0

We have an object, call it MainObject__c that is a master object. There are several other objects with a Master-Detail relationship to it. This is a given and cannot be changed.

One of those objects, Request__c, is available for editing to a small subset of Community users. They have their own Profile and Permission Set.
Among the things they are allowed to edit are files. They can upload and delete files on the Request__c object.

Each user is only allowed to access one or more specific Request__c records. We control this on the frontend via our Angular app, and in the backend via trigger checks on records.
This works well.

What doesn't work so well is the fact that a user can view files uploaded to Request__c records to which they have no access. For example:
Alice will upload a file to a Request__c record to which she has access.
Alice can view this file, and download it via a link like

https://instance.force.com/sfc/servlet.shepherd/document/download/069XXXXXXXXXXXXXXX

Alice can email that link to Bob, who does not have access to Alice's Request__c record, and yet he can download the file she uploaded.

This is a big no-no and we would like to prevent it.
Ideally I'd like to find a way to allow per record sharing access on Request__c object, but I fear that may not be possible due to its Master-Detail relationship and being controlled by parent.

Another possible solution would be to block the download in Apex from an unauthorized user. But I have no idea how (or even if) that can be done.

0

The solution we eventually implemented involved changing the schema of our org.
We created a new object SecureRequest__c instead of Request__c.
SecureRequest__c has a Lookup to MainObject__c instead of Master-Detail.
All other fields are identical (yes, API Name as well), and so we were able to (mostly) continue using existing code with just a few modifications.

This allowed us to define new sharing settings and rules for SecureRequest__c, and thus prevent unwanted file access.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.