report for custom setting related issue. Which says that you have applied proper permission check for custom setting but scanner is not detecting that.