2

I have a situation where community user can edit the URL and access standard Salesforce record page by using the query parameters. I want to control it. This is somewhat related to the discussion on here but my scenario is between Lightning Community and Lightning Experience Salesforce UI. For example my community page URL is => https://communityURL/s/view-activity?c__activityId=a07r00000021c3YAAQ. A smart portal user can easily copy the record Id query param and modify the URL to https://communityURL/s/a07r00000021c3YAAQ. This opens up a standard record page for the user.

In VF/classic we used to assign a Home page layout with a redirect URL vf page to the user so as soon as they access any internal record, they get redirected. Any idea on how to handle this in Lightning?

3
  • If you give the users the appropriate licenses or permissions in Profile and Permission Sets, then it would not make a difference on how the users access the data, would it? Aug 22, 2019 at 11:49
  • It would, access is controlled through Sharing Sets. A contact had read/edit access to their records as configured in Sharing set. But I don't want the user to edit a record at certain point of time. Let's say they submitted an application for review and it is under review. I wouldn't want them accessing the record and edit the info while its under processing. But I can control that through access/sharing. Does that makes sense?
    – malu
    Aug 22, 2019 at 15:30
  • You can check in your doInit handler on the component whether or not to disable the input fields on your form based on the status of the application or any other type of check you'd like. If you invoke the hasRecordId interface in your component, you can use the force:recordData to grab any fields you want to check on your doInit function. I would need a bit more information on how the pages are being rendered in order to further assist. But this seems like a logical way to restrict access by "state/stage", while still giving read permissions to the records. Feb 21, 2020 at 19:31

3 Answers 3

1
+50

I would recommend you not to expose salesforce record Id on the community URL directly, which will make your application vulnerable.

Looking at your example I believe view-activity is a custom community page hosting some custom component.

Here are few recommendations that might help-

  • Use atob and btoa base 64 encoding options and sanitize the url, so that the record ID will not be directly exposed.
  • On your custom component init() you can put some logic for atob and btoa encoding to retrieve the actual ID back.

for example :

btoa('a07r00000021c3YAAQ'); -> YTA3cjAwMDAwMDIxYzNZQUFR
atob('YTA3cjAwMDAwMDIxYzNZQUFR') -> a07r00000021c3YAAQ
  • On top of this you can have a client side check as @Jake Richter has already mentioned to his answer.
1
  • Salesforce's standard pages expose the record IDs and it seems a bit excessive to write custom components to avoid that
    – brezotom
    Feb 27, 2020 at 20:36
1

In the Experience Builder, there's a page called, "Record Detail". Drop a custom lightning component anywhere on that page that will redirect your users where you want them to go. You'd use the init handler on an Aura component or connectedCallback in an lwc.

A down and dirty Aura component could look like this.

myRecordRedirect.cmp:

<aura:component implements="forceCommunity:availableForAllPageTypes, force:hasRecordId" >
    <aura:handler name="init" value="{!this}" action="{!c.doInit}" />
</aura:component>

myRecordRedirectController.js


doInit: function(cmp, evt, helper) {
  const recordId = component.get('v.recordId');
  // some logic to only do this for specific object types
  if (recordId.startsWith('a07') {
    window.location.href = 'https://communityURL/s/view-activity?c__activityId=' + recordId;
  }
}

For an lwc, you'd do something similar, but you'd leverage the connectedCallback.

6
  • Thanks! any ideas on redirecting from record list page as well?
    – malu
    Feb 21, 2020 at 17:54
  • @malu Same idea. Drop a similar component on the Record List page. Feb 21, 2020 at 17:57
  • I see options only to create/edit record, home and app pages. I dont see a record list page.
    – malu
    Feb 21, 2020 at 18:03
  • Here's what I'm referring to: i.imgur.com/kr1OB1h.png Feb 21, 2020 at 18:06
  • 2
    Any solution using javascript can be bypassed by a smart user.
    – Jeff
    Feb 24, 2020 at 19:38
0

You should be able to define a page layout that has VF section that redirects to your home page when the page is loaded. This should still work in Lightning/Communities as it would display the VF in an iFrame. Then you just assign that layout to your community users.

3
  • If I hack the URL to 001, it will still display all my accounts and I will be able to edit it as a community user. Any thoughts on that?
    – malu
    Feb 20, 2020 at 17:37
  • For the list page, you should be able to hide your existing list views from community users and only give them a list view which has filters that hide all accounts (Filter it with something like createddate = null or something that would never be true)
    – brezotom
    Feb 21, 2020 at 2:34
  • 1
    @malu If you're doing this as a security measure please keep in mind that any JavaScript based redirect is client side and can therefor be stopped by the customer.
    – Kasper
    Feb 22, 2020 at 1:05

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .