Skip to main content

Questions tagged [field-level-security]

Each Field within an Object has it's own CRUD (Create, Read, Update and Delete) security permissions applied to it. Field level security settings can make the security applied to a field more restrictive for a User's Profile beyond what Object level security would on it's own, but cannot make the security less restrictive.

Filter by
Sorted by
Tagged with
21 votes
4 answers
30k views

Does Process Builder run with System permissions or User permissions?

Regarding field-level security, does Lightning Process Builder run as system-level permissions or user? That is: Can I trigger an update to a field that the current user cannot edit? Can I filter ...
Charles Koppelman's user avatar
18 votes
2 answers
1k views

How does Salesforce handle Managed Package Licences between Packages?

So I have a managed package we'll call Package Core. It has various components, incl custom fields on Account and Contact. It is licensed by user, and works as expected - no license, no access to the ...
BritishBoyinDC's user avatar
12 votes
2 answers
37k views

Make a button on a layout be visible only to a specific group of users

If I want a specific field to be visible only to a specific user or group of users on a layout, I set up field-level security for this field. I want to be able to do the same for my custom button ...
Dmitry Nikolaev's user avatar
12 votes
2 answers
4k views

Newbie Q: Is "Field Level Security" the same as "Field Accessibility"?

There are two buttons that seem very similar when viewing the detial page for an object: Set Field Level Security and View Field Accessibility. They both seem to allow you to set the field level ...
davea0511's user avatar
  • 355
12 votes
0 answers
493 views

Is there a reliable way to have WITH SECURITY_ENFORCED applied to all queries?

I've just gone through a biggish code base making sure that WITH SECURITY_ENFORCED is set on every query. Most were, but for some recent additions, it hadn't been included. For managed packages that ...
Keith C's user avatar
  • 136k
11 votes
3 answers
2k views

Security Review Preparation: Checking isAccessible on each object and field in complex SOQL queries for whole codebase

We are preparing our managed package for security review. And as a part of this we need to enforce not just create/update/delete but also read (i.e. select) permissions. That means basically checking ...
wesaw's user avatar
  • 3,080
9 votes
1 answer
906 views

How to opt out of FLS validation when a SOQL query is run by a trigger?

I have a large Salesforce application with hundreds of SOQL queries. Currently, the code uses Schema.DescribeFieldResult data to determine if the logged in user has rights to each field in the SELECT ...
SeanW's user avatar
  • 672
8 votes
3 answers
17k views

How do 'Modify All Data' and 'View All Data' affect Field-Level Security settings

Does the Modify All Data or View All Data permission allow a user/profile to ignore the FLS settings for an object? The documentation would seem to suggest that this is the case, but I've found ...
cseaton's user avatar
  • 621
8 votes
3 answers
9k views

Set Field Level security for profile using meta-data api

I am using meta-data api to create custom fields in java class. Now I want to set field level security for different profiles. First is it possible to set this with meta-dat api, If yes than how can I ...
ankit maini's user avatar
8 votes
1 answer
7k views

For SOQL queries, can "WITH USER_MODE" safely replace "WITH SECURITY_ENFORCED"?

When performing static or dynamic SOQL queries, should WITH SECURITY_ENFORCED now be replaced with WITH USER_MODE? Under what conditions, if any, should WITH SECURITY_ENFORCED still be used given ...
kennyc's user avatar
  • 349
8 votes
1 answer
1k views

What exception does Security.stripInaccessible throw?

This new security method Security.stripInaccessible both strips out fields that the user has no rights to and will throw an exception if the object-level permissions are being violated. What ...
Keith C's user avatar
  • 136k
8 votes
1 answer
2k views

Profile Field Level Security missing in XML when retrieve profile changes from scratch org

In our DX project we maintain 4 profiles (3 custom and the System Administrator profile). When a scratch org is created I can push the project and everything deploys correctly including the profiles ...
David Dawson's user avatar
  • 1,204
7 votes
3 answers
889 views

Platform Encryption vs. FLS

What would I get from Platform Encryption that I cannot get from Field Level Security? We are investigating whether or not to invest in Salesforce Shield, so I want to better understand the ...
Adrian Larson's user avatar
  • 150k
7 votes
2 answers
871 views

Do I need to include Field-Level Security to get on the App Exchange?

I have a list of issues that Salesforce sent me for the security review before my app can be accepted in the AppExchange. The first section is titled "CRUD and FLS", followed by a lot of examples for ...
George S.'s user avatar
  • 2,740
7 votes
1 answer
537 views

Schema.SobjectField Access Changed in API v34.0 (Summer '15)

While I was working on a Visualforce page which has some similar functionality to another page that has already been developed in the past into one of my other orgs, I decided to re-use the same code ...
Boris Bachovski's user avatar
7 votes
1 answer
752 views

Why did I fail Security Review when not checking FLS or using "without sharing"?

I submitted a package for security review which has a Custom Object which has internal / technical semantics only. So it's not created or even seen by users. When a user performs some action some "...
Robert Sösemann's user avatar
6 votes
2 answers
8k views

Field-Level Security (FLS) in Lightning Components

I'm going through CRUD and Field-Level Security (FLS) from Lightning Components Developer Guide, and the following code for Field-Level Security validation doesn't make any sense for me in terms of ...
o-lexi's user avatar
  • 3,094
6 votes
1 answer
581 views

Why is stripInaccessible removing an M-D field?

I am building and LWC which uses lightning-record-edit-form to create an object, then calls an Apex controller method to create a list of M-D children of the newly created object. In my current test, ...
Jason Clark's user avatar
  • 11.9k
5 votes
2 answers
3k views

LWC - Bypass Field-Level Security using Lightning-Input-Field?

Is it possible to create an LWC input form that bypasses field-level security, while still leveraging the powerful UI brought by <lightning-input-field>? Im creating a generic filter component ...
D. Salvadori's user avatar
5 votes
2 answers
532 views

Basic unit test to check if I have read access to a field - Apex

I'm currently working on a generic way of implementing FLS on all SOQL calls in my code base. I want to start by creating a few basic unit tests in Apex to check whether or not I have read access to ...
Daft's user avatar
  • 2,661
5 votes
3 answers
532 views

What is the risk of not performing Field Level Security (FLS) checks on internally developed Apex code?

I see more and more information about the importance of performing FLS checks before SOQL and DML operations, using the Security.stripInaccessible method, e.g. in the Winter '21 PD1 certification ...
MikeA's user avatar
  • 1,105
5 votes
1 answer
612 views

Criteria-based field-level security

I have two Departments who each have different sells, based on a custom object. I would like for Dept A to only see certain fields in the sells which are created in Dept B - and vice versa. If I ...
Zoom_v's user avatar
  • 3,894
4 votes
1 answer
375 views

Field Level Security for new fields

When creating new fields, some profiles are checked by default on page load. How are these profiles determined ?
david raj's user avatar
  • 623
4 votes
1 answer
7k views

WITH SECURITY_ENFORCED and Security.stripInaccessible in a single SOQL

Premise: I followed WITH SECURITY_ENFORCED, Security.stripInaccessible and comparison before designing my Apex class for querrying a few records. Doubt: I implemented my SOQL as Security....
user43598's user avatar
  • 497
4 votes
1 answer
479 views

Apex Source Scanner flag CRUD/ FLS as security risk for no reason

I've been using FFLIB_SecurityUtils lib to enforce CRUD and FLS in my apex classes. I've no issues when running unit tests, but when submitting my code on Source Scanner for partners, i've several ...
Bryce's user avatar
  • 442
4 votes
1 answer
3k views

How does Read-Only field level security affects Apex and Workflows

Let's say I have a Profile in the system which has a particular Field of an Object set as Read-Only. How does this affect my Apex code and Workflows if they are executed by a User with this Profile? ...
smukov's user avatar
  • 5,603
4 votes
1 answer
2k views

Allow One User to Edit A Field

Our business rules require that the opportunity probability field be linked to the Opportunity's stage. Users can choose the stage, which automatically updates the probability, but the probability ...
Benj's user avatar
  • 11.2k
4 votes
1 answer
300 views

New field permission during Push update

The question is about permission for newly added custom field in a managed package. Consider the situation when we have a managed package (say version 1.0), and we're going to Push upgrade on customer'...
Mike Raven's user avatar
  • 2,133
4 votes
1 answer
206 views

Is the User Mode approach to object and field security acceptable in a security review?

This Enforce User Mode for Database Operations looks by far the cleanest approach to implement the object and field-level security that is required to pass a Salesforce AppExchange Security Review. (...
Keith C's user avatar
  • 136k
4 votes
1 answer
421 views

How do I find out if a field is updateable by the System?

I am running a batch process that is marked without sharing. I would like to to take one course of action if the batch process can update a particular field, and another if not. For example: if (...
Charles Koppelman's user avatar
4 votes
1 answer
228 views

Unable to simulate FLS/CRUD security leaks although no checks in code

I recently checked my managed package using the Force.com Security chechker (by Checkmarx) and the tool listed a few CRUD and FLS issues in my Controller classes. Before fixing them I tried to better ...
Robert Sösemann's user avatar
4 votes
0 answers
723 views

How to deploy FLS (Field Level Security) for all Objects & Fields in Scratch Org with application source push?

I'm trying to setup DX with Source code in Git and I'm pulling it from there and pushing it into a Scratch org. My Source code has multiple standard/custom objects with fields. But after Pushing code ...
VarunC's user avatar
  • 5,980
3 votes
2 answers
2k views

How do you configure Field Level Security for Custom settings in managed package?

