I have custom Setting (Hierarchy) Type with api name Test__c. in my custom setting I have one boolean field "View__c" I am using it in my custom apex controller and visual force page.

In my visual force page I allow user to choose true or false and call the apex method to upsert the setting for the current login user. its work fine with system administrator profile but when I try to login with custom profile It doesn't work because of salesforce code scanner I ensure the "Enforcing Object and Field Permissions".

is there any permission or point I need to do for custom profile?

Note: if I remove the condition if(objDesc.isUpdateable()) its work fine for custom profile but i have to use it because of sale force scanner report.


public with sharing class customController{

// custom setting to keep user Can View value

    public Test__c testSetting {

    public boolean userCanView{get;set;}

    public  customController(){
     testSetting = Test__c.getInstance(); 

      if(NULL != testSetting.View__c ){                     
            userCanView= testSetting.View__c; 
        }else {        
            userCanView =false;

    public void changeUserSetting(){
        Schema.sObjectType objType = Schema.getGlobalDescribe().get('Test__c');
        Schema.DescribeSObjectResult objDesc = objType.getDescribe();
         //check the permission user can update the custom setting   
        if(objDesc.isUpdateable())   {            
             testSetting.View__c = userCanView; 
        upsert  testSetting;

  • 3
    Custom settings records cannot have security explicitly set on them or their fields. If you choose to expose them to users, those users need the "Customize Application" permission to modify the records or you need to interact with the Custom Setting records via a custom apex class which you then use in your VF page to read & write the data. Are you trying to address something specific for a Security Review scan of your application?
    – Mark Pond
    Jun 13, 2018 at 3:13

1 Answer 1


As @MarkPond has commented Custom settings require "Customize application" permission to perform operations in them.

You can perform below query to check if current user has customize application permission or not.

Select Id from PermissionSetAssignment where AssigneeId = :userinfo.getuserid()
    and PermissionSet.PermissionsCustomizeApplication = true

After applying this check there is no need to apply CRUD checks for custom settings.

Also for issue shown in salesforce code scanner you can submit a false-positive report for custom setting related issue. Which says that you have applied proper permission check for custom setting but scanner is not detecting that.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .