4

We have a community which has a lightning:fileUpload component for guests to upload anonymous file attachments to their created records. The guest user creates a new record via a global action which then takes them to a modified record detail page containing the file upload component. We accomplish this by enabling the guest user file upload checkbox and providing the record id to the file upload component.

As of this morning, Salesforce have rolled out the 'Assign Records Created by Guest Users to a Default Owner' security update, which, when enabled, blocks guest users from uploading files, even if they have the modify all permission on the custom object.

Is this a Salesforce bug which needs a case raising or intended functionality of this update as there is no mention on the update documentation (https://releasenotes.docs.salesforce.com/en-us/winter20/release-notes/rn_networks_guest_user.htm) and the enable guest file uploads still remains visible and checked. If the update is disabled, the file upload component immediately works again.

Thanks

  • 1
    If you have the update applied, then that's the intended behavior. This is what is mentioned in the docs -- [While we strongly encourage you to assign a default owner, changing record ownership can affect your guest users’ ability to access records.]. – Jayant Das Sep 11 at 13:46
  • @JayantDas Thanks for the reply, If they have 'modify all' permissions, should they not still be able to upload files to all records? – J Dubbs Sep 11 at 14:50
  • Does the profile currently have Modify All? I would imagine they can in that case. – Jayant Das Sep 11 at 17:45
  • @Javant Das: tried to set up Modify all permission to Guest user profile and sObject that file is being uploaded to, but it still doesn't solve the problem. This is really a show-stopper for us :( If you guys have any ideas, please help. *Can't comment under the main question, since i don't have 50+ reputation yet :( – Blaz Begovic Oct 8 at 12:35
  • The workarounds they have suggested in webinars involve executing the DML in a helper class that runs without sharing - is that an option here? – BritishBoyinDC Oct 8 at 12:43
3

Partner support have replied to me and provided a working solution!

Follow this tutorial https://developer.salesforce.com/blogs/developer-relations/2017/05/build-lightning-file-uploader-component.html but change the file upload apex class to 'without sharing'. Then embed the component within a flow following from the record creation passing through the new record id into the recordId attribute (I did it through a design attribute).

For now this will upload to notes & attachments rather than files but I assume a process builder or other solution could move it over if required.

Partner support does note that: ">>If you want to try this, another thing to keep in mind is the entry point of the Apex without sharing logic should be protected by some secure access code, for ex. an encrypted record id. "

0

@BritishBoyinDC no, this is not possible because we use lightning:fileUpload component and we have no control over sharing. E.g. when doccument is uploaded, contentVersion before insert and contentDocument before insert triggers are triggered - then it fails.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.