2

I created two objects ObjectVisible and ObjectHide. ObjectVisible has lookup fields to ObjectHide. I set the OWD as follows: ObjectVisible: Public Read, ObjectHide: Private

I used custom code to share ObjectHide by creating records in ObjectHide__share table. I added the ObjectVisible to standard Accounts page layout.

The issue is, users that don't have access to the ObjectHide record can see the field values through the ObjectVisible related list on the Account page.

Is this expected? or some sort of a loophole in object level security? Is there anything else I need to set to enforce the field level security of ObjectHide when it's viewed through the related list of ObjectVisible?

Example: UserA has access to an ObjectHidden record, UserB doesn't. Both users have access to ObjectVisible record that has lookup fields to ObjectHidden record. ObjectVisible related list is on the standard Account page. Both users are able to see the contents of ObjectVisible related list, including the values in the lookup fields pointing to ObjectHidden (I expected UserB not to be able to see the values). When UserA clicks on an item in the related list pointing to the HiddenObject record, it loads the details of the HiddenObject record, but when UserB clicks it, it display insufficient privileges (good thing). The problem is why is UserB able to see the HiddenObject values through the VisibleObject related list?

  • Is this a standard page layout or visualforce? – PepeFloyd Nov 24 '14 at 21:45
  • Standard page layout. – JJCoolJ Nov 24 '14 at 22:04
  • 1
    The users are getting access in another way, what you are describing is not expected and I have never seen it behaving like that. Use the sharing button on one of those records that should be hidden and find out how are those users getting access. They are either getting access due to having access to a parent record, or they have a permission in their profile such as View All or Modify All. – PepeFloyd Nov 24 '14 at 22:20
  • Hi Pepe, I check the profiles and they don't have View All/Modify All checked. Also, There's no Master-Detail relationship on the ObjectHidden so it's not inheriting the access permissions from a parent Object. I also checked the Roles for the users I'm using to test and they are all in the same Role so the inherit using role hierarchy is also not the culprit here. – JJCoolJ Nov 25 '14 at 14:42
  • 1
    Are you able to use the Sharing button on one of the records to identify why the user has access? – PepeFloyd Nov 25 '14 at 14:59
0

I found out what the issue is. The ObjectVisible lookup field to the ObjectHidden was being populated using an external integration. The external intergration used Dataloader to populate the fields and it was signing in as a user with a profile that had access to all data enabled.

|improve this answer|||||
  • Please mark this as the correct answer so it does not keep getting bumped by the bots – Eric Nov 27 '14 at 20:12

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.