Per a security review, we've found that the use of transient keyword is required to store variables within custom settings. There's a great link that's been provided to help us get pointed in the right direction, which we've followed...
http://wiki.developerforce.com/page/Secure_Coding_Storing_Secrets
Under the Custom Settings section, the wiki page says...
In order to allow authorized users to create and update sensitive information, create a Visualforce page that only accepts input and does not render the value back on the page. The “transient” keyword should be used to declare instance variables within Visualforce controllers to ensure they are not transmitted as part of the view state. Please refer to the following link for details: http://www.salesforce.com/us/developer/docs/apexcode/Content/apex_classes_keywords_transient.htm.
Awesome, that sounds like it's not too bad. So, we poked around, and created this VF page and controller.
Controller
public with sharing class TestCustomSettings {
public Transient TestR__c myPref {get;set;}
public TestCustomSettings(){
myPref = TestR__c.getvalues(System.UserInfo.getOrganizationId());
if(myPref == null)
myPref = new TestR__c(setupOwnerId = System.Userinfo.getOrganizationId());
}
public PageReference save() {
if(myPref.id == null){
insert myPref;
} else
update myPref;
return null;
}
}
VF Page
<apex:page controller="TestCustomSettings" title="Test Custom Settings Title">
<h1>Test Custom Setting</h1>
<apex:form >
<apex:pageBlock title="Edit Preferences" mode="edit">
<apex:pageBlockButtons location="bottom">
<apex:commandButton action="{!save}" value="Save"/>
</apex:pageBlockButtons>
<apex:pageBlockSection title="Change my preferences" columns="2">
<apex:inputField value="{!myPref.Password1__c}"/>
<apex:inputField value="{!myPref.Password2__c}"/>
</apex:pageBlockSection>
</apex:pageBlock>
</apex:form>
</apex:page>`
Unfortunately, whenever the form is saved, we receive the following error message:
"Attempt to de-reference a null object Error is in expression '{!save}' in component in page testcustomsettings"
Any thoughts as to how we can follow the requirements for using the transient keyword but still get this to work properly?