1

Due to Spring 2020, we now have this new setting 'View All Custom Settings' in the profile. As I understand it, if this is not checked, then users of that profile will not be able to access any Custom Settings. You need to either check this setting or manually add your custom settings to the profile.

I tried testing this via a dummy test class, but even if the 'View All Custom Settings' is not checked, users of that profile can still access the custom settings.

Try this code:

public static testMethod void testThis() {

   Custom_Setting_A__c o1 = Custom_Setting_A__c();
        o1.Name = 'test1a';
        insert o1;

   User u = [Select Id FROM User WHERE Id = 'xxx'];
   System.runAs(u) {
        List<Custom_Setting_A__c> oemList = Custom_Setting_A__c.getall().values();
        System.debug('oemList: ' + oemList.size());
   }
}

Note: User is on a profile whose 'View All Custom Settings' is not checked.

If you run the dummy test code, the user can still access 'Custom_Setting_A__c' even if 'View All Custom Settings' is unchecked.

What then is the use of 'View All Custom Settings'?

Thanks.

| improve this question | | | | |
  • does your test user profile have Customize Application permission – User6670 Feb 27 at 12:32
5

This is basically adding an object-level security layer that didn't exist. Apex can always access Custom Settings, just as it can always query any object regardless of the user's object-level permissions.

Prior to this change, users of any privilege level who had API permissions could have made REST/SOAP SOQL queries to fetch the Custom Setting values. Now they are blocked unless they have access to that specific CS or to all CS at the profile/permission level. This also affects direct access to CS from Visualforce markup and any other feature that would normally respect standard security.

If your Apex code were specifically checking for security (e.g. WITH SOQL_ENFORCED, or Security.stripInaccessible or checking isAccessible on the Object describe) then you'd be able to see the lack of access.

| improve this answer | | | | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.