I can't seem to find this configuration in the User Profile settings.
ben's user avatar
  • 107
3 votes
3 answers
7k views

How to pass Schema.SObjectType to a class method as an argument?

In an effort to write reusable code, I am trying to move my field-level security check code into a common class/methods. Because the Schema.SObjectType is dynamic, I am looking for a way to pass ...
Swisher Sweet's user avatar
3 votes
1 answer
2k views

Workflows and field-level security

I've got a workflow that triggers a field update (checkbox). I would like to restrict this checkbox to read-only for everybody except System Administrator. However, if a non-Sys Admin causes the ...
tsb8m's user avatar
  • 33
3 votes
1 answer
5k views

Visible vs Read Only?

Opportunity Fields > "Field Label/name" > Set Field-Level Security > What is Visible vs Read OnLy? A Google Search Revealed: Visible : If you check the "Visible" checkbox, that field will be ...
Guest Guy's user avatar
3 votes
1 answer
6k views

How to check edit access for LWC?

I am just going through the Summer 20 Release Notes and found an article - Check User Permissions for Lightning Web Components Here is the link Here I found, to check View Setup permission you just ...
Sahil Malhotra's user avatar
3 votes
2 answers
2k views

Shortest and most efficient way to query ALL accessible fields of an object

Now that stripInaccessible() and WITH_SECURITY_ENFORCED are GA I wonder what is the most readable and efficient way to do a SELECT all_accessible_fields_for_user FROM AnyObject WHERE Id = ...
Robert Sösemann's user avatar
3 votes
1 answer
6k views

Enforce Field-Level Security Permissions for SOQL Queries WITH SECURITY_ENFORCED (Confused )

What is the need of WITH SECURITY_ENFORCED? Only benefit is minimal development experience with security and to applications where graceful degradation on permissions errors isn’t required. If ...
cloudZigZag's user avatar
  • 1,376
3 votes
1 answer
607 views

Contact last-modified date changed by read-only user

Have a number of read only users, that appear to all be setup the same way, though one of the users is somehow being logged as the user for the last-modified date on the contact. Again, checked the ...
blunders's user avatar
  • 1,618
3 votes
1 answer
1k views

Does object level permission effect data visibility on a VF page with Custom controller?

I have a user associated to a profile which does not even have the READ permission on the customObject__c. Now I have to display the customObject__c details on a VF page for this user. I used only a ...
Sam's user avatar
  • 4,383
3 votes
2 answers
578 views

Manually Enforce CRUD and FLS in trigger handler and Ajax to pass salesforce security review

I want to pass salesforce security review in my app. I want to make sure that all the known issues fixed before submission. I have Enforced CRUD and FLS in to all the apex classes. But i am not sure ...
Peeyush's user avatar
  • 911
3 votes
1 answer
389 views

What determines the default FLS settings when creating a new field

In step 3 of the create new field wizard, you are presented with a page like this: Why do some of the profiles get default visibility and some don't? There is probably an extremely simple profile ...
Caspar Harmer's user avatar
3 votes
1 answer
191 views

Strange issue with Account and contact fields on case object

For some reason the account and contact field on the case object is grayed out, my initial guess was FLS or page layout making the field read only but all have the fields open for my profile, not sure ...
Anil Shivaraj's user avatar
3 votes
0 answers
335 views

Best practices for pushing objects through DevOps?

We are using DevOps to push changes from sandboxes through to Production. Recently, I attempted to deploy some significant changes to an object. This includes: Creation of record types New fields ...
user avatar
3 votes
0 answers
51 views

Is there an alternative solution to prevent other profiles from seeing a certain profile's activites?

I have an original profile A A group of users wanted to go from profile A to a new profile called profile B that is an exact mirror of profile A. Profile B wants to create activities and task, but ...
Cara Cini's user avatar
  • 109
3 votes
0 answers
137 views

Why would an app change Field Level Security settings en masse (unexpectedly)?

I installed an app (a managed package) to my org's Salesforce instance this morning, and shortly thereafter noticed that in FLS, visibility had been removed on dozens of important fields, across ...
OBerm's user avatar
  • 1,234
2 votes
2 answers
3k views

How to make custom object record only visible to certain users based on field checkbox

So I have a custom object in my org called Promotion Events. I would like to add a field called 'Private' that is a check box, and if it is checked and the event is created, this event(Promotion Event ...
Storm Martinous's user avatar
2 votes
1 answer
848 views

Field level security pain in Apex tests when using packaging 2

In line with current security standards, we use with security_enforced extensively in our code. When doing CI (Continuous Integration) builds or working interactively we use sfdx force:user:permset:...
Keith C's user avatar
  • 136k
2 votes
1 answer
572 views

IsUpdateable returns true for Admin profile, even though I removed edit access

I am running checks on fields in my Apex controller, to see if the logged in user has update access on a field before allowing an update. While logged in as Admin, when I check IsUpdateable() in my ...
Swisher Sweet's user avatar