Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

The tag has no usage guidance.

2
votes
1answer
72 views

soql on object permissions on a profile

I was trying to find out CRUD level permissions for a particular object on a specific profile for which I've framed below query: SELECT Id,SObjectType,PermissionsRead,PermissionsCreate FROM ...
2
votes
1answer
30 views

How to check other user's CRUD permission for an object (APEX)

I want to find out, if another user has READ permission on a specific object (I don't care about record access/sharing). Is there a way to accomplish this via APEX? I do NOT want to find out if the ...
1
vote
1answer
21 views

SysAdmin Cannot delete EventRelation in Unit Test?

I have a unit test that creates an Event (in the future) and some EventRelations (for Contacts, with isInvitee=True), and then later deletes 1 of the EventRelations, via runAs(SysAdmin). Pretty sure ...
2
votes
1answer
60 views

How to enforce CRUD and FLS in bulk trigger?

How to enforce CRUD and FLS in following situation (bulk trigger). Better idea is simply throw an exception or addError(errMsg) ? trigger CaseCommentTrigger on CaseComment (after insert) { List<...
0
votes
2answers
37 views

Will Sharing=ReadOnly allow my user to Delete or Clone a record

I have Lightning Quickactions for Delete and Clone on a CustomObject__c and I want to ensure that only users with the right permission can use it. From reading this documentation I understand that I ...
0
votes
1answer
39 views

CRUD FLS issue to edit task access for site guest user

I am applying CRUD FLS on task object fields and also I have provided read and edit access to task for site user profile. Even checked with sharing settings as 'Controlled by parent'. But still when ...
1
vote
1answer
61 views

FLS and CRUD check for User object

I have a code which is inserting user object. It is created when the end user creates his account from force.com site. Since we cannot control FLS for user fields at profile level do we have to check ...
1
vote
1answer
43 views

check FLS and CRUD for more than one field

I have a code which inserts custom Note__c object by using 5 fields. I want to check FLS and CRUD permission field level wise as they are reported in the checkmarx report. I know we can write in if ...
1
vote
0answers
31 views

How can the Describe for a Field of getPopulatedFieldsAsMap() be null

I'm doing a CRUD check on Field level, since under some weird circumstances our customers don't have update rights on Record level, but only on fields (it's a guest license). So in addition to the ...
1
vote
1answer
21 views

Custom Setting for User Create Access Remove

In my org 4 users have the same profile and have all CRUD permission. My requirement is: I don't want to give create access to only one user with the help of custom setting, but I am not aware about ...
4
votes
1answer
59 views

CRUD & FLS on Managed Package Objects

We're working on a managed package that includes two data SObjects which track and log the work the users do in our package. We are including an Admin permission set and a User permission set to ...
0
votes
2answers
107 views

system.security.NoAccessException even if controller APEX class is of type without sharing

I have a visual force page with standard controller (of type standard object) and controller extension. controller extension for page is of type without sharing. On this page, I am binding fields ...
0
votes
0answers
18 views

Contact Update from Authenticated Site User

I have an existing Apex class that serves as a controller in a force.com site visualforce page. The Apex class is performing an update on the Contact sObject directly and I believe the update should ...
0
votes
0answers
49 views

CRUD FLS issue on Task object for site guest user

I'm creating managed package but I'm stuck with CRUD FLS for Task object. I'm inserting task from site guest user if I check isCreatable access in my code, I'm not able create Task records. I have ...
1
vote
1answer
47 views

AppExchange ISV Security Review CRUD/FLS Puzzler

Who knows the answer to this puzzler? Q: If a Visualforce Page is using a standard controller with a custom controller extension and the controller extension is declared "with sharing", do we need ...
-1
votes
1answer
199 views

isAccessible() vs isQueryable() and which one to use for SOQL query CRUD checks [duplicate]

Whats the difference between isAccessible() vs isQueryable() methods in DescribeSObjectResult Class and which method should one use for CRUD checks in SOQL query ? (https://developer.salesforce.com/...
2
votes
1answer
239 views

CRUD/FLS Enforcement: how to add isAccessible() to the test class for code coverage

I received the result from security review from Salesforce team and it failed. One of the vulnerability shown in the report was CRUD/FLS Enforcement. The report suggest I use the isAccessible() check ...
2
votes
0answers
55 views

CRUD-FLS Implementation for Event Object

We are creating a managed package and have submitted for Security review process. We had implemented CRUD-FLS check on all the objects we had used within our application except EVENT. But we had ...
1
vote
0answers
69 views

FLS/CRUD Enforcement In Helper Classes

We have several controller classes that call out to helper classes to grab data or save data. This has resulted in a few questions... Is it sufficient to simply check all permissions in the ...
4
votes
1answer
913 views

Integration with REST API that is not CRUD

I'm a developer working on an API that tries to be REST-ful, but is limited in terms of CRUD. Many entities expose a GET endpoint, but because many create and update actions have side-effects, we don'...
0
votes
1answer
211 views

Enforce CRUD for Database.delete

if (!(EMPYRAMDM__UploadedContact_Csv_Dup__c.sObjectType.getDescribe().isDeletable())) { system.debug('**Cannot Delete the Uploaded Contact CSV Duplicates'); } else { Database.delete (scope, ...
3
votes
1answer
162 views

Enforce FLS/CRUD Delete issue in security scan

I am getting problem in understanding a issue given by security scan. The problem is : [] I am not pasting the whole code but the essential lines: public with sharing class ...
1
vote
1answer
37 views

Best practice for delayed operation?

I have request for delayed operation: When Contact(single record of the class) undergo specific conditions, wait 30 days and disable it. I have option to implement it outside of Salesforce, but that ...
3
votes
1answer
258 views

CRUD FLS enforcements and best practices

I have written a basic controller class which does insert/delete/update. I wanted to validate whether I'm thinking about CRUD/FLS enforcements the right way. Also wanted to know what are the best ...
1
vote
1answer
378 views

Sample test for testing FLS/CRUD

I'm trying to understand FLS/CRUD permissions using a simple test. I have created a user and assigned a no-update,no-delete,no-create permission set on that. In my test I'm trying to run as this new ...
3
votes
2answers
855 views

Dynamically enforce object and field level security?

I am building a dynamic data table in lightning and trying to enforce object and field level security for it, but I'm having some issues. Here is my code to check for object access. String[] objects ...
1
vote
1answer
315 views

Security scanner: enforcing CRUD. Auto scanner reported issue

I have a question here regarding to Security scan: enforcing CRUD. For the example case deletion, but we also have problems with update and creation. Before I delete a record, I apply deletable check ...
1
vote
1answer
283 views

FLS Create for upsert

How manage FLS Create issues in Checkmarx for upsert statements ? I use isCreateable() for insert and isUpdateable() for update. But for upsert, I don't know what function I have to use (one or both)...
0
votes
1answer
282 views

Enforcing CRUD / FLS / Sharing in Apex

I am having trouble putting the different aspects of enforcing CRUD/FLS/Sharing Rules into perspective. Reading through the manuals and doing extensive tests on my own, I came to the following ...
3
votes
1answer
467 views

Security Review - CRUD/FLS Checks for every SOQL Query

I know this sounds like a standard question, so please bear with me. Recently our Security Reviews fail due to CRUD/FLS violations. The highlighted codelines include almost every SOQL Query in the ...
4
votes
2answers
220 views

IP Address Restrictions Other Than Profile-Based?

We have about 6 users at our company who need a similar set of CRUD permissions against our Salesforce org. 1 of those users is employed in a lesser capacity than the other 5 and therefore shouldn't ...
7
votes
1answer
496 views

Most optimal way to Enforce CRUD/FLS in Apex

This article shows a common way to check access in Apex with a syntax like: if (!Schema.sObjectType.Contact.fields.Name.isAccessible()){ return ''; } However, it is very time/space-consuming to ...
2
votes
1answer
205 views

Manually Enforce CRUD and FLS in trigger handler and Ajax to pass salesforce security review

I want to pass salesforce security review in my app. I want to make sure that all the known issues fixed before submission. I have Enforced CRUD and FLS in to all the apex classes. But i am not sure ...
3
votes
0answers
92 views

Accessing SAML Login Information in Connected App programmatically

I was looking for a way to programmatically read (and potentially - write) data in SAML Login Information (on ConnectedApp 'manage-side' settings), as displayed below: I already tried using Metadata ...
0
votes
1answer
509 views

How to update a field on Lead object with Lightning Components?

I was playing around with Lightning Trail Head Examples and couldn't figure out how to update a record. When I asked google Yoda master, master referred me here,to this post. I was able to replicate ...
3
votes
0answers
85 views

Why Field Accessibility Check is broken in a Managed Package?

my code has a centralised class which is responsible for all DML operations. This class before inserting / updating / deleting a record is checking: 1, if the object is accessible for the current ...
2
votes
1answer
93 views

Capturing record events without triggers

Is there any way other than Apex Trigger/Process Builder/Workflow to capture record events programmatically? Does Salesforce have any sort of CRUD event publisher that can be somehow subscribed to? ...
3
votes
1answer
78 views

Preventing access to detail records using CRUD

I have a custom object B that has a master detail relationship to Account. The sharing settings on Account are set to Private. Account CRUD for sys admin and user 1 is create, edit, view, delete. The ...
1
vote
3answers
2k views

How do I check CRUD and FLS in apex?

Please help me solving this Issue. I'm new to the salesforce, I worte an Controller which do get list of objects values from contact, Cases and also inserts New cases and Case comments to, During the ...
0
votes
1answer
98 views

Run test code as a community user, but pass CRUD/FLS checks

So, the title might be a bit confusing, but I tried to keep it short. Here's the problem I'm facing: So we've built out some community based pages for one of our products. Because these pages utilize ...
1
vote
1answer
295 views

How to modify CRUD permission on an object programmatically?

I want to modify CRUD permissions for a custom object inside my Visualforce page controller (accessible only by administrators) in order to hide/show this object to other users when clicking on a ...
4
votes
1answer
7k views

How to update a field with Lightning Components?

Following the "expense" example in the documentation, I'm trying implement an even simpler Lightning Component just to query and update just the single field Account.Name - query and display works ...
0
votes
1answer
34 views

Creating metadata in client org

I have some packaged code that utilizes the SF Metadata API to create VF pages, as well as modify some object metadata. The code currently is not executing on the client side (but it's working fine in ...
0
votes
1answer
56 views

FLS Code Coverage issue

Need code coverage for my IF block if (!Schema.sObjectType.Account.fields.Name.isCreateable()) { ApexPages.addMessage(new ApexPages.Message(ApexPages.Severity.FATAL, ...
0
votes
1answer
460 views

Using without sharing with customer community - can't create account

It looks like customer community users can't create Account records because there is no create option in object settings for a customer community profile. I thought that I could get around this if ...
1
vote
1answer
427 views

CRUD with help Lightning Component

Please show me example how work with CRUD in Lightning Component: I want to create order system for restaurant. User is waiter. He make all CRUD operation with orders. There are "close" and "open" ...
5
votes
2answers
702 views

Do we allow CRUD & FLS in each component of Apex?

Can I write CRUD & FLS Enforecement codes in following : If not in any of these - then Why ? Apex Class - YES Apex Trigger - ? Apex BatchClasses - ? Utility Classes - ?
2
votes
1answer
155 views

Allow my customers to edit their details via force site

I want to allow my customers to be able to sign into my force.com site (via authenticated website access) and allow users to view and edit certain fields related to them (i.e. email &phone details ...
1
vote
0answers
78 views

Do I need any CRUD & FLS Checking for code below ? Will it pass in Appexchange Review?

Note : I have done CURD & FLS for Account & Contact which I have inserted already i.e. objAccount1 and objContact1 Code : //create an opp for each lead Database....
2
votes
1answer
476 views

CRUD and FLS enforcement

I have an Account list and I want to update it. I want to testing object and field level security enforcement but I'm wondering what I have to test : 1 - if Account object is updatable ? (if it's ...