2

I created two objects ObjectVisible and ObjectHide. ObjectVisible has lookup fields to ObjectHide. I set the OWD as follows: ObjectVisible: Public Read, ObjectHide: Private

I used custom code to share ObjectHide by creating records in ObjectHide__share table. I added the ObjectVisible to standard Accounts page layout.

The issue is, users that don't have access to the ObjectHide record can see the field values through the ObjectVisible related list on the Account page.

Is this expected? or some sort of a loophole in object level security? Is there anything else I need to set to enforce the field level security of ObjectHide when it's viewed through the related list of ObjectVisible?

Example: UserA has access to an ObjectHidden record, UserB doesn't. Both users have access to ObjectVisible record that has lookup fields to ObjectHidden record. ObjectVisible related list is on the standard Account page. Both users are able to see the contents of ObjectVisible related list, including the values in the lookup fields pointing to ObjectHidden (I expected UserB not to be able to see the values). When UserA clicks on an item in the related list pointing to the HiddenObject record, it loads the details of the HiddenObject record, but when UserB clicks it, it display insufficient privileges (good thing). The problem is why is UserB able to see the HiddenObject values through the VisibleObject related list?

Improve this question
6
  • Is this a standard page layout or visualforce?
    – PepeFloyd
    Commented Nov 24, 2014 at 21:45
  • Standard page layout.
    – JJCoolJ
    Commented Nov 24, 2014 at 22:04
  • 1
    The users are getting access in another way, what you are describing is not expected and I have never seen it behaving like that. Use the sharing button on one of those records that should be hidden and find out how are those users getting access. They are either getting access due to having access to a parent record, or they have a permission in their profile such as View All or Modify All.
    – PepeFloyd
    Commented Nov 24, 2014 at 22:20
  • Hi Pepe, I check the profiles and they don't have View All/Modify All checked. Also, There's no Master-Detail relationship on the ObjectHidden so it's not inheriting the access permissions from a parent Object. I also checked the Roles for the users I'm using to test and they are all in the same Role so the inherit using role hierarchy is also not the culprit here.
    – JJCoolJ
    Commented Nov 25, 2014 at 14:42
  • 1
    Are you able to use the Sharing button on one of the records to identify why the user has access?
    – PepeFloyd
    Commented Nov 25, 2014 at 14:59

1 Answer 1

Reset to default
0

I found out what the issue is. The ObjectVisible lookup field to the ObjectHidden was being populated using an external integration. The external intergration used Dataloader to populate the fields and it was signing in as a user with a profile that had access to all data enabled.

Improve this answer
1
  • Please mark this as the correct answer so it does not keep getting bumped by the bots
    – Eric
    Commented Nov 27, 2014 at 20:12

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .