Questions tagged [field-level-security]
Each Field within an Object has it's own CRUD (Create, Read, Update and Delete) security permissions applied to it. Field level security settings can make the security applied to a field more restrictive for a User's Profile beyond what Object level security would on it's own, but cannot make the security less restrictive.
198
questions
21
votes
4
answers
30k
views
Does Process Builder run with System permissions or User permissions?
Regarding field-level security, does Lightning Process Builder run as system-level permissions or user? That is:
Can I trigger an update to a field that the current user cannot edit?
Can I filter ...
- 4,232
18
votes
2
answers
912
views
How does Salesforce handle Managed Package Licences between Packages?
So I have a managed package we'll call Package Core. It has various components, incl custom fields on Account and Contact. It is licensed by user, and works as expected - no license, no access to the ...
- 13.5k
12
votes
2
answers
35k
views
Make a button on a layout be visible only to a specific group of users
If I want a specific field to be visible only to a specific user or group of users on a layout, I set up field-level security for this field. I want to be able to do the same for my custom button ...
- 571
12
votes
2
answers
4k
views
Newbie Q: Is "Field Level Security" the same as "Field Accessibility"?
There are two buttons that seem very similar when viewing the detial page for an object: Set Field Level Security and View Field Accessibility. They both seem to allow you to set the field level ...
- 355
12
votes
0
answers
391
views
Is there a reliable way to have WITH SECURITY_ENFORCED applied to all queries?
I've just gone through a biggish code base making sure that WITH SECURITY_ENFORCED is set on every query. Most were, but for some recent additions, it hadn't been included. For managed packages that ...
- 135k
11
votes
3
answers
1k
views
Security Review Preparation: Checking isAccessible on each object and field in complex SOQL queries for whole codebase
We are preparing our managed package for security review.
And as a part of this we need to enforce not just create/update/delete but also read (i.e. select) permissions. That means basically checking ...
- 2,990
9
votes
1
answer
745
views
How to opt out of FLS validation when a SOQL query is run by a trigger?
I have a large Salesforce application with hundreds of SOQL queries. Currently, the code uses Schema.DescribeFieldResult data to determine if the logged in user has rights to each field in the SELECT ...
- 672
8
votes
3
answers
16k
views
How do 'Modify All Data' and 'View All Data' affect Field-Level Security settings
Does the Modify All Data or View All Data permission allow a user/profile to ignore the FLS settings for an object? The documentation would seem to suggest that this is the case, but I've found ...
- 621
8
votes
3
answers
9k
views
Set Field Level security for profile using meta-data api
I am using meta-data api to create custom fields in java class. Now I want to set field level security for different profiles. First is it possible to set this with meta-dat api, If yes than how can I ...
- 115
8
votes
1
answer
1k
views
What exception does Security.stripInaccessible throw?
This new security method Security.stripInaccessible both strips out fields that the user has no rights to and will throw an exception if the object-level permissions are being violated.
What ...
- 135k
8
votes
1
answer
2k
views
Profile Field Level Security missing in XML when retrieve profile changes from scratch org
In our DX project we maintain 4 profiles (3 custom and the System Administrator profile). When a scratch org is created I can push the project and everything deploys correctly including the profiles ...
- 1,194
7
votes
1
answer
3k
views
For SOQL queries, can "WITH USER_MODE" safely replace "WITH SECURITY_ENFORCED"?
When performing static or dynamic SOQL queries, should WITH SECURITY_ENFORCED now be replaced with WITH USER_MODE? Under what conditions, if any, should WITH SECURITY_ENFORCED still be used given ...
- 307
7
votes
3
answers
834
views
Platform Encryption vs. FLS
What would I get from Platform Encryption that I cannot get from Field Level Security?
We are investigating whether or not to invest in Salesforce Shield, so I want to better understand the ...
- 149k
7
votes
2
answers
863
views
Do I need to include Field-Level Security to get on the App Exchange?
I have a list of issues that Salesforce sent me for the security review before my app can be accepted in the AppExchange.
The first section is titled "CRUD and FLS", followed by a lot of examples for ...
- 2,730
7
votes
1
answer
525
views
Schema.SobjectField Access Changed in API v34.0 (Summer '15)
While I was working on a Visualforce page which has some similar functionality to another page that has already been developed in the past into one of my other orgs, I decided to re-use the same code ...
- 16.2k
6
votes
2
answers
7k
views
Field-Level Security (FLS) in Lightning Components
I'm going through CRUD and Field-Level Security (FLS) from Lightning Components Developer Guide, and the following code for Field-Level Security validation doesn't make any sense for me in terms of ...
- 3,094
6
votes
1
answer
487
views
Why is stripInaccessible removing an M-D field?
I am building and LWC which uses lightning-record-edit-form to create an object, then calls an Apex controller method to create a list of M-D children of the newly created object. In my current test, ...
- 11.8k
6
votes
1
answer
715
views
Why did I fail Security Review when not checking FLS or using "without sharing"?
I submitted a package for security review which has a Custom Object which has internal / technical semantics only. So it's not created or even seen by users. When a user performs some action some "...
- 37.3k
5
votes
2
answers
3k
views
LWC - Bypass Field-Level Security using Lightning-Input-Field?
Is it possible to create an LWC input form that bypasses field-level security, while still leveraging the powerful UI brought by <lightning-input-field>?
Im creating a generic filter component ...
- 313
5
votes
2
answers
499
views
Basic unit test to check if I have read access to a field - Apex
I'm currently working on a generic way of implementing FLS on all SOQL calls in my code base.
I want to start by creating a few basic unit tests in Apex to check whether or not I have read access to ...
- 2,661
5
votes
1
answer
582
views
Criteria-based field-level security
I have two Departments who each have different sells, based on a custom object. I would like for Dept A to only see certain fields in the sells which are created in Dept B - and vice versa.
If I ...
- 3,856
4
votes
1
answer
329
views
Field Level Security for new fields
When creating new fields, some profiles are checked by default on page load.
How are these profiles determined ?
- 623
4
votes
1
answer
453
views
Apex Source Scanner flag CRUD/ FLS as security risk for no reason
I've been using FFLIB_SecurityUtils lib to enforce CRUD and FLS in my apex classes. I've no issues when running unit tests, but when submitting my code on Source Scanner for partners, i've several ...
- 442
4
votes
1
answer
2k
views
How does Read-Only field level security affects Apex and Workflows
Let's say I have a Profile in the system which has a particular Field of an Object set as Read-Only.
How does this affect my Apex code and Workflows if they are executed by a User with this Profile? ...
- 5,503
4
votes
1
answer
2k
views
Allow One User to Edit A Field
Our business rules require that the opportunity probability field be linked to the Opportunity's stage. Users can choose the stage, which automatically updates the probability, but the probability ...
- 11.2k
4
votes
3
answers
387
views
What is the risk of not performing Field Level Security (FLS) checks on internally developed Apex code?
I see more and more information about the importance of performing FLS checks before SOQL and DML operations, using the Security.stripInaccessible method, e.g. in the Winter '21 PD1 certification ...
- 1,055
4
votes
1
answer
288
views
New field permission during Push update
The question is about permission for newly added custom field in a managed package.
Consider the situation when we have a managed package (say version 1.0), and we're going to Push upgrade on customer'...
- 2,133
4
votes
1
answer
390
views
How do I find out if a field is updateable by the System?
I am running a batch process that is marked without sharing.
I would like to to take one course of action if the batch process can update a particular field, and another if not.
For example:
if (...
- 4,232
4
votes
1
answer
220
views
Unable to simulate FLS/CRUD security leaks although no checks in code
I recently checked my managed package using the Force.com Security chechker (by Checkmarx) and the tool listed a few CRUD and FLS issues in my Controller classes.
Before fixing them I tried to better ...
- 37.3k
3
votes
3
answers
7k
views
How to pass Schema.SObjectType to a class method as an argument?
In an effort to write reusable code, I am trying to move my field-level security check code into a common class/methods.
Because the Schema.SObjectType is dynamic, I am looking for a way to pass ...
- 4,947
3
votes
1
answer
5k
views
WITH SECURITY_ENFORCED and Security.stripInaccessible in a single SOQL
Premise: I followed WITH SECURITY_ENFORCED, Security.stripInaccessible and comparison before designing my Apex class for querrying a few records.
Doubt:
I implemented my SOQL as
Security....
- 447
3
votes
2
answers
2k
views
How do you configure Field Level Security for Custom settings in managed package?
I can't seem to find this configuration in the User Profile settings.
- 107
3
votes
1
answer
2k
views
Workflows and field-level security
I've got a workflow that triggers a field update (checkbox). I would like to restrict this checkbox to read-only for everybody except System Administrator. However, if a non-Sys Admin causes the ...
- 33
3
votes
1
answer
4k
views
Visible vs Read Only?
Opportunity Fields > "Field Label/name" > Set Field-Level Security >
What is Visible vs Read OnLy?
A Google Search Revealed:
Visible : If you check the "Visible" checkbox, that field will be ...
- 27
3
votes
2
answers
1k
views
Shortest and most efficient way to query ALL accessible fields of an object
Now that stripInaccessible() and WITH_SECURITY_ENFORCED are GA I wonder what is the most readable and efficient way to do a
SELECT all_accessible_fields_for_user FROM AnyObject WHERE Id = ...
- 37.3k
3
votes
1
answer
6k
views
Enforce Field-Level Security Permissions for SOQL Queries WITH SECURITY_ENFORCED (Confused )
What is the need of WITH SECURITY_ENFORCED?
Only benefit is minimal development experience with security and to applications where graceful degradation on permissions errors isn’t required.
If ...
- 1,366
3
votes
1
answer
561
views
Contact last-modified date changed by read-only user
Have a number of read only users, that appear to all be setup the same way, though one of the users is somehow being logged as the user for the last-modified date on the contact. Again, checked the ...
- 1,618
3
votes
1
answer
5k
views
How to check edit access for LWC?
I am just going through the Summer 20 Release Notes and found an article - Check User Permissions for Lightning Web Components
Here is the link
Here I found, to check View Setup permission you just ...
- 1,580
3
votes
1
answer
1k
views
Does object level permission effect data visibility on a VF page with Custom controller?
I have a user associated to a profile which does not even have the READ permission on the customObject__c. Now I have to display the customObject__c details on a VF page for this user. I used only a ...
- 4,383
3
votes
2
answers
567
views
Manually Enforce CRUD and FLS in trigger handler and Ajax to pass salesforce security review
I want to pass salesforce security review in my app. I want to make sure that all the known issues fixed before submission. I have Enforced CRUD and FLS in to all the apex classes. But i am not sure ...
- 901
3
votes
1
answer
339
views
What determines the default FLS settings when creating a new field
In step 3 of the create new field wizard, you are presented with a page like this:
Why do some of the profiles get default visibility and some don't?
There is probably an extremely simple profile ...
- 20.3k
3
votes
1
answer
155
views
Strange issue with Account and contact fields on case object
For some reason the account and contact field on the case object is grayed out, my initial guess was FLS or page layout making the field read only but all have the fields open for my profile, not sure ...
- 1,762
3
votes
1
answer
166
views
Is the User Mode approach to object and field security acceptable in a security review?
This Enforce User Mode for Database Operations looks by far the cleanest approach to implement the object and field-level security that is required to pass a Salesforce AppExchange Security Review.
(...
- 135k
3
votes
0
answers
245
views
Best practices for pushing objects through DevOps?
We are using DevOps to push changes from sandboxes through to Production.
Recently, I attempted to deploy some significant changes to an object. This includes:
Creation of record types
New fields
...
user123801
3
votes
0
answers
48
views
Is there an alternative solution to prevent other profiles from seeing a certain profile's activites?
I have an original profile A
A group of users wanted to go from profile A to a new profile called profile B that is an exact mirror of profile A.
Profile B wants to create activities and task, but ...
- 109
3
votes
0
answers
640
views
How to deploy FLS (Field Level Security) for all Objects & Fields in Scratch Org with application source push?
I'm trying to setup DX with Source code in Git and I'm pulling it from there and pushing it into a Scratch org. My Source code has multiple standard/custom objects with fields. But after Pushing code ...
- 5,900
3
votes
0
answers
126
views
Why would an app change Field Level Security settings en masse (unexpectedly)?
I installed an app (a managed package) to my org's Salesforce instance this morning, and shortly thereafter noticed that in FLS, visibility had been removed on dozens of important fields, across ...
- 1,224
2
votes
2
answers
2k
views
How to make custom object record only visible to certain users based on field checkbox
So I have a custom object in my org called Promotion Events. I would like to add a field called 'Private' that is a check box, and if it is checked and the event is created, this event(Promotion Event ...
2
votes
1
answer
742
views
Field level security pain in Apex tests when using packaging 2
In line with current security standards, we use with security_enforced extensively in our code. When doing CI (Continuous Integration) builds or working interactively we use sfdx force:user:permset:...
- 135k
2
votes
1
answer
500
views
IsUpdateable returns true for Admin profile, even though I removed edit access
I am running checks on fields in my Apex controller, to see if the logged in user has update access on a field before allowing an update. While logged in as Admin, when I check IsUpdateable() in my ...
- 4,